Privacy Policy
This Policy explains how Igor Korolev, an independent developer and the controller of personal data for BonitaMente (“we”), handles information when you use the mobile application and its learning services. Contact us about privacy at support@bonitamente.es.
1. Information we process
- Profile and account: your email address, name, optional avatar, account identifier, sign-in information, authentication and session records, and records of the notices and consents you have accepted. Apple sign-in can provide an Apple identifier and an email address, including a private relay address.
- Guest learning: a guest identifier, session information and the learning activity associated with that guest. You can use the available guest features without providing an email address.
- Learning records: courses and lessons accessed, progress and completion, viewing history and time, assignment answers and photos you choose to submit, ratings and comments, and authorised reviewers’ assessments and replies.
- Purchases: products, access rights, subscription status, amounts and currencies, purchase and expiry dates, renewals, cancellations, refunds and transaction identifiers. Apple processes App Store payment details. We do not receive your full payment-card number or card security code.
- Support: the content of requests or feedback you voluntarily send, any contact email you provide, and information needed to investigate and answer the request.
- Technical and security information: IP address when connecting, request and security logs, app and operating-system versions, device model where needed for diagnostics, language, and error information.
- Usage measurement: installation and session identifiers, event times, interactions with onboarding, sign-in, lessons and subscription screens, viewing duration and purchase outcomes. Where you sign in, a pseudonymous account reference can link relevant activity across your installations. Pseudonymous information is still personal data; it is not treated as anonymous simply because your name is absent.
Information comes from you, your interactions and device, authorised course reviewers, and services involved in sign-in and purchases. When you access an existing account, its relevant learning and purchase records are available in the mobile Service.
Do not include medical records, intimate images or confidential information about other people in assignments or support requests. We do not use assignment photos or avatars for biometric identification or facial recognition.
2. Purposes and legal bases
- Providing the Service and fulfilling your requests: account access, guest sessions, course delivery, progress, assignments, requested support and purchase entitlements are processed as necessary to perform our agreement with you or take steps at your request before entering it.
- Security and reliability: we process proportionate technical records and diagnostics for our legitimate interests in preventing misuse, protecting accounts and keeping the Service reliable, subject to your rights and interests.
- Improving learning and the Service: limited first-party usage measurement helps us understand lesson engagement and the use of our access and purchase flows. Where lawful, this relies on our legitimate interests in improving the Service, with minimisation and your right to object. Where applicable law requires consent for measurement or access to information on your device, we obtain that consent before the relevant processing.
- Legal obligations and claims: we retain and use necessary records to meet applicable legal duties, handle rights requests and establish, exercise or defend legal claims.
- Consent-based processing: where we ask for a separate consent, we explain the purpose at that time. You may withdraw it without affecting the lawfulness of earlier processing.
Accepting the Terms or acknowledging this Policy is not consent to advertising or to every possible use of your information. A device permission allows a particular device function; it is not unlimited permission to use the resulting data.
3. Required and optional information
Account sign-in, paid access and the submission of an assignment require the information necessary for those functions. If you do not provide it, that function may be unavailable. Guest access remains available for the features offered to guests. Avatars, voluntary feedback and information not needed for the feature you request are optional. Photo access is limited by your choices and device permissions.
4. Who can receive information
We restrict access to people and providers who need information for the following purposes:
- Authorised course reviewers and support personnel: relevant assignments, learning records and requests needed to provide feedback or assistance.
- Hosting and file-storage providers: data stored or transmitted to operate accounts, learning, files and service infrastructure.
- Service-email providers: the destination email and content required for sign-in, account, security and requested service messages.
- Support and communication providers: requests and relevant contact or technical information needed to route, investigate and answer them.
- Apple: sign-in, App Store purchases and subscriptions, restoration and system review features. Apple handles information for its own platform under the Apple Privacy Policy. We receive the identity and purchase information needed for the functions you use.
