Privacy Notice

Who we are

SpainReady Ltd (trading as “SpainReady”) provides the SpainReady Spanish-learning website and web app. SpainReady Ltd is the data controller for the personal data described in this notice. You can reach us any time at support@spainready.app or through our contact page.

SpainReady Ltd is registered in England and Wales, company number 17314696. Registered office: 77 Bute Street, Treorchy, Wales, CF42 6AH.

What we collect and why

• Account data — email address and password (stored only as a secure hash). Used to create and secure your account. Legal basis: performance of our contract with you.
• Subscription and entitlement data — your plan (trial, monthly, annual, lifetime), start date, renewal date and payment-provider customer reference. Used to give you access to what you've paid for. Legal basis: contract.
• Learning data — lessons and categories completed, progress and preferences. Used to save your place and personalise your learning. Legal basis: contract.
• Enquiries and lead forms — your name, email and message when you contact us or request the free phrase pack. Used to reply and to send the material you asked for. Legal basis: contract and legitimate interests.
• Marketing email — where you have opted in, your email address and unsubscribe status. Legal basis: consent (withdraw any time via the unsubscribe link in every email).
• Technical and usage data — IP address, device and browser type, pages viewed and interactions. Used for security, fraud prevention and to improve the product. Legal basis: legitimate interests (security) and consent (analytics cookies).

Card and bank details are never collected or seen by us. Payments are taken by our payment provider (see below).

Who we share data with

We share personal data only with the following categories of recipient:

• Paddle.com Market Ltd — our Merchant of Record. Paddle sells the subscription to you, takes payment, handles billing, tax compliance, invoicing, refunds and subscription management. Paddle is a separate controller for the payment data it collects.
• Lovable Cloud (Supabase infrastructure) — hosting, database, authentication and file storage for the app.
• Resend — delivery of transactional and subscription emails sent from notify.spainready.app.
• Google Analytics and Microsoft Clarity — website analytics and session insight. These load only if you accept analytics cookies.
• Professional advisers (legal, accounting) and authorities where we are required by law.

We do not sell your personal data, and we never have.

International transfers

Some of the providers above process data outside the UK and EEA. Where that happens, transfers are covered by UK/EU Standard Contractual Clauses, the UK Addendum, or an adequacy decision.

How long we keep it

• Account, learning progress and preferences — until you delete your account.
• Transaction and tax records — 7 years, as required by UK tax and accounting law.
• Support messages and enquiries — 24 months from your last contact.
• Analytics data — retained in aggregated or anonymised form only.
• Email suppression list — we keep a record of unsubscribed addresses indefinitely so we don't email you again by mistake.

Anything no longer needed is deleted or irreversibly anonymised. See our account deletion page for how to remove your account and data.

Your rights

Under UK GDPR and the EU GDPR you have the right to access your data, correct it, delete it, restrict or object to our processing, receive a portable copy, and withdraw consent at any time.

Email support@spainready.app and we will respond within one month. If you are unhappy with our response you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

Cookies

We use essential cookies to keep you signed in and secure — these cannot be switched off. Analytics cookies (Google Analytics, Microsoft Clarity) load only after you accept them. You can change your choice at any time using the Cookie preferences link in the footer. We do not use advertising cookies.

Security

We use encryption in transit, hashed passwords, row-level database access controls and least-privilege access for staff. No system is perfectly secure, but we take appropriate technical and organisational measures to protect your data.

Children

SpainReady is not intended for children under 16 and we do not knowingly collect their data.

Changes

If we make a material change to this notice we will update the date above and, where appropriate, tell you by email.