Privacy policy
Last updated: 26 September 2026
Who is responsible
- Controller: [LEGAL NAME], tax number [NIF]
- Address: [FULL ADDRESS], Spain
- Data protection contact: [PRIVACY EMAIL]
- Data protection officer: [state one if appointed; otherwise delete this line]
What we process, why, and on what basis
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name, email, hashed password | Creating and running your account, verifying your address, signing in | Performance of the contract | While the account is active, plus 1 year |
| Billing country and address, tax number if you give one | Working out the applicable tax and issuing your invoice | Legal obligation (tax law) | 6 years from the transaction |
| Amount, date and reference of each payment | Running the subscription, refunds and accounting | Contract and legal obligation | 6 years |
| Which classes you favourite or finish, and where you stopped in each | Delivering the service (resuming a class where you left off, showing your progress through a course) | Performance of the contract | While the account is active |
| Newsletter sign-up for a studio | Sending you that newsletter | Consent (double opt-in) | Until you unsubscribe |
| IP address, browser, server logs | Security, fraud prevention and diagnosing faults | Legitimate interest in keeping the service safe | 12 months |
| Content reports and moderation decisions | Handling the report and evidencing the decision | Legitimate interest and legal obligation | 3 years |
We do not process health data. We never ask for medical information, and we ask you not to include it in messages or forms.
We do not profile you for advertising, sell your data, or pass it to advertisers. There are no automated decisions with legal effects on you.
Card details
We do not store your card. Payment details go straight into Stripe's payment page; we only receive a payment reference, the amount and the last four digits.
If you are a teacher
We also process your studio details (name, description, photo), what is needed to pay you through the payment provider, and the records of your sales and settlements. The basis is performance of the contract and our tax and accounting obligations. Transaction records are kept for 6 years.
The identity verification required before you can receive payments is carried out by the payment provider as its own controller; we never receive your documents.
Processors and recipients
| Provider | Purpose | Where |
|---|---|---|
| Stripe Payments Europe, Ltd. | Payment processing and payouts to teachers | Ireland, with transfers to the USA under standard contractual clauses |
| BunnyWay d.o.o. (Bunny.net) | Hosting and delivering the videos | EU, with a global delivery network |
| [INVOICING PROVIDER — Finseed] | Issuing invoices and filing them under Verifactu | Spain |
| [EMAIL PROVIDER] | Transactional email and newsletters | [COUNTRY] |
| [HOSTING PROVIDER] | Application servers and backups | [COUNTRY], EU |
| Spanish Tax Agency (AEAT) | Receiving the invoicing records | Spain |
Each processes data on our instructions under a processing agreement, except Stripe and the AEAT, which act as controllers in their own right for their part.
If a teacher sends you their newsletter, that teacher is an independent controller for that message.
International transfers
The application and the database are hosted in the European Union. Some transfers outside the EEA may happen through Stripe and the video delivery network; both are covered by standard contractual clauses approved by the European Commission.
Your rights
You can exercise your rights of access, rectification, erasure, restriction, portability and objection at any time, and withdraw consent where processing is based on it, by writing to [PRIVACY EMAIL] from the address on your account. We answer within one month.
You can also do two of these yourself, at any time, from Your data in your account menu: download a copy of everything we hold about you (in JSON, a format other services can read), and erase your account. Erasure removes your name, email address, password, practice history and newsletter subscriptions straight away and ends any running membership without another charge. A teacher account with a studio is closed with support, so that sales and payouts are settled first.
Some data cannot be erased when you close your account: invoicing records must be kept by law for the period stated above. In that case we block the data and keep it available only to the competent authorities.
If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).
Security
Connections are encrypted, passwords are stored with a slow hashing function, administrative access requires two-factor authentication, and videos are served through short-lived signed links. We take daily backups. If a breach occurs that poses a high risk to your rights, we will tell you without undue delay.
Minors
The service is not intended for anyone under 18 and registration is not permitted.
Changes
Any change is published here. If it affects the purpose or the legal basis of processing, we will email you before applying it.