Privacy Policy
Last updated: 2026-05-04
IALACOLREG processes the minimum personal data needed to run a free study platform. This page explains exactly what we collect, why, who can see it, and how to exercise your rights under GDPR (Regulation (EU) 2016/679) and Spanish LOPDGDD.
1. Data controller
IALACOLREG (operated from Spain). For any data-protection question, write to privacy@ialacolreg.com. You may also contact the Spanish supervisory authority (AEPD, www.aepd.es).
2. What we collect
If you sign in with Google: your email, name and avatar URL from your Google account, plus your study activity (test attempts, scores, mistakes, streaks and any certifications you earn). If you only browse without signing in: aggregate, non-identifying usage metrics and a small amount of local storage in your browser to remember the questions you got wrong and your locale.
3. Why we process it
To provide the service (display your dashboard, save your progress, deliver lesson content), to improve content quality (aggregate analytics on which rules are studied), and to issue certifications when you pass the final exam.
4. Legal basis
Performance of contract (GDPR Art. 6.1.b) for the signed-in dashboard. Legitimate interest (GDPR Art. 6.1.f) for security logging and aggregate, non-identifying analytics. Explicit consent (GDPR Art. 6.1.a) for non-essential cookies and third-party analytics, requested via the consent banner.
5. Recipients (subprocessors)
Supabase (auth, database, file storage; rows are scoped to tenant 7). Vercel (hosting, edge cache, optional product analytics — only if you accept). Google (OAuth sign-in only; we receive your name/email/avatar). Google Tag Manager / Google Analytics (only if you accept the analytics consent). We do not sell or rent personal data.
6. International transfers
Supabase, Vercel and Google process data in the United States and other regions. We rely on the European Commission's adequacy decisions and Standard Contractual Clauses (SCCs, GDPR Art. 46) where required. You can request the relevant DPAs by writing to privacy@ialacolreg.com.
7. Retention
Account profile: kept while your account is active and deleted within 30 days of an account-deletion request. Test attempts and certifications: kept for the lifetime of the account so you can review your history. Analytics: aggregated, with no individual identifier kept beyond 14 months. Server logs: 30 days.
8. Your rights
Access, rectification, erasure, portability, restriction and objection (GDPR Art. 15-22). Signed-in users can download their data and delete their account directly from the dashboard at /me. Otherwise email privacy@ialacolreg.com — we respond within 30 days.
9. Cookies and local storage
Strictly necessary: a Supabase session cookie when you are signed in, and a locale preference cookie. Functional (browser localStorage): your wrong-answer review queue (key 'ialacolreg_mistakes') and your in-app progress (key 'ialacolreg_progress'). Analytics: only loaded after you accept in the consent banner; can be revoked at any time by clearing the 'ialacolreg_consent_v1' key from your browser.
10. Analytics
We use Google Tag Manager (loading Google Analytics 4) and Vercel Analytics for aggregate usage metrics. Both are loaded only after you click "Accept all" in the consent banner. No cross-site advertising or behavioural profiling is done by default.
11. Complaints
If you believe your data has been mishandled, you may lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — www.aepd.es) or your local EU/EEA supervisory authority.