Controller
Metruta. For any request about your data: islamiibrahiim@gmail.com. We respond within 30 days of your request.
What data we process
Account data
- Email address and a nickname you choose.
- Password stored only as an irreversible hash (bcrypt). We can never read it.
- Interface language and preferences.
Learning data
- Answers, correct/incorrect, time per question and score for each exam.
- Spaced-repetition history and marked theory cards.
- Progress, streak and badges computed from the above.
Billing data
- Stripe customer identifier and purchase reference. We never store your card number.
- Purchase date and the end of your Access Pass.
Technical data
- IP address (direct or derived from the proxy) for rate limiting and security.
- An httpOnly session cookie and a language cookie.
Lawful basis
Performance of a contract (art. 6(1)(b))
Email address, hashed password, exam progress, answers and their results.
Without this data we cannot give you an account or calculate your progress.
Compliance with a legal obligation (art. 6(1)(c))
Customer and purchase identifiers, and billing transaction records.
We keep what tax and accounting rules require us to keep.
Legitimate interests (art. 6(1)(f))
Audit log of admin access, payments and exam submissions.
To prevent fraud and abuse, and to protect the integrity of the service and of payments.
Consent (art. 6(1)(a))
Welcome, re-engagement and exam-date reminder emails.
Withdrawable at any time from Settings → Emails.
Who we share them with
- — Processes payments and subscriptions.
- — Generates AI responses (explanations, plans).
- — Stores accounts, answers and progress.
- SMTP provider— Sends verification and reminder emails.
Each processes data only for its function. We do not sell your data to third parties.
Your rights
Access
We send you a copy of your data in a machine-readable format.
Rectification
You can change your nickname, email and password from Settings.
Erasure
You can ask us to delete your account and all your learning data.
Restriction and objection
You can ask us to restrict or stop using your data, and withdraw consent for emails.
Portability
You can take your answers and history to another provider.
To exercise any of these, write to islamiibrahiim@gmail.com. We respond within 30 days. If you believe we have not complied, you can complain to the Spanish Data Protection Agency (AEPD).
How long we keep them
Learning data
Kept while you hold the account, and deleted within 30 days of your deletion request.
Billing data
Kept for the life of the relationship and for the periods tax rules require (typically 4 years).
Security logs
Kept for at most 12 months, then deleted automatically.
Changes
If we update this policy we publish the new date above. Substantial changes are also announced on /changelog.