Privacy policy — SonidoenRed

1. Data controller

In compliance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), we inform you that the controller of your personal data is:

Name / Company name: SonidoenRed
Contact email: [email protected]
Website: sonidoenred.com

2. Personal data we collect

We collect the following data depending on how you interact with the platform:

Email registration: email address and password (stored encrypted). During registration we also record the timestamp and the IP address at which you confirm that you are at least 14 years old and accept the Terms of use and this Privacy policy, as evidence of the consent given (art. 7 GDPR).
Google registration: name, email address and profile picture provided by Google OAuth.
Platform use: username, account preferences, training progress and configured price alerts.
Technical data: IP address, browser type, operating system and pages visited, automatically collected via Google Analytics.
Behaviour analysis: through Microsoft Clarity we collect, only if you give your consent, mouse movements and clicks, page scrolling, and anonymised session recordings, for the sole purpose of understanding how the platform is used and detecting usability issues. Clarity automatically masks the content entered in form fields to avoid capturing personal data.
Newsletter subscription: email address, preferred language, timestamp, IP address and the version of the policy accepted at the time of sign-up. The subscription uses double confirmation (double opt-in): we do not add your address to our mailing list until you confirm it through the link you receive. Messages are sent from [email protected].

We do not collect specially protected data (health, ideology, racial origin, etc.). In accordance with art. 7 of the LOPDGDD, you must be at least 14 years old to create an account, and you confirm this expressly during registration. If you are under 14, do not use this platform and ask your parent or legal guardian to manage access on your behalf.

3. Purpose of processing

We process your data for the following purposes:

Managing your registration and authentication on the platform.
Providing access to training content and the price comparator.
Sending you price alert notifications that you have configured.
Sending you transactional communications related to your account (email confirmation, password reset).
Sending you the newsletter with content, updates and platform resources, if you have voluntarily subscribed. You can unsubscribe at any time via the link included in each email.
Analysing platform usage to improve our services (Analytics).

4. Legal basis for processing

Performance of a contract: processing is necessary to provide you with the service (registration, authentication, price alerts).
Consent: for the use of analytical cookies, requested on your first visit.
Legitimate interest: for aggregate statistical analysis of platform usage for service improvement purposes.

5. Data retention

We retain your data while you maintain an active account on SonidoenRed. If you delete your account, we will delete or anonymise your data within a maximum of 30 days, except for data we are required to retain by law (for example, tax data for 5 years).

The evidence of consent (timestamp, IP address and the version of the policy accepted) is kept for as long as the corresponding relationship lasts (an active account or a current subscription), so that we can demonstrate, if required, that consent was given freely and in a specific, informed and unambiguous manner.

Navigation data collected by Google Analytics is retained for 14 months, in accordance with the settings applied to our account.

Session recordings and heatmaps generated by Microsoft Clarity are kept for a maximum of 13 months from capture, in accordance with the provider's standard retention policy.

6. Recipients and international transfers

Your data may be shared with the following service providers, all of which have adequate safeguards under the GDPR:

Render (EE. UU.) — application server hosting provider. Transfer covered by EU Standard Contractual Clauses.
Supabase, Inc. (EE. UU.) — PostgreSQL database provider. Transfer covered by EU Standard Contractual Clauses.
Cloudinary (EE. UU.) — image storage and delivery. Transfer covered by EU Standard Contractual Clauses.
Resend (EE. UU.) — transactional email sending service (account verification, password reset, contact form notifications). Transfer covered by EU Standard Contractual Clauses.
Brevo (Sendinblue Iberia S.L., España) — newsletter management and sending of commercial communications to subscribers. Provider established in the European Economic Area.
Google LLC (EE. UU.) — Google OAuth (authentication) and Google Analytics (statistics). Transfer covered by the EU-US Data Privacy Framework.
Microsoft Corporation (EE. UU.) — Microsoft Clarity, for behaviour analysis through heatmaps and anonymised session recordings. Transfer covered by the EU-US Data Privacy Framework.

We do not sell or transfer your data to third parties for their own purposes.

7. Your rights

As a user, you have the following rights regarding your personal data:

Access: knowing what data we process about you.
Rectification: correcting inaccurate or incomplete data.
Erasure: requesting the deletion of your data when it is no longer necessary.
Portability: receiving your data in a structured, commonly used format.
Objection: objecting to processing based on legitimate interest.
Restriction: requesting that we temporarily suspend the processing of your data.
Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.

You can exercise these rights by writing to us at [email protected]. In addition, from the Settings → Privacy section of your account you can directly download a JSON file with all your personal data (right to portability) and delete your account. If you believe that the processing infringes the regulations, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).

8. Cookies

We use our own and third-party cookies. You can find all the details in our Cookie policy.

9. Changes to this policy

We may update this privacy policy at any time. We will notify you of relevant changes by email or through a visible notice on the platform. The date of the last update always appears at the beginning of this document.