Privacy Policy

1. Data we collect

• Account data — your email address and a securely hashed password (we never store your actual password).
• Profile data — display name, profile picture (if provided), Spanish dialect preference, CEFR level, your reason for learning, any free text you write describing your learning goal, target date, and daily time goal.
• Subscription and payment data — your subscription status and plan, and a customer reference ID used to link your account to Stripe (our payment processor). We do not store your card details or billing address — these are collected and held entirely by Stripe. We do pass your unique account ID to Stripe so we can match your payment to your account.
• Usage data — lessons completed, flashcard and quiz scores, streaks, experience points, and related learning-progress timestamps.
• Technical data — your IP address may be temporarily logged against specific API requests for abuse-prevention purposes (see Section 8).
• Communications — any support emails you send us.

We do not knowingly collect any data from, or aimed at, children under 13. We do not collect special category (sensitive) data.

2. How we use your data

• To personalise your lessons and track your learning progress.
• To manage your account and subscription.
• To send essential transactional emails (e.g. signup confirmation, billing).
• In aggregated, anonymised form, to improve Rumbo.
• To respond to support requests.
• To prevent abuse of our systems (see Section 8).
• To meet our legal and tax obligations.

3. Legal basis for processing

We rely on: Contract(to provide the service you've signed up for); Legitimate interests (product improvement and fraud/abuse prevention); Legal obligation (tax and financial record-keeping); and Consent (for analytics and advertising cookies — see Section 7).

4. Who we share data with

We do not sell, rent, or trade your personal data. We share it only with the following service providers, each acting under their own data protection terms:

• Supabase — our database and authentication provider. Data is hosted in Ireland (EU — AWS eu-west-1).
• Stripe — payment processing. PCI-DSS compliant; we never see or store your full card details or billing address. We pass your unique account ID to Stripe so payments can be matched to your account. Their privacy policy is available at stripe.com/gb/privacy.
• Anthropic — powers our AI-generated lessons and conversation practice. Lesson prompts include your CEFR level and learning goal, but never your name or email. Anthropic does not use this data to train its models.
• Resend — sends transactional emails (e.g. signup confirmation). They receive your email address only to deliver those emails.
• Vercel — hosts our application.
• Meta — if you accept analytics/advertising cookies (see Section 7), we use the Meta Pixel to measure ad performance on our marketing pages. Separately, when you complete a paid subscription, we send Meta a one-way, irreversibly scrambled (hashed) version of your email address so Meta can measure ad conversions — this happens regardless of your cookie choice, as it is a core part of processing your purchase, and Meta cannot reverse the scrambling to recover your actual email.
• Google — if you accept analytics cookies (see Section 7), we use Google Analytics to understand how visitors use our marketing pages.

We may disclose your data if required by law, court order, or to protect the safety of our users or the public.

5. Data retention

If you ask us to delete your account, we will delete your personal data within 30 days, except where we are required to keep financial records for up to 7 years for tax purposes. We don't currently offer in-app self-service deletion — to delete your account, email hello@rumbospanish.app and we will action this manually.

Aggregated, anonymised data (which can no longer identify you) may be retained indefinitely to help us understand product trends.

6. Your rights

Under UK GDPR you have the following rights. You can exercise any of them by emailing us at hello@rumbospanish.app.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data correctly. We would appreciate the opportunity to address your concerns first.

7. Cookies and tracking

When you first visit Rumbo, we ask whether you're happy for us to use analytics and advertising cookies. Until you make a choice, and unless you choose “Accept”, we do not load Google Analytics or the Meta Pixel — nothing is tracked. You can change your mind at any time by clearing your cookies, which will show the banner again.

If you accept, we use: Google Analytics, to understand how visitors use our site; and the Meta Pixel, to measure the effectiveness of our advertising.

Regardless of your cookie choice, we use one piece of essential local storage to remember your onboarding answers as you move through signup, and a small first-party cookie to remember your cookie choice itself.

8. Abuse prevention and security logging

To protect Rumbo from automated abuse (for example, bots making excessive requests), we may temporarily log the IP address, the specific feature accessed, and the time of certain requests. This data is used only for abuse prevention and is not linked to your account or used for any other purpose.

9. International data transfers

Where any of our service providers process data outside the UK/EU without an adequacy decision in place, we rely on Standard Contractual Clauses (SCCs) or an equivalent safeguard to protect your data.

10. Security

• All data in transit is encrypted via HTTPS.
• Passwords are hashed, never stored in plain text.
• Access to your data is restricted by access controls.

11. Changes to this policy

If we make material changes to this policy, we will give you at least 14 days' notice before they take effect.