Back to Apuntivo

Privacy

Version: 15 October 2026

This information explains which data Apuntivo uses, why it needs it and how you can exercise your rights. Do not enter other people’s data without authorization or sensitive information that is not necessary for studying.

On this page

Controller and contact

The owner identified below is the controller of your data in Apuntivo. Their full identification details appear in the legal notice.

Boet Roef van Dongen

soporte@apuntivo.com
Legal notice

Data we use

Account and access data: the name you provide, email address, date of birth and, where applicable, guardian’s email. Authentication is managed by Supabase; do not send us your password by email.

If you choose to sign in or create your account with Google, Supabase receives your Google account identifier, email and, when Google supplies them, your name and profile photo link. We use this data to create your account or authenticate access to Apuntivo. This option does not grant access to Gmail or Google Drive.

Study materials and activity: documents you upload, extracted text, messages, generated resources, answers, audio, space organization and preferences. Technical data, errors and usage needed to protect the service and verify its operation are also recorded.

Payments: Stripe processes payment-method data. Apuntivo records customer, subscription and invoice references, payment status and available allowance; it does not store your full card number.

Account creation, storage of materials and the functions you request rely on performance of the contractual relationship. Invoice management and other enforceable obligations rely on compliance with the law.

Security, abuse prevention and incident investigation rely on the legitimate interest of maintaining a secure service, with access limited to necessary data. You may object where applicable due to your particular circumstances. Any optional processing requiring consent will be requested separately; reading this policy does not constitute universal consent.

Optional emails

From age 14, you may separately choose to receive Apuntivo news and improvements or offers and discounts at your account’s email. These preferences are disabled when the account is created and enabled only if you choose them. The legal basis is your consent; you do not need to enable them to use the service.

You can withdraw each choice at any time in Account, under Apuntivo emails, without affecting use of your account or prior lawful processing. Necessary security and billing notices are independent of these preferences. We do not enable news or offers for children under 14; guardian authorization does not include advertising.

The waiting list in Plans asks for separate permission to send one email when paid plans open. You can withdraw it using the same switch; joining does not enable news, offers or a subscription. We store your confirmed email, language, consent text and version, signup date and changes to your choice. It is deactivated if your email changes or you close your account. News and offers preferences are stored with your profile and deleted when account content is erased.

Providers and artificial intelligence

Supabase provides authentication, databases and files; Vercel hosts the application; Resend handles automated emails; and Stripe handles payments. Stripe may process certain data as a controller for its own obligations and purposes, under its privacy information.

When you use “Report a problem”, we send your comment and your account’s verified email through Resend to our support inbox to review the issue and reply. If you email support directly, Cloudflare routes your message and Google provides the inbox where we handle it. Do not send passwords, full card numbers or photographs of identity documents.

When you request an AI function, DeepInfra processes the content needed for study tools, corrections, audio scripts and voices. Anthropic processes Nubo queries. In paid plans, search by meaning uses OpenAI to prepare and query an index of source text when that feature is active. Text extraction and OCR run in your browser without using AI allowance. Merely opening this page does not send your material to an AI provider.

Data needed to host Apuntivo, manage accounts and send emails may be processed outside the European Economic Area. Supabase and Vercel incorporate the European Commission’s standard contractual clauses into their agreements where applicable. Resend stores data in the United States and safeguards transfers through those clauses, with the Data Privacy Framework as an additional mechanism. Stripe applies mechanisms in its transfer addendum according to the service and its role.

The linked agreements explain these safeguards; you can also request a copy through Apuntivo’s contact channel. A European application or email region does not mean all this data stays in Europe. Cloudflare, Google and AI providers explain their respective processing in their policies; you can ask through the contact channel about recipients and safeguards for the workflow you need.

Retention

Study content and account data are retained as long as necessary to provide the service and respect your retention or deletion choices. You can delete materials from the study space or request deletion of the account.

The guardian approval link expires after 48 hours; this does not delete the request or evidence of authorization or withdrawal. We review pending requests weekly and, after 30 days without completion, review with the requester whether to continue or close them. Evidence is retained while access depends on it and afterwards only as needed for obligations or claims, with restricted access and monthly review of its necessity.

Ordinary support inquiries are deleted from our copies and inbox 30 days after resolution unless they must form part of a rights, security or complaint file. Auxiliary export copies are removed when delivery is confirmed and within 30 days at most if no issue remains open. These reviews and removals are the controller’s tasks, not automatic deletion of all information.

Vercel execution logs are retained for one day in the service used; Supabase’s log viewing window is seven days, which does not mean all account audit tables are deleted. Resend retains emails and logs for 30 days and backups for seven. Supabase database backups are kept for seven days; protected local backups are reviewed monthly and replaced or removed when no longer needed for service recovery. Backups are not used as active accounts, and affected deletion requests are reviewed before restoration.

When closing an account, payment evidence, usage records and evidence essential to legal obligations or claims may need to be retained with restricted access. The request is reviewed to identify what is deleted, what must be retained and why; exceptions are reviewed monthly and end when their grounds cease. An invoice does not justify retaining all study material. Canceling renewal does not itself delete the account.

Your rights

You may request access, rectification, erasure, restriction, objection and portability where applicable, and withdraw consent without affecting prior lawful processing. Write from your account’s email and specify your request. If we need to verify your identity, we will request only information proportionate to the case; do not send photographs of documents initially.

We generally respond within one month; if complexity or the number of requests requires a lawful extension, we inform you within that first month. You may complain to the Spanish Data Protection Agency if you consider that your rights have not been respected.

Minors

Date of birth allows access to be adapted. For children under 14, the account remains pending until the person controlling the guardian’s email declares parental authority or guardianship and authorizes the informed processing. We retain the supplied email, information version, declaration and authorization or withdrawal dates. The link confirms inbox access; it does not itself establish identity or legal representation, and proportionate checks may be needed.

The guardian’s email includes another link to reject the request or withdraw authorization without accessing the student’s account. While authorization is required, withdrawal blocks study functions and new purchases; it does not automatically delete the account or cancel a subscription. You can request erasure or rectification through our contact channel. From age 14, students may consent to processing themselves, subject to legal exceptions. Subscriptions must be purchased by someone with legal capacity to do so; data authorization does not constitute purchasing or paying.

Cookies and browser storage

The application uses session cookies and local storage for necessary functions such as maintaining access and remembering study-space preferences. This workflow does not incorporate advertising cookies or commercial tracking tools. If optional functions requiring them are added, we will provide information and request the relevant choice before activation.

You can delete this data in your browser; doing so may sign you out or reset preferences, but does not delete materials saved in your account. External payment and provider pages explain their own cookies.

Provider information

Spanish Data Protection Agency