Privacy Policy

1. 1. Who we are and scope

The controller for the data described in this policy is:

• Entity: [LEGAL_ENTITY_NAME] ([LEGAL_ENTITY_TYPE])
• Registered address: [REGISTERED_ADDRESS]
• Company / tax identifier: [COMPANY_NUMBER_OR_TAX_ID]
• Country of establishment: Spain
• General contact: info@spatova.com
• Privacy and data protection matters: info@spatova.com

This policy applies to the personal data we process as a controller in connection with the Spatova platform, our marketing website and our commercial and support communications. It does not apply to student data that we process on behalf of a studio (see the DPA), nor to third-party websites linked from our services.

2. 2. Controller vs processor

The data protection roles are as follows:

Studio student data

The studio (tenant) decides what student data it collects and for what purpose: it is the data controller. Spatova processes that data only on the studio's instructions, as a data processor. This processing is governed by the Data Processing Agreement (DPA) that the studio accepts as part of its subscription.

Owner, billing, support and platform data

In relation to studio owner account data, billing data, support communications and platform usage analytics, Spatova determines the purposes and means of processing and therefore acts as the controller. This Privacy Policy covers that processing only.

If you are a student of a studio that uses Spatova and you wish to exercise your rights over your data, you should contact the relevant studio, which is the controller of that data.

3. 3. What data we collect

When we act as a controller, we process the following categories of personal data:

• Identity and account data: name, user identifiers, login credentials and role within the studio.
• Google sign-in data (optional): if you choose "Continue with Google", Google shares your email address, name and profile picture (if available) with us. We use this data solely to authenticate you and link your Spatova account; we do not access any other data in your Google account (such as Gmail, Drive or contacts) and we do not post anything on your behalf.
• Contact data: email address, phone number (if you provide it) and the studio contact person's details.
• Business data: studio name, domain or subdomain, country, language, plan configuration and preferences.
• Billing data: amounts, subscribed plan, payment history and taxes. Payments are processed through Stripe; Spatova does not store full card numbers.
• Usage, device and log data: IP addresses, session identifiers, browser type, pages visited, timestamps and technical events needed for security and diagnostics.
• Cookies and similar technologies: see the cookies section below.
• Support communications: the content of your messages, tickets or enquiries and our responses.
• Marketing preferences: your consent to, or opt-out from, commercial communications.

4. 4. How we use it and legal bases

We process your personal data for the following purposes and on the following legal bases:

• Providing and managing the service (creating and administering your account, giving access to the platform): performance of a contract.
• Billing, collection and tax and accounting obligations: compliance with a legal obligation and performance of a contract.
• Support and customer care: performance of a contract and legitimate interest in providing a quality service.
• Security, fraud prevention, integrity and product improvement: legitimate interest in keeping a secure and reliable service.
• Marketing communications and product updates: consent, where required, or legitimate interest for communications to existing customers, with the ability to object at any time.
• Compliance with legal requirements and defence of claims: compliance with a legal obligation and legitimate interest.

Where the legal basis is consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.

5. 5. Cookies and similar technologies

We use cookies and similar technologies on spatova.com for two main purposes:

• Essential: necessary for the operation of the site, authentication and security. These do not require consent.
• Analytics: help us understand how the site is used and improve the product. These are used in line with your preferences where consent is required.

You can review the cookies we use and manage your preferences on our cookies page and through your browser settings.

6. 6. Sharing and subprocessors

We do not sell personal data. We share data only with providers who deliver services to us (subprocessors), under contract and with appropriate data protection safeguards. Our current subprocessors are:

• Supabase: application database, authentication and storage.
• Stripe: payment processing and billing.
• Resend: transactional email delivery.
• Bunny Stream / Bunny CDN: video hosting and delivery.
• Hetzner + Coolify: application infrastructure hosting.
• Cloudflare: DNS, CDN and network security.

We may also disclose data to public authorities or advisers where there is a legal obligation or where necessary to defend our rights. In the event of a corporate reorganisation (merger, acquisition or sale of assets), data may be transferred to the successor entity under the same safeguards.

7. 7. International transfers

Some of our providers may process data outside the European Economic Area or the United Kingdom. Where this happens, we apply the appropriate safeguards required by law, such as the EU Standard Contractual Clauses (SCC) and, where applicable, the UK Addendum / IDTA, together with supplementary technical and organisational measures.

You can request more information about these safeguards by writing to info@spatova.com.

8. 8. Retention

We retain personal data only for as long as necessary for the purposes for which it was collected:

• Account data: while the subscription is active and for a reasonable period afterwards to handle offboarding and possible claims.
• Billing, tax and accounting data: for the retention periods required by applicable law.
• Log and security data: for a limited period, proportionate to the security and diagnostic purposes.

Once the applicable periods have elapsed, we securely delete or anonymise the data.

9. 9. Security

We apply reasonable technical and organisational measures to protect personal data, including encryption in transit, access controls, row-level security (RLS) in the database and separation of environments.

No method of transmission or storage is completely secure. While we work to protect your data, we cannot guarantee absolute security. If we become aware of a security breach affecting you, we will act in accordance with the notification obligations required by applicable law.

10. 10. Your rights

Under the GDPR and the UK GDPR, you have the following rights over your personal data where we act as controller:

• Access to your data.
• Rectification of inaccurate or incomplete data.
• Erasure of your data where applicable.
• Restriction of processing in certain cases.
• Portability of the data you have provided to us.
• Objection to processing based on legitimate interest or for marketing purposes.
• Withdrawal of consent at any time, where processing is based on it.

To exercise any of these rights, write to us at info@spatova.com. You also have the right to lodge a complaint with the competent data protection supervisory authority.

11. 11. Children

Spatova is a service aimed at businesses and professionals (studios and their owners). It is not directed to children, and we do not knowingly collect data from children in our relationship as a controller.

Where a studio collects data from its students, including any minors, the studio is the controller of that processing and is responsible for obtaining the appropriate consents and safeguards.

12. 12. Changes to this policy and contact

We may update this Privacy Policy to reflect legal, technical or business changes. We will publish the updated version on spatova.com and indicate the date of the latest revision. If the changes are substantial, we will endeavour to notify you through an appropriate channel.

For any questions about this policy or your personal data, you can contact us at info@spatova.com or, for privacy matters, at info@spatova.com.