Privacy Policy

Last updated: 27 June 2026

This Privacy Policy explains how SolEspañol ("we", "us") collects, uses and protects personal data when you use this website. We comply with the UK GDPR and the Data Protection Act 2018.

1. What personal information we collect

• Account details: first name, surname (optional), email address, password (encrypted, never stored in plain text).
• For students under 16: a parent/guardian email address.
• School year, exam board, and country (optional).
• Marketing consent preferences.
• Learning activity: XP, streaks, quiz scores, topics studied, daily revision completions, last login.
• Technical data: device, browser and anonymised usage information for security and improvement.

2. Why we collect it

• To create and secure your account.
• To track your learning progress and personalise revision.
• To contact parents/guardians of under-16 users for safeguarding where necessary.
• To send you optional marketing (revision tips, new features, offers) — only if you opt in.
• To comply with our legal and safeguarding obligations.

3. How we store your data securely

Your data is stored on encrypted databases hosted by Supabase (EU region). Passwords are hashed using industry-standard bcrypt and are never accessible to staff. Access to personal data is restricted to authorised administrators and protected by role-based access control.

4. Marketing emails

If you opt in to marketing, your email may be added to our marketing platform (Brevo) so we can send you revision tips, product updates and offers. You can unsubscribe at any time from the link in any marketing email or from your account page. Parent/guardian emails are only added to a marketing list if their own separate consent is given.

5. Payment information

When premium subscriptions become available, all payment information will be processed securely by Stripe. SolEspañol does not see, store or process your card details.

6. Your rights

• Access: download a copy of your data from your account page.
• Deletion: request deletion of your account and all associated data from your account page. We will remove your data from our database and from Brevo within 30 days.
• Correction: update your details at any time from your account.
• Withdraw consent: turn off marketing emails at any time.

7. Children's data

If a student is under 16, we require confirmation that a parent or guardian has given permission to create the account. Parents may at any time request access to or deletion of their child's data by contacting us.

8. Data retention

We keep your data while your account is active. If you request deletion, we remove your personal data within 30 days, except where we are required to keep records by law.

9. Contact

For any privacy enquiry — including data access or deletion requests — please contact:

• Privacy enquiries: [email placeholder]
• Postal: [address placeholder]

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.