Privacy Policy

Data Controller

The controller responsible for processing the personal data collected through this platform is:

Data We Collect

Depending on how you use the platform, we may collect the following types of data:

2.1 Registration data

• Username (nickname) and password, always stored encrypted with bcrypt (never in plain text).
• Email address, used for account verification and password recovery.
• Date and time of registration.
• Profile avatar, only if the user voluntarily uploads one.

2.2 Activity and gamification data

• Progress in tutorials and lessons (study time, completed lessons).
• Experience points (XP), level and unlocked achievements.
• Scores in mini-games (Battleship, Tetris, TicTacToe).
• Submitted assignments and grades received.
• Streak of consecutive active days.
• Friendship relationships between users within the platform.

2.3 Communications data

• Messages sent in the global chat and in private chats between users.
• Conversations held with the built-in AI assistant.
• Emails and messages sent through the contact form.

2.4 Technical data

• IP address, anonymized after login.
• Browser type, operating system and device type (mobile or desktop).
• Pages visited and time spent, via Google Analytics.
• Configuration preferences (dark mode, sound on/off, language, etc.).

2.5 Third-party data

• If the user links or mentions their Discord profile, only the public identifier voluntarily provided by the user themselves is stored.

Purpose and Legal Basis for Processing

We process your data for the following purposes and legal bases, in accordance with Article 6 of the GDPR:

Retention Period

Data is retained for as long as your account remains active. In case of account deletion:

Recipients and Data Processors

Programando Web does not sell or share personal data with third parties for commercial purposes. The following providers access certain data, exclusively to provide the service, under a data processing agreement or equivalent safeguards:

You can review the Google Analytics Privacy Policy here, and opt out by installing the Google Analytics opt-out add-on.

Cookies and Similar Technologies

This platform uses first-party and third-party cookies for it to function correctly:

You can manage or delete cookies from your browser settings at any time. Note that disabling technical cookies may affect the basic functioning of the platform.

Information Security

We apply appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss or destruction:

• Passwords stored with bcrypt hashing, not reversible or recoverable in plain text.
• Communications encrypted via HTTPS/TLS across the entire site.
• Database access restricted exclusively to authorized personnel.
• Password recovery tokens that expire after 1 hour and are single-use.
• Ban and moderation system to protect users from abusive behavior.
• Logging of suspicious activity for early detection of unauthorized access.
• Periodic backups of the database.

Minors

Programando Web is an educational platform open to users of all ages. However, if you are under 14 years old (the minimum age of consent under the LOPDGDD), you will need the consent of your parent or legal guardian to register and use the platform.

If we detect that a user under 14 has registered without such consent, we will delete their account and associated data. If you are a parent or legal guardian and believe a minor in your care has provided data without your consent, contact us and we will act as a priority.

Your Rights

As a user in the European Union, you have the following rights regarding your personal data:

To exercise any of these rights, contact us by email stating the right you wish to exercise and attaching, if necessary, proof of your identity. We will respond within a maximum of 30 days.

You also have the right to file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

International Data Transfers

Some service providers (such as Google Analytics or the AI assistant provider) may process data outside the European Economic Area (EEA). In such cases, these transfers are carried out under appropriate safeguard mechanisms, such as the Standard Contractual Clauses approved by the European Commission, or the EU-US Data Privacy Framework.

Automated Decisions and Profiling

The XP, level, achievement and ranking system is calculated automatically based on your activity, but it does not produce legal effects nor significantly affect you within the meaning of Article 22 of the GDPR: it is not used to make decisions about your access to the service, except in moderation cases for rule violations, which can always be reviewed by a person.

The AI assistant processes your queries to generate guidance to support learning; it does not build profiles for advertising purposes nor make automated decisions about your account.

Security Breaches and Incident Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we commit to:

• Notify the Spanish Data Protection Agency within a maximum of 72 hours from when we become aware of the incident, in accordance with Art. 33 GDPR.
• Inform affected users without undue delay when the risk to their rights is high, in accordance with Art. 34 GDPR.
• Adopt immediate corrective measures to contain and mitigate the incident.

Changes to this Policy

We reserve the right to update this Privacy Policy when necessary, for example due to legislative changes or new platform features. When relevant changes occur, we will notify you on the platform itself or by email. The date of the last update will always be visible in the header of this document.

Frequently Asked Questions