Privacy policy

1. Data controller

• Controller: José Luis Alegre Llopis
• VAT / tax ID: 12345678Z
• Postal address: Sagunto, Valencia
• Contact: soporte@testcelador.com

2. What data we process

• Account and contact data: email, optional name, language, time zone, role, and account status.
• Authentication and security data: encrypted passwords, email verification, 2FA codes, sessions, device identifiers, IP, logs, and security events.
• Academic usage data: visible topics, attempts, answers, progress, statistics, metrics, and quiz or exam drafts.
• Billing and subscription data: customer or subscription identifiers in the payment gateway and the status of the purchased plan. We do not store the full card number.
• Academy relationship data: memberships, invitations, linked students, and teacher metrics when the user participates in an academy.
• Support, incident, and necessary communication data related to the account or the purchase.
• Technical preferences and, where applicable, consent regarding cookies or similar technologies.

3. Purposes and legal bases

We do not make exclusively automated decisions with legal or similarly significant effects on the user without meaningful human involvement.

4. Data retention

• Account data: while the account remains active. After account deletion, direct identifiers are anonymized, access is disabled, and sessions/devices are revoked.
• Academic data, metrics, and history: attempts and aggregate metrics may be retained dissociated from the account to preserve academic and service integrity.
• Security and audit data: login audit is retained for 180 days and account/billing administration audit for 365 days, unless an active legal hold requires longer preservation; identifiers are minimized on account deletion.
• Billing and subscription data: for the periods legally required under accounting, tax, contractual, support, and Stripe reconciliation rules.
• Optional-cookie choice is stored in the browser for up to 12 months; the versioned grant, rejection or withdrawal proof is retained for up to 5 years unless a legal hold applies.
• Encrypted immutable backups rotate under the approved infrastructure lifecycle. Deleted data may remain temporarily until expiry; a restore must reapply deletion requests made after the backup.

5. Recipients, internal access, and processors

• Internal access to data is limited to the owner and to authorized staff or collaborators strictly necessary for support, security, billing, or administration.
• If you belong to an academy, that academy's teaching staff may access the information necessary to manage students, invitations, and metrics linked to that relationship.
• Hosting provider: ovh.es in UE/EEE.
• Payment and subscription provider: Stripe, in the context of purchasing and managing the paid plan.
• Transactional email provider: mailer@testcelador.com.
• Anti-abuse service: Google reCAPTCHA v3, loaded only in protected forms. Google receives the token and standard request metadata; the application does not send the IP in the verification form.

When any of these providers implies international data transfers, the safeguards required by the GDPR will apply, such as standard contractual clauses or adequacy decisions where applicable.

6. User rights

You can exercise the rights of access, rectification, erasure, objection, restriction of processing, and portability, as well as withdraw your consent when processing is based on it.

From your account page you can download a JSON export and request account deletion/anonymization. You can also contact us for any right that requires manual handling.

We will acknowledge and resolve verified rights requests within the applicable period, no later than 30 days unless a lawful extension applies and is communicated.

To exercise them, write to soporte@testcelador.com clearly indicating your request and the contact method with which you registered.

If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Security and confidentiality

We apply reasonable technical and organizational measures to protect personal data against loss, unauthorized access, alteration, or improper disclosure.

• Access controls, password hashing, session protection, and security policies.
• Monitoring and audit logs to detect abuse or risky activity.
• Form and access protection measures when required by the environment.
• Internal procedures for review, traceability, and data minimization.

8. Minors and proper use

The platform is not aimed at children under 14. If we detect an account created in breach of this rule or using third-party data without sufficient authorization, we may limit or cancel it.

Users must use the platform in line with its study and academic-management purpose, without providing unnecessary or unauthorized personal data about third parties.