Privacy Policy
Version 2.2 · 8 September 2026
1. Who is the data controller?
Kluppy S.L. Tax ID: B75131953 Registered office: Mikeletegi pasealekua 65 (Planta Baja, Local 1), 20009, Donostia - San Sebastián, Gipuzkoa Contact email: info@kluppy.com Data protection contact: dpo@kluppy.com
Hereinafter "Kluppy", "we" or "the Platform".
This policy applies to https://kluppy.com and its subdomains (including play.kluppy.com and old.kluppy.com while it remains active) and to the official Kluppy mobile applications.
Controller or processor?
Kluppy's role depends on how you reach the Platform:
| Situation | Data controller | Kluppy's role |
|---|---|---|
| You register yourself or create a family account (B2C) | Kluppy | Controller |
| Your school, business or organisation creates your account (B2B) | The school or organisation | Processor (Art. 28 GDPR), under the signed DPA |
| You join an extracurricular activity run by a school | The school | Processor, under the signed DPA |
Where Kluppy acts as a processor, you exercise your rights before the school or organisation; we will point you to the right contact and assist them.
2. What data do we process?
2.1. Data you provide directly
| Data | Required? | Purpose |
|---|---|---|
| Yes | Create your account and be able to contact you | |
| Full name | Yes | Identify you in the classroom and on the platform |
| Username | Yes | Your public name in rankings and leagues |
| Password | Yes | Protect your account |
| Avatar / profile picture | No | Personalisation |
| Billing details (legal name, tax ID, address) | Only if you take out a paid plan | Issue the invoice |
2.2. Data generated by your activity
When you use Kluppy, we automatically generate data about your educational progress:
- Typing speed (words per minute)
- Accuracy (percentage of correct keystrokes)
- Current level and progress
- Experience points (XP) and achievements
- History of practised texts
- Test and speed-certification results, together with the technical signals needed to detect attempts to falsify a result
This data is necessary for the service to work properly and for you (or your teacher) to see your progress.
2.3. Camera in Level 0 (hand placement)
In Level 0 you can turn on your camera so the Platform can tell you whether your hands are correctly placed on the keyboard.
- It is always optional. If you do not grant permission, or you revoke it, the level is completed in manual mode.
- The video never leaves your device. Hand-position analysis runs entirely in your browser (the MediaPipe Hands library). We do not record, transmit or store any image or frame. Only the level outcome (completed or not) reaches the server.
- This is not biometric data processing within the meaning of Art. 4(14) GDPR: hand landmarks are computed in memory to draw the on-screen guide, discarded immediately, and never used to identify you.
- The analysis model files are downloaded from the public jsDelivr content delivery network, which by virtue of the download learns your IP address.
2.4. Payment data (paid users only)
If you take out a paid plan, Stripe (our payment gateway) will process your card data. Kluppy never stores your card details — Stripe is PCI-DSS Level 1 compliant, the highest payment security standard.
2.5. Technical and error logs
To keep the service running and diagnose faults, we log technical incidents. These logs may include your account identifier, the operation that failed and the error message. They are not used for commercial purposes or to profile you, and they are deleted by automatic rotation (see section 6).
2.6. Visit origin (at account creation)
When you create your account we record where your visit came from (referrer page and UTM campaign tags from our own links) for marketing statistics. It does not include your IP or third-party identifiers, and it is deleted along with your account.
2.7. Data we do NOT collect
- ❌ Postal address (other than the billing address, if you take out a paid plan)
- ❌ Phone number (except in school registration, optional)
- ❌ Date of birth on the learning platform. Exception: Kluppy Academy and the monitor recruitment process do request it, as verifying that the person is of legal age is mandatory; both are governed by their own policies.
- ❌ Biometric data (see section 2.3)
- ❌ Geolocation
- ❌ Browsing history outside Kluppy
- ❌ Health data
- ❌ Social media data (Google or Microsoft login only collects email and name)