- Sentry: crash and error diagnostics, including the error type and location, app version, operating system and device information. Network delivery exposes an IP address to the receiving service. Our diagnostic configuration does not intentionally include names, emails, photos, assignment text or form contents. See Sentry’s Privacy Policy.
- Kinescope: the video-delivery service receives connection and device information needed to load and play lessons, including your IP address and requests for the selected video. See the international Kinescope Privacy Policy.
Providers acting on our behalf must have access limited to their service and be subject to appropriate confidentiality, security and data-protection obligations. Platform providers may also act as independent controllers for their own activities. We may disclose necessary information where required by law, to protect legal rights, or in a lawful transfer of the Service subject to applicable safeguards and notice.
We do not sell personal data or share it for cross-context behavioural advertising. We do not use personal data for decisions based solely on automated processing that produce legal or similarly significant effects.
5. Storage and international processing
Our main application servers are in Germany. Assignment photos are stored with a file-storage provider in France. Service providers may process information in other countries, including countries outside the European Economic Area. EU storage does not by itself exclude access from another country, and a provider’s international operations do not mean that every data category is sent to every country where it operates.
Where a transfer requires safeguards under applicable data-protection law, we use an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and any necessary supplementary measures. You may contact us for information about the recipients and safeguards relevant to your data and to request a copy of applicable safeguards, with protection for confidential information.
6. Retention
- Profile and learning records, including submitted work: for the life of the account or guest record, until you request their deletion, subject to the limited exceptions below.
- Raw usage analytics: no longer than 24 months from the relevant event, with earlier deletion where required in response to a valid request.
- Support requests: while the matter remains open and for no longer than 24 months after closure, unless a specific legal obligation or claim requires limited further retention.
- Ordinary security logs and diagnostic reports: no longer than 30 days. Records necessary for a particular security incident or legal claim may be isolated and retained for that purpose for as long as necessary.
- Residual backup copies: removed or overwritten within 30 days after deletion. They are restricted from ordinary use; a restoration must preserve the effect of deletion requests.
- Purchase records and evidence of consent: only as long as needed for the applicable transaction, statutory recordkeeping, proof of consent or handling of claims. The period depends on the legal obligation, transaction date and applicable limitation period; these exceptions do not justify retaining unrelated learning content.
We may keep statistics that are genuinely anonymous and cannot reasonably be used to identify or single out you or your installation. Replacing your identity with a stable identifier does not by itself make records anonymous. Providers acting as independent controllers, such as Apple for its transaction records, apply their own retention duties.
7. Your choices and rights
Depending on the law that applies, you may request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent where processing relies on it. We assess objections to legitimate-interest processing as required by law. Exercising privacy rights does not result in unlawful discrimination.
Use the in-app deletion options or follow Account and Data Deletion. You can also email support@bonitamente.es for any privacy request, including an objection to analytics. We may ask only for information reasonably necessary to identify the relevant records and verify your authority. Do not send your password or payment-card details.
For requests governed by the GDPR, we respond without undue delay and normally within one month. If a legally permitted extension is necessary, we explain it within that first month. Where another law sets a different deadline or an appeal right, we follow it and explain how to challenge our response.
You may complain to the data-protection authority in your place of residence, work or the alleged infringement. In Spain, this is the Agencia Española de Protección de Datos. This does not prevent you from using another competent authority or court.
8. Security, children and this legal website
We use access restrictions, encrypted transport and other measures proportionate to the information and risk. No method of transmission or storage can guarantee absolute security. The Service is for adults aged 18 or older. If you believe a child has provided personal data, contact us so that we can investigate and take appropriate action.
These legal pages do not use analytics, forms, external fonts or tracking cookies. The hosting service receives ordinary connection information needed to deliver and secure the pages.
9. Changes and contact
The version and publication date appear on this page. We provide additional notice of material changes where required, and obtain a new consent where necessary. Contact the controller, Igor Korolev, at support@bonitamente.es.