Privacy Policy
Last updated: 2026-05-20
IALACOLREG processes the minimum personal data needed to run a free study platform. This page explains exactly what we collect, why, who can see it, and how to exercise your rights under GDPR (Regulation (EU) 2016/679) and Spanish LOPDGDD.
1. Data controller
The data controller is CONSBA, SCCL. (NIF F43642412), Passeig de la Clotada 36, 43560 La Sénia (Tarragona), España — the cooperative that operates IALACOLREG. For any data-protection question, write to privacy@ialacolreg.com. You may also contact the Spanish supervisory authority (AEPD, www.aepd.es).
2. What we collect
With Google sign-in, we receive your name, email and avatar URL and store your IALACOLREG profile, submitted test results and practice certificates. Your browser also stores learning activity, study-page visits, dates, scores, durations, mistakes, preferences and saved radio-practice evidence, including when you are not signed in. Group quizzes store the nickname and result you submit for their shared leaderboard. Hosting processes technical request data; optional analytics and advertising use the consent choice described below. Optional agent notebooks store study links, notes and a pseudonymous owner identifier separately from exam records.
3. Why we process it
To deliver lessons, show your learning history, save results, run group quizzes and issue practice certificates for qualifying results. These certificates are records of practice, not official qualifications. Optional analytics help us understand usage and improve the content.
4. Legal basis
Performance of contract (GDPR Art. 6.1.b) for the signed-in dashboard. Legitimate interest (GDPR Art. 6.1.f) for security logging and aggregate, non-identifying analytics. Explicit consent (GDPR Art. 6.1.a) for non-essential cookies and third-party analytics, requested via the consent banner.
5. Recipients (subprocessors)
Supabase provides sign-in, database and content storage; Vercel provides hosting. Google provides optional Google sign-in. With full consent, the site also loads Vercel Analytics, Google Tag Manager / Google Analytics, Google AdSense and Mediavine Grow. Hosting and sign-in are separate from the optional analytics choice. We do not sell or rent personal data. Cloudflare hosts the optional agent notebook and credential service.
6. International transfers
Supabase, Vercel and Google process data in the United States and other regions. We rely on the European Commission's adequacy decisions and Standard Contractual Clauses (SCCs, GDPR Art. 46) where required. You can request the relevant DPAs by writing to privacy@ialacolreg.com.
7. Retention
Account profile: kept while your account is active and deleted within 30 days of an account-deletion request. Test attempts and certifications: kept for the lifetime of the account so you can review your history. Analytics: aggregated, with no individual identifier kept beyond 14 months. Server logs: 30 days. Claimed agent notebooks can be deleted from Agent notebooks or through account deletion; revoking access alone keeps the notes for the owner.
8. Your rights
Access, rectification, erasure, portability, restriction and objection (GDPR Art. 15-22). The signed-in dashboard at /me exports the stored IALACOLREG profile, test history, streak record and practice certificates, and can delete those site records. This does not erase the shared sign-in identity, group-quiz records or browser storage. For these or other data requests, email privacy@ialacolreg.com. Applicable statutory response periods apply. The account export also includes your claimed agent notebooks.
9. Cookies and local storage
Session and language cookies support sign-in and language preferences. Browser storage holds mistakes, local learning history, settings, radio-practice evidence and the consent choice. Actual keys include 'ialacolreg_mistakes', 'ialacolreg_learning_v1:' and 'ialacolreg_consent_v1'. Use Cookie settings in the footer to change consent; the page reloads automatically when you withdraw it. Browser site-data controls can clear local records.
10. Analytics
After full consent, the site loads Google Tag Manager for Google Analytics, Vercel Analytics, Google AdSense and Mediavine Grow. Analytics measure usage; advertising helps fund access. Accepting includes the optional analytics and advertising services. Cookie settings in the footer let you reopen the consent controls.
11. Complaints
If you believe your data has been mishandled, you may lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — www.aepd.es) or your local EU/EEA supervisory authority.