Privacy Policy

Last updated: July 18, 2026

1. Introduction

Welcome to Spanish Driving Theory ("we," "our," or "us"). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, and share your personal data when you use our web application at spanishdrivingtheory.com (the "Service").

2. Data Controller

Zubair Idrees (operating as an Autónomo), registered in Spain with registered address at Carrer de la Indipendencia 74-76, 4-2, Badalona, Barcelona, Spain and NIF/NIE Z4606605D, is the data controller for the personal data collected through the Service.

Contact email: hello@spanishdrivingtheory.com

3. Data We Collect and Why (Legal Basis)

We only collect the data necessary to provide and operate the Service. We do not use third-party analytics, tracking cookies, or advertising.

• Account Data: Email address, hashed password, and account creation date.
  Purpose: To create and manage your account.
  Legal Basis: Performance of a contract (GDPR Art. 6(1)(b)).
• Payment Data: Handled entirely by our payment processor, Stripe. We never see or store your full credit card number. We only store your Stripe customer ID, subscription ID, plan type, subscription status, and billing period dates.
  Purpose: To manage your subscription and grant access to paid content.
  Legal Basis: Performance of a contract (GDPR Art. 6(1)(b)).
• Usage and Progress Data: Quiz attempts, scores, favorited/flagged questions, study streaks, XP/badges, last-read book chapter/section, bookmarked sections, and chapter checkpoint-quiz results.
  Purpose: To provide the core functionality of the app, track your learning progress, and operate the service.
  Legal Basis: Legitimate interest (GDPR Art. 6(1)(f)) to operate and provide a functional learning application to our users.

4. How Long We Retain Your Data

We retain your personal data for as long as your account is active or as needed to provide you the Service. If you delete your account, your personal data will be deleted or anonymized, except where retention is required for legal or tax compliance purposes (e.g., records of payments).

5. Sub-processors and Data Transfers

We do not sell your personal data. We only share data with the following essential service providers (sub-processors):

• Supabase: Provides database hosting, authentication, and file storage. Data is hosted in Ireland (EU).
• Stripe: Processes payments. Stripe may process data in the United States and globally.
• Vercel: Hosts our web application infrastructure. Vercel may process data globally.

Where data is transferred outside the EU/EEA (such as to the US via Stripe or Vercel), we ensure it is protected by appropriate safeguards, typically Standard Contractual Clauses (SCCs) approved by the European Commission, in compliance with GDPR requirements.

6. Your Rights Under GDPR

As an EU resident, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure ("Right to be forgotten"): Request deletion of your data.
• Portability: Receive your data in a structured, machine-readable format.
• Objection/Restriction: Object to or restrict our processing of your data.

To exercise these rights, please contact us at hello@spanishdrivingtheory.com.

You also have the right to lodge a complaint with a supervisory authority. For users in Spain, this is the Agencia Española de Protección de Datos (AEPD), or you may contact the data protection authority in your local member state.

7. Data Breaches

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and we will notify affected users without undue delay.

8. Children's Privacy

Our Service is not directed to individuals under the age of 16. You must be at least 16 years old to create an account. We do not knowingly collect personal data from children under 16.