Privacy policy

Who the controller is

The data controller is Jordi Bravo, based in Luxembourg.

• Controller: Jordi Bravo — full legal / trading name — to be supplied
• Address: full postal address in Luxembourg — to be supplied
• Privacy contact: contact email address — to be supplied

We have no data protection officer: given the volume and nature of the processing, one is not required. For anything at all, write to the address above or use the contact form.

What data we process

Only what the service needs:

• Account: your name, email address, password (stored hashed, never in the clear) and your chosen language.
• Study progress: which topics you have opened, which questions you have answered and whether you got them right, exam attempts and scores.
• Purchases: which access you hold and minimal payment metadata (checkout session id, amount, date, status). Card details never touch this site — Stripe handles them.
• Support: whatever you write in the contact form or in a question report, with your email address if you give it.
• Technical: your IP address and anti-abuse counters used to rate-limit logins, reports and contact messages.
• Analytics: only if you consent. No measurement id is configured at present, so no analytics tool loads even if you say yes.

Why, and on what lawful basis

• Giving you the account and the access you bought — performance of the contract (Art. 6(1)(b) GDPR).
• Storing your study progress — performance of the contract: it is the service itself.
• Taking and evidencing payment, and meeting accounting and tax obligations — contract and legal obligation (Art. 6(1)(b) and 6(1)(c)).
• Replying when you write to us — contract, or our legitimate interest in helping you (Art. 6(1)(b) / 6(1)(f)).
• Security and abuse prevention (rate limits, anti-spam) — our legitimate interest in protecting the service (Art. 6(1)(f)).
• Analytics and marketing measurement — your consent only (Art. 6(1)(a)), which you can withdraw at any time.

Who else has access

We do not sell or rent your data. It is shared only with the providers we need in order to operate, each for its own part:

• Stripe — payment gateway; it handles card data and returns only purchase metadata to us.
• Cloudflare — hosting for the site and its database.
• The service's email provider — delivery of transactional email (password resets, notices).
• Google Analytics 4 and Meta Pixel — audience measurement, only with your consent and only once configured.

Some of these providers may process data outside the European Economic Area. Where they do, the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision.

How long we keep it

• Account and progress: for as long as the account is active. If you ask us to delete it, we delete it.
• Purchase records and invoices: for as long as accounting and tax law requires.
• Contact messages and question reports: up to 24 months, so we can close the case and fix the content.
• Anti-abuse counters: hours to a few days; they expire by themselves.
• Analytics: whatever retention each tool sets, and only if you consented.

Your rights

At any time you can exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw any consent you gave without affecting processing already carried out.

Write to contact email address — to be supplied or use the contact form. We reply as soon as we can and, in any event, within the one month the GDPR allows.

If you think we got it wrong, you can complain to the Luxembourg supervisory authority, the Commission nationale pour la protection des données (CNPD, cnpd.public.lu), or to the authority of your own country of residence — in Spain, the Agencia Española de Protección de Datos (aepd.es).

Automated decisions

We do not profile you and we take no automated decisions producing legal effects concerning you. Your progress statistics are visible only to you.

Children

The service is aimed at adults preparing a civil-service exam. It is not intended for under-16s and we do not knowingly collect their data.

Changes

If we change this policy we will update the date below and, where the change matters, tell you by email or on the site itself.