Privacy Policy

Last updated: 20 September 2026

This Privacy Policy explains how SolEspañol, operated by Why Not Languages ("we", "us", "our"), collects, uses and protects personal information when you use SolEspañol.

We comply with the UK GDPR, the Data Protection Act 2018 and, where relevant, the ICO's Children's Code.

1. Information we collect

We may collect:

• account information, including first name, optional surname, email address, and authentication information managed securely by our authentication provider; we do not receive or store passwords in plain text;
• profile information, including school year, exam board and country;
• topic and term preferences, including topics studied and school term plan;
• learning information, including activities completed, quiz results, vocabulary performance, weak topics, Daily Revision completion, XP, streaks, progress and last activity;
• membership information, including subscription status, plan type, trial dates and billing status — we do not store full card details;
• marketing preferences, including the date, source and wording of consent where recorded;
• parent or guardian contact information where provided; and
• technical information, including device and browser information, security logs and limited usage information.

We aim to collect only what is reasonably necessary.

2. Why we use your information

We use personal information to create and secure your account; provide SolEspañol and its learning features; personalise Daily Revision and the 5-minute Challenge based on selected topics, progress and revision history; save and display progress; manage memberships, trials and subscriptions; provide customer support; maintain security and reliability; comply with legal obligations; and send marketing emails only where you have chosen to receive them.

3. Our lawful bases

Depending on the purpose, we rely on:

• Contract — for your account, the service, membership and core learning features;
• Consent — for marketing communications or where specifically required;
• Legitimate interests — for security, preventing misuse, improving the service and understanding usage, with particular care where users are children; and
• Legal obligation — where the law requires us to process information.

The ICO requires organisations to determine and document the appropriate lawful basis before processing.

4. Children's information

SolEspañol is designed primarily for secondary-school students, including users under 18. We take additional care and aim to apply high-privacy settings by default. Under UK law, a child aged 13 or over can generally give their own consent where processing relies on consent; a child under 13 needs consent given or authorised by a person with parental responsibility, with reasonable verification steps. Not all processing relies on consent — core account and learning functionality may rely on contract. We do not require marketing consent in order to use SolEspañol.

5. Personalised revision and profiling

SolEspañol uses topics studied, activity performance, revision history and weak areas to personalise recommendations in Daily Revision and the 5-minute Challenge. This personalisation is designed to support learning. It does not make decisions with legal or similarly significant effects on users. Students can update which topics they have studied from their account or profile settings.

6. Marketing emails

Marketing is optional. If you actively opt in, we may send your email address and relevant consent information to Brevo, our email-marketing provider, so we can send revision tips, product updates and offers. Marketing checkboxes are not pre-selected. You can withdraw marketing consent at any time by using the unsubscribe link in a marketing email or by changing your preferences in your account. Downloading the free GCSE Spanish Speaking Guide does not require you to agree to ongoing marketing. Where a parent or guardian email is supplied, it is only used for marketing where that person has separately opted in. The ICO says marketing consent should involve a clear positive action and organisations should keep records of when, how and what a person consented to.

7. Payments

Membership payments are processed by Stripe. Stripe processes card and payment information securely. SolEspañol does not receive or store your full card number. We may receive limited information from Stripe such as subscription status, plan type, trial dates, payment status, and customer or subscription identifiers. This is used to provide and manage membership access.

8. Service providers

We use third-party providers for website and app hosting and infrastructure; databases and authentication; payment processing; transactional email; marketing email; and analytics or security where enabled. Our hosting, database and authentication use Lovable Cloud managed services powered by Supabase. Our production database infrastructure is currently hosted in AWS US West (Oregon). These providers process information on our behalf only where necessary for their services. We periodically review which providers we use and the information shared with them.

9. International transfers

Some service providers may process information outside the UK. Where personal information is transferred internationally, we use appropriate safeguards required by UK data-protection law, where applicable.

10. Data security

We use appropriate technical and organisational measures designed to protect personal information, including access controls, authentication protections and restrictions on administrative access. No online service can guarantee absolute security, but we take reasonable steps to protect the information we hold.

11. How long we keep information

We keep account and learning information for as long as reasonably necessary to provide SolEspañol and maintain the account. If an account is deleted, we aim to remove or anonymise associated personal information within 30 days, unless we need to retain limited information for legal, accounting, fraud-prevention or dispute purposes. Marketing information is retained until you unsubscribe or otherwise ask us to stop using it, subject to limited suppression records where required to ensure we respect your opt-out.

12. Your data-protection rights

Your rights may include access, correction, deletion, restriction of processing, objection, data portability, and withdrawal of consent where processing is based on consent. Some rights are subject to legal limitations. You can update certain account information and marketing preferences directly through SolEspañol. For other requests, contact us using the details below.

13. Cookies and similar technologies

SolEspañol uses cookies and similar browser-storage technologies that are necessary for login, account security, membership and access control, payments, and essential operation of the service. These essential technologies do not require analytics consent.

With your permission, we also use limited first-party analytics and acquisition technologies to understand how SolEspañol is found and used. These may record page and form events, referral details, campaign parameters, an anonymous session identifier and whether a browser has visited before. They do not begin unless you choose "Allow analytics". If you choose "Essential only", we do not set or read these analytics identifiers or record these non-essential events. You can change your choice at any time using the "Privacy choices" control on the site. We do not currently use third-party advertising trackers such as Google Analytics, Meta Pixel or Hotjar. Browser analytics preferences are separate from email-marketing consent.

14. Changes to this Privacy Policy

We may update this Privacy Policy as SolEspañol develops or where legal requirements change. Where changes are significant, we will take reasonable steps to notify users.

15. Contact

SolEspañol is operated by Why Not Languages. For privacy enquiries or requests relating to your information, contact: abbie@whynotlanguages.co.uk.

You also have the right to complain to the Information Commissioner's Office (ICO) if you are unhappy with how your information has been handled. The ICO website is: ICO website.