3. What do we use your data for?
| Purpose | Legal basis | Data used |
|---|---|---|
| Create and manage your account | Performance of a contract (Art. 6.1.b GDPR) | Email, name, password |
| Social authentication (Google/Microsoft) | Performance of a contract (Art. 6.1.b GDPR) | Email, name (provided by the OAuth provider) |
| Provide the educational service | Performance of a contract (Art. 6.1.b GDPR) | Typing metrics, progress, level |
| Evidence report supporting the school's assessment (schools and organisations only) | Performance of the contract signed by the school (Art. 6.1.b GDPR). The school is the Controller and Kluppy acts as Processor (Art. 28 GDPR) | Typing metrics for the period, level reached, cumulative keystrokes and sessions worked |
| Directory import | Admin's consent (Art. 6.1.a GDPR) | Email, name (from Google Workspace/Classroom or Microsoft 365) |
| Billing | Legal obligation (Art. 6.1.c GDPR) | Email, name, tax and payment details |
| Sending invitation emails and service notices | Performance of a contract (Art. 6.1.b GDPR) | |
| Hand-placement camera guide | Consent, revocable (Art. 6.1.a GDPR) | Image processed on your device only, no storage |
| Security and prevention of fraud in results and certifications | Legitimate interest (Art. 6.1.f GDPR) | Technical signals from the typing session |
| Error diagnosis and service stability | Legitimate interest (Art. 6.1.f GDPR) | Technical logs (section 2.5) |
| Web analytics (Google Analytics) | Consent (Art. 6.1.a GDPR) | Anonymous browsing data |
| Technical support (tickets) | Performance of a contract (Art. 6.1.b GDPR) | Email, message content |
Where the basis is legitimate interest, we have balanced that interest against your rights and you may object at any time by writing to dpo@kluppy.com.
We never sell your data to third parties, nor use it for advertising.
Automated decision-making
We do not take automated decisions producing legal or similarly significant effects concerning you (Art. 22 GDPR), nor do we profile you for that purpose. Typing metrics are objective measurements of what you type: they record what you do on the Platform, they do not describe who you are.
Evidence reports in schools and organisations
If you practise with Kluppy within a school or an organised activity, that school may request an evidence report: a document that arranges those same measurements by period and places them in achievement bands, to help its teachers assess the keyboard-writing block. Here is exactly what it is and what it is not:
- It is a proposal, not a mark. The report produces no effect by itself: it does not change your level, your access or your progress in Kluppy, and it does not become a grade merely by being issued.
- A person always sets the grade. The school's teaching staff can change or discard any proposed band before transferring it to a report card, and it is they who decide.
- Kluppy cannot be the sole or main basis of your grade. The contract with the school expressly prohibits this, and the tool requires the school to set and document the weight it gives this block within the subject.
- The bands are not decided by AI. They are calculated using fixed arithmetic rules applied to your measurements and to cut-points that the school agrees and publishes. The AI systems described in section 4 play no part in the report.
- We say what we measure. The report always distinguishes what is measured (speed, accuracy, level reached, keystrokes) from its interpretation (the band), and prints the band alongside the data supporting it, never on its own.
- Coverage of the classwork signal. For context, Kluppy infers when your group worked from the group's own aggregate activity, and reflects in how many of those sessions you worked. It is not an attendance record, it is not communicated to anyone as such, and it does not score.
This processing therefore does not constitute an automated decision under Art. 22 GDPR: it is not based solely on automated processing — a person decides — nor does it by itself produce legal or similarly significant effects. If you want to know how a particular band was calculated, you can ask your school or write to us at dpo@kluppy.com: the cut-points and the formula are public and explainable.
This report exists only in the schools and organisations channel. If you use Kluppy as a private individual (B2C), it is not generated.
4. Use of Artificial Intelligence (Regulation (EU) 2024/1689 — AI Act)
Kluppy uses artificial intelligence (AI) to improve the learning experience. This section explains how AI is used, in compliance with the European AI Act and the GDPR.
4.1. AI systems used
| AI system | Provider | Purpose | Is personal data sent? |
|---|---|---|---|
| Exercise text generation | Google Vertex AI (Gemini) | Create typing practice texts tailored to your level | ❌ No — Only technical parameters (allowed characters, language, text length) |
| Tutorial scripts | Google Vertex AI (Gemini) | Generate instructional audio scripts for learning each key | ❌ No — Only the key character and the language |
| Benchmark texts | Google Vertex AI (Gemini) | Generate paragraphs for typing speed tests | ❌ No — Only language and technical parameters |
| Document analysis (administrators only) | Google Vertex AI (Gemini) | Extract names and emails from uploaded documents (e.g. student lists) | ⚠️ Yes — The document content is processed by the AI |
Hand-placement detection (section 2.3) also uses a vision model, but it runs on your own device and sends nothing to any provider.
4.2. How AI-generated content is identified
When you practise with an AI-generated text, you will see an "✨ AI-generated" label in the exercise interface, ensuring transparency about the origin of the content you interact with.
