Privacy policy — SonidoenRed

1. Data controller

In compliance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), we inform you that the controller of your personal data is:

Name / Company name: SonidoenRed
Contact email: [email protected]
Website: sonidoenred.com

2. Personal data we collect

We collect the following data depending on how you interact with the platform:

Email registration: dirección de correo electrónico y contraseña (almacenada de forma cifrada). Durante el registro también guardamos la marca temporal y la dirección IP en la que confirmas tener al menos 14 años y aceptas los Términos de uso y esta Política de privacidad, como evidencia del consentimiento prestado (art. 7 RGPD).
Google registration: name, email address and profile picture provided by Google OAuth.
Platform use: username, account preferences, training progress and configured price alerts.
Technical data: IP address, browser type, operating system and pages visited, automatically collected via Google Analytics.
Behaviour analysis: through Microsoft Clarity we collect, only if you give your consent, mouse movements and clicks, page scrolling, and anonymised session recordings, for the sole purpose of understanding how the platform is used and detecting usability issues. Clarity automatically masks the content entered in form fields to avoid capturing personal data.
Newsletter subscription: dirección de correo electrónico, idioma preferido, marca temporal, dirección IP y versión de la política aceptada en el momento del alta. La suscripción utiliza doble confirmación (double opt-in): no añadimos tu correo a nuestra lista de envío hasta que confirmas el alta mediante el enlace que recibes. Las comunicaciones se envían desde [email protected].

No recopilamos datos especialmente protegidos (salud, ideología, origen racial, etc.). Conforme al art. 7 de la LOPDGDD, para crear una cuenta debes tener al menos 14 años y así lo confirmas expresamente durante el registro. Si eres menor de 14 años, no utilices esta plataforma y pide a tu padre, madre o tutor legal que gestione el acceso en tu nombre.

3. Purpose of processing

We process your data for the following purposes:

Managing your registration and authentication on the platform.
Providing access to training content and the price comparator.
Sending you price alert notifications that you have configured.
Sending you transactional communications related to your account (email confirmation, password reset).
Sending you the newsletter with content, updates and platform resources, if you have voluntarily subscribed. You can unsubscribe at any time via the link included in each email.
Analysing platform usage to improve our services (Analytics).

4. Legal basis for processing

Performance of a contract: processing is necessary to provide you with the service (registration, authentication, price alerts).
Consent: for the use of analytical cookies, requested on your first visit.
Legitimate interest: for aggregate statistical analysis of platform usage for service improvement purposes.

5. Data retention

We retain your data while you maintain an active account on SonidoenRed. If you delete your account, we will delete or anonymise your data within a maximum of 30 days, except for data we are required to retain by law (for example, tax data for 5 years).

La evidencia del consentimiento (marca temporal, dirección IP y versión de la política aceptada) se conserva mientras se mantenga la relación correspondiente (cuenta activa o suscripción vigente), al objeto de poder demostrar, en caso de requerimiento, que el consentimiento fue prestado de forma libre, específica, informada e inequívoca.

Navigation data collected by Google Analytics is retained for 14 months, in accordance with the settings applied to our account.

Session recordings and heatmaps generated by Microsoft Clarity are kept for a maximum of 13 months from capture, in accordance with the provider's standard retention policy.

6. Recipients and international transfers

Your data may be shared with the following service providers, all of which have adequate safeguards under the GDPR:

Render (EE. UU.) — application server hosting provider. Transfer covered by EU Standard Contractual Clauses.
Supabase, Inc. (EE. UU.) — PostgreSQL database provider. Transfer covered by EU Standard Contractual Clauses.
Cloudinary (EE. UU.) — image storage and delivery. Transfer covered by EU Standard Contractual Clauses.
Resend (EE. UU.) — transactional email sending service (account verification, password reset, contact form notifications). Transfer covered by EU Standard Contractual Clauses.
Brevo (Sendinblue Iberia S.L., España) — newsletter management and sending of commercial communications to subscribers. Provider established in the European Economic Area.
Google LLC (EE. UU.) — Google OAuth (authentication) and Google Analytics (statistics). Transfer covered by the EU-US Data Privacy Framework.
Microsoft Corporation (EE. UU.) — Microsoft Clarity, for behaviour analysis through heatmaps and anonymised session recordings. Transfer covered by the EU-US Data Privacy Framework.

We do not sell or transfer your data to third parties for their own purposes.

7. Your rights

As a user, you have the following rights regarding your personal data:

Access: knowing what data we process about you.
Rectification: correcting inaccurate or incomplete data.
Erasure: requesting the deletion of your data when it is no longer necessary.
Portability: receiving your data in a structured, commonly used format.
Objection: objecting to processing based on legitimate interest.
Restriction: requesting that we temporarily suspend the processing of your data.
Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.

You can exercise these rights by writing to us at [email protected]. Además, desde la sección Configuración → Privacidad de tu cuenta puedes descargar directamente un fichero JSON con todos tus datos personales (derecho de portabilidad) y eliminar tu cuenta. Si consideras que el tratamiento vulnera la normativa, puedes presentar una reclamación ante la Spanish Data Protection Agency (AEPD).

8. Cookies

We use our own and third-party cookies. You can find all the details in our Cookie policy.

9. Changes to this policy

We may update this privacy policy at any time. We will notify you of relevant changes by email or through a visible notice on the platform. The date of the last update always appears at the beginning of this document.