Privacy policy

1. Controller

• Provider: Miguel Segarra
• Tax ID: 44894880F
• Address: San Valeriano 6, 28039 Madrid, España
• Privacy contact: infoacentoacademia@gmail.com

2. What we process and why

• Account: e-mail, name and country, to give you access to what you buy. Basis: performance of the contract.
• Purchases: course, amount, payment session identifier and invoice. Basis: contract and legal tax obligation.
• Consent to immediate access: the text you accepted, the date and the version of the terms. Basis: legal obligation (Art. 16(m) Directive 2011/83/EU).
• Progress: which lessons you completed and your placement test result. Basis: performance of the contract.
• Source: if you arrived through a tagged campaign link (a QR code, a post), that tag is stored — never the page you were on before, never your browsing. It tells us which channels work. Basis: legitimate interest. You can ask us to delete it.
• Waiting list: e-mail, language and course of interest, only if you ask. Basis: your consent, withdrawable at any time.
• Security: IP address and timestamps used to rate-limit abusive requests. Basis: legitimate interest in protecting the service.

3. What we do NOT do

• No device fingerprinting or equivalent covert identification.
• No advertising, no third-party pixels, no tracking cookies.
• We never sell or share personal data.
• No automated decisions with legal or similarly significant effects. If a security check flags unusual use, it alerts a person; suspending an account is always a human decision and can be appealed.
• No behavioural profiling beyond your progress through the courses.

4. Video watermark

Videos display a short code over the player. It is a pseudonym derived from your internal identifier: not your e-mail, not your name, and it reveals nothing about you to anyone who sees it.

That is deliberate. If a video ended up circulating outside the platform, a visible identifier containing your e-mail would be a disclosure of your personal data caused by our own security measure. The pseudonym deters just as well without that risk.

5. Processors and data location

Data processing agreements are in place with all of them. Those outside the EEA operate under the safeguards of Chapter V GDPR.

• Supabase — database and authentication.
• Vercel — application hosting.
• Stripe — payment processing and invoicing.
• Bunny.net (Slovenia, EU) — video hosting and delivery.

6. Retention

• Account and progress: while your account is open. If you close it, data is deleted except what must be kept by law.
• Invoicing: six years, under commercial and tax rules.
• Purchase consents: five years, the limitation period for personal actions under Spanish law.
• Security records: held in memory for the length of the rate-limiting window and not stored.
• Waiting list: until the course launches or you unsubscribe.

7. Your rights

You may exercise access, rectification, erasure, objection, restriction and portability by writing to infoacentoacademia@gmail.com. We reply within one month at the latest.

If you believe we have handled this badly, you may complain to the Spanish Data Protection Agency (www.aepd.es) or to the supervisory authority of your country of residence.