Privacy policy
How we handle your personal data, why, for how long and what rights you have under the GDPR and Spain's LOPDGDD. The Spanish version is the binding one.
Updated: 2026-10-06
1. Data controller
, tax ID , address: . Data protection contact: .
2. What data we process, why and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Email, password (stored encrypted with scrypt, never in plain text), optional name, language | Create and maintain your account | Performance of the service you requested (art. 6.1.b GDPR) |
| Questionnaire answers: nationality, residence, birth year, studies, grades, languages, goals, achievements, documents ready | Work out which grants fit you and show your results | Your consent when you answer (art. 6.1.a GDPR) |
| Optional sensitive answers: disability, family income, large family, first-generation student | Find programmes for specific groups | Your explicit consent (art. 9.2.a GDPR); processed only if you tick them |
| Saved grants, application status and your notes | Provide “My grants” synced across devices | Performance of the service (art. 6.1.b) |
| Reviews (rating, outcome and text; only your first name or “Participant” is shown) | Publish moderated opinions of other users | Your consent when you publish (art. 6.1.a) |
| Error reports on a card (text and optional contact) | Correct the data | Legitimate interest in keeping information accurate (art. 6.1.f) |
| IP address, only in server memory | Limit repeated login and submission attempts (security) | Legitimate interest in security (art. 6.1.f); not stored |
The text you type into the “Application draft” is processed to write the letter and is not saved in our database. If you enable a local model (Ollama), it is processed on your own computer.
3. Special categories of data
Disability and some other personal circumstances may count as sensitive data. They are always optional: if you do not tick them the service works the same, but we cannot show you programmes aimed at that group. By ticking them you give explicit consent to use them only to calculate compatibility. You can withdraw it at any time by unticking them or deleting your account.
4. How long we keep data
As long as you keep your account. If you delete it from “My account”, your account, questionnaire, saved grants and reviews are erased immediately and irreversibly. Error reports are kept without your identity until the card is fixed. Login sessions expire after 30 days.
5. Recipients and transfers
We do not sell or pass your data to third parties. We use no advertising or third-party analytics.
Data is hosted on the servers of the hosting provider (), which acts as processor and accesses it only to run the service. If the provider is outside the European Economic Area, the transfer relies on the safeguards required by the GDPR.
6. Your rights
To exercise them, use the buttons in “My account” or write to . We reply within one month.
- Access, rectification and erasure of your data.
- Restriction of processing and objection to it.
- Portability: you can download your data under “My account → Download my data”.
- Withdrawal of consent at any time (processing before withdrawal remains lawful).
- Complaint to the supervisory authority: the Spanish Data Protection Agency (www.aepd.es).
7. Minors
In Spain, people aged 14 or over can give their own consent to data processing (art. 7 LOPDGDD). If you are under 14 you need a parent's or guardian's consent to register. That is why registration asks you to confirm your age.
8. Security
Passwords are stored with one-way encryption (scrypt) and sessions are identified by a random code of which we keep only a fingerprint. The session cookie is httpOnly and is sent only to this site. No system is perfectly secure, though: use a unique password and tell us if you spot a problem.
9. Changes to this policy
If we change how we process data, we will update this page and its date. For significant changes we will notify you on the site.