Privacy Policy and Personal Data Protection
In compliance with the General Data Protection Regulation (EU GDPR 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD).
1Data Controller
The data controller responsible for personal data collected through this platform under the GDPR is the service provider identified in the Legal Notice.
Direct contact email for privacy inquiries and exercising rights: contacto.
2What Personal Data We Collect and How We Obtain It
We process only data strictly necessary to provide the interactive educational service:
- Email address: Provided directly upon registration or checkout, used to deliver passwordless Magic Links, purchase receipts, and service notices.
- Exam answers and progress: Scores obtained across Reading, Listening, Writing, and Speaking to compute your Pass/Fail verdict and progress history.
- Audio recordings and transcripts (Speaking Test): Voice samples recorded during speaking tasks for real-time transcription and pedagogical evaluation based on official Instituto Cervantes rubrics.
- Transaction and payment data: Session ID and payment status provided by Stripe. Note: We never have access to or store your complete payment card number or CVV security code.
3Purpose and Legal Basis for Processing
Educational Service Provision
Managing your student account, authentication, access to 20 simulations for 90 days, and delivery of score reports.
Legal basis: Performance of a contract (Art. 6.1.b GDPR).
Artificial Intelligence Evaluation
Processing written responses and audio recordings with language models to provide instant grading and feedback.
Legal basis: Explicit consent (Art. 6.1.a GDPR).
4Data Retention Period
Your data will be retained during the active access period (90 calendar days from payment) and subsequently for statutory periods required to comply with fiscal and accounting obligations (up to 5 years for billing). Voice recordings are processed in ephemeral memory and discarded after transcription and grading.
Users may request the total deletion of their account and data at any time by contacting our privacy email.
5Recipients and Service Providers (Data Processors)
We do not sell or transfer your data to third parties for advertising purposes. For platform operation, we rely on trusted industry-leading security partners under Data Processing Agreements (DPA):
- Stripe Payments Europe, Ltd. (Secure payment gateway certified PCI-DSS Level 1).
- Resend Technologies, Inc. (Secure transactional email delivery for Magic Links).
- Google Cloud Platform (Vertex AI) / Anthropic (Language model infrastructure for automated grading and phonetic transcription).
- Vercel, Inc. (High-availability cloud web hosting with TLS encryption).
6Your Data Protection Rights (GDPR)
You have the following rights recognized by the GDPR at all times:
- Right of Access: Know what personal data we hold about you.
- Right to Rectification: Request the correction of inaccurate or incomplete data.
- Right to Erasure ("Right to be Forgotten"): Request the permanent deletion of your data from our systems.
- Right to Restriction and Objection: Limit or object to data processing in statutory circumstances.
- Right to Data Portability: Receive your data in a structured, commonly used digital format.
To exercise any of these rights, send an email with your request to contacto from the email address associated with your account.