Privacy
Last updated 23 October 2026.
Who is responsible
The operator's legal name, tax ID, address and email are published here before passes go on sale.
What is stored and why
| Data | Why | How long |
|---|---|---|
| Your email address | To sign you in and run your account | Until you delete the account |
| Sign-in codes, stored only as a hash, with the email address each was sent to | To check the code you type | A code works for ten minutes. It is deleted when you use it or ask for a new one, and an hourly cleanup deletes expired codes. |
| A session cookie with a random token; the site keeps only its hash | To keep you signed in | Until you sign out, or 30 days after your last visit if sooner. A visit extends it at most once a day, and an hourly cleanup deletes expired sessions. |
| Your level, sitting, weekly hours and email preference | Your dashboard and study plan | Until you change them or delete the account |
| Your answers and scores in practice sets and mock exams | Your progress and the next task suggested to you | Until you delete the account |
| Passes: product, dates, amount, payment references and when you accepted the terms | To give you access and keep sales records | Kept as sales records. Deleting your account deletes the account and its email address, but these records keep their payment references, which Stripe can link to the buyer. |
| Counts of recent requests, kept under your network address, the email address you entered or your account | To limit repeated sign-in attempts and saved practice results | Up to a day |
Account and progress data are processed to provide the service you signed up for. Rate limits rest on the site's interest in keeping accounts safe. Emails about new material are sent only if you tick that option on the account page, and you can untick it at any time.
Data that stays on your device
Writing drafts and speaking recordings stay in your browser and are not sent to the site. A practice result you check before signing in waits in the same browser tab and is saved to your account only if you then sign in.
Cookies and analytics
The only cookie is the session cookie, set when you sign in. Visits may be counted with Cloudflare Web Analytics, which sets no cookies and does not identify you.
Who processes the data
Cloudflare hosts the site and its database, sends the sign-in emails and provides the visit counts. Stripe handles payments as merchant of record and processes your payment data under its own privacy policy; Apto DELE receives the payment result and references, not card details. Both companies work in several countries under the safeguards set out in their terms.
Your rights
You can see, download and delete your data from the account page. You can also ask for access, correction, deletion, portability or restriction, or object to processing, by writing to the address above. If you think your data is mishandled, you can complain to the Agencia Española de Protección de Datos (aepd.es).
Changes
This policy may change; the date at the top shows the current version.