Privacy policy

At the Cultural & Language Clinic for Spanish we take the protection of your personal data seriously, in accordance with Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

Controller: Clínica Cultural. Tax ID: 08916742X. Address: M. Magdalena, 5, Estepona (Málaga), Spain. Contact email: clinicacultural@gmail.com. We have not appointed a Data Protection Officer, as it is not legally required; you may use the contact email for any data-protection matter.

2. Data we process

• Identification and contact: name, email and, if you provide them, phone and date of birth.
• Language and cultural profile: nationality, native language, Spanish level, cultural interests, profile type.
• Your learning work: diagnosis results, the texts of your writing tasks and diagnosis, saved vocabulary, progress, and the files you upload to your portfolio (photos and audio).
• AI interactions: the texts you send to be corrected or answered by the AI (writing corrections, La Doctora, cerebrIA).
• Learner corpus (opt-in only): if you consent, your writing tasks are annotated under a pseudonym (never your name or email) and included in the CLM teaching and research corpus «A semester in Granada»; a second, separate consent allows pseudonymised public samples. You can withdraw it at any time and the annotations are deleted. The public page Corpus Granada shows only aggregate learner statistics (never texts); published reference samples carry a CC BY-NC-SA 4.0 licence.
• Payment data: processed through Stripe; the Clinic does not store your card details.
• Possible special-category data (health): if in the chat with La Doctora you express psychological distress or risk situations, that content may be health data (Art. 9 GDPR). It is stored encrypted and with restricted access.

3. Purposes

• Managing your account and access via magic link.
• Carrying out your diagnosis and offering personalised resources, routes and tutoring.
• Correcting your written work and generating recommendations with the help of artificial intelligence (see §7).
• Building the pseudonymised learner corpus for teaching and research, only with your consent (Art. 6.1.a).
• Managing payments and enrolment.
• Communicating with you in connection with the service.

4. Legal basis

Performance of the requested service (Art. 6.1.b), your consent where applicable (Art. 6.1.a — analytics/advertising and, where relevant, health data) and the Clinic's legitimate interest in the security and improvement of the service (Art. 6.1.f).

5. Recipients and processors

To provide the service, your data may be processed by the following providers acting as data processors:

• Stripe — payment processing.
• Resend — transactional emails (magic link, notices).
• Anthropic (Claude) — AI corrections, La Doctora and cerebrIA.
• Vercel — hosting, file storage (Blob) and usage analytics.
• Neon — database.
• Google — analytics and ad measurement via Google Tag Manager, only if you accept cookies (see the cookie policy).
• quijotesco.com — optional (opt-in) transfer of a cerebrIA structural summary, only if you activate it.

6. International transfers

Some of these providers (e.g. Anthropic, Stripe, Vercel, Google) may process data outside the European Economic Area (in the United States). Where that happens, the transfer relies on the safeguards of Chapter V GDPR (standard contractual clauses or equivalent frameworks such as the EU-US Data Privacy Framework).

7. Automated decisions and AI

We use artificial intelligence (Anthropic/Claude) to correct your writing, analyse your diagnosis and suggest resources. These outputs are indicative and for teaching support; we do not make automated decisions producing legal or similarly significant effects on you within the meaning of Art. 22 GDPR.

8. Retention

We keep your data while your account is active. If your account stays inactive we notify you and, after the grace period (about 180 days of inactivity in total), it is deleted automatically along with all its data.

Accounts that never get started: if you sign up but do nothing at all — no level test, no completed profile and no learning activity — we send you a reminder after 15 days; if 3 more days go by with still no activity, the account and its data are deleted automatically. Simply entering the site is not enough: taking the test, completing your profile or any real activity keeps the account. Accounts with an active paid plan are exempt.

Profiles without a level test: if you complete your profile but never take your level test, we send you reminders (from day 3, then weekly). If you still have not taken it after 30 days and you have no active paid plan (a free trial/promo does not count), we warn you and, after 3 more days, the account and its data are deleted. Taking the test keeps the account, and an active paid subscription is always exempt from deletion.

You can also download your data or delete your account at any time from Admisión → Mis datos y mi cuenta. After deletion we keep only what the law requires (e.g. billing).

9. Minors

The service is intended for people aged 14 or over. Minors under 14 need the consent of their parents or legal guardians; write to clinicacultural@gmail.com.

10. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability yourself (download and deletion from your dashboard) or by writing to clinicacultural@gmail.com. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).