4.3. Key facts about AI at Kluppy
- No profiling: AI is not used to profile, score or classify users. It only generates educational content.
- No automated decisions: AI makes no decision affecting your rights, your access or your educational results.
- Human oversight: All AI-generated content is subject to review by administrators and can be disabled at any time. If a text seems inappropriate, you can report it from within the Platform.
- Data minimisation: We send AI systems the bare minimum — in most cases, zero personal data.
- EU processing: AI processing takes place in Europe (Vertex AI region: EU
eumulti-region). User data is stored in Europe (Firestore region: eur3, Belgium/Netherlands). - No training on your data: Your personal data is not used to train AI models. Google Vertex AI processes requests without retaining user data for training, per our Google Cloud project configuration (Data Logging disabled, EU
eumulti-region for AI processing). Details in Google Cloud's Data Governance documentation.
4.4. Document analysis (administrators only)
When an administrator uploads a document (PDF or image) to extract emails, the document is sent to Google Vertex AI for processing. This involves processing personal data (names and emails contained in the document).
- For individual users (B2C): This processing is based on performance of a contract (Art. 6.1.b GDPR).
- For schools (B2B): Kluppy acts as Processor (Art. 28 GDPR). The legal basis is the Data Processing Agreement (DPA) signed with the school, which expressly authorises Google Vertex AI as a sub-processor.
Document content is processed in memory and explicitly deleted after processing. It is not saved to any database, bucket or log. The AI provider does not retain request data for training (Data Logging disabled in our Google Cloud configuration).
4.5. Your rights regarding AI
- You have the right to know when content is AI-generated (transparency labels in the interface).
- You can contact us at info@kluppy.com for more information about the use of AI.
- If you consider AI-generated content inappropriate, you can report it from the Platform or through the support system.
5. Who do we share your data with?
We only share data with the providers needed for the service to work:
| Provider | Service | Data shared | Location | DPA |
|---|---|---|---|---|
| Google Cloud / Firebase | Storage, processing, authentication (Google login) | All account data | EU 🇪🇺 (Belgium/Netherlands — eur3) | View DPA |
| Google Vertex AI | Educational text generation | No personal data (technical parameters only) | EU 🇪🇺 (eu multi-region) | Included in Google Cloud DPA |
| Google Workspace / Classroom | Directory import (optional, admin-initiated) | Student email, name | EU 🇪🇺 | Included in Google Cloud DPA |
| Microsoft (Azure AD / Entra ID) | Authentication (Microsoft login), directory import | Email, name | Ireland 🇮🇪 | View DPA |
| Stripe | Payment gateway | Email, card data | Ireland 🇮🇪 | View DPA |
| Holded | Invoicing | Email, name, tax ID (paying customers only) | Spain 🇪🇸 | View DPA |
| Mailjet | Transactional email | Recipient's email | EU 🇪🇺 | View DPA |
In addition, if your account is managed by a school or organisation, authorised staff of that organisation can view your educational progress within the Platform. That organisation is the controller in such cases (see section 1).
We may also disclose data where there is a legal obligation (for example, to the tax authorities or to law enforcement upon a valid request).
Is data transferred outside the EU?
All core data is stored and processed in the EU (Europe multi-region: Belgium/Netherlands — eur3). The only possible outflows are:
- Google Analytics, and only if you consent: processing in the USA, covered by the EU-US Data Privacy Framework.
- jsDelivr, the public network from which your browser downloads the hand-placement model if you enable the camera: it receives your IP address as a technical consequence of the download, and no other data.
6. How long do we keep your data?
| Type of data | Retention period |
|---|---|
| Account and progress data | While your account is active |
| Account you deleted yourself | 14-day grace period, then permanent deletion (see section 8) |
| Account whose licence your school withdraws | No deletion: you leave the school and your account continues as a free personal account, with your progress |
| Account your school orders to be erased | Permanent, immediate erasure, with no waiting period |
| Account deactivated by your school before September 2026 | 180 days from deactivation, then permanent deletion |
| Students withdrawn from an extracurricular activity | 180 days from withdrawal, then permanent deletion |
| Billing data | 5 years after the last invoice (Spanish tax obligation) |
| Technical and error logs | 30 days (automatic rotation) |
| Google Analytics | 14 months |
| Support tickets | 2 years after resolution |
If your school withdraws your licence, your account is neither deleted nor blocked: you leave the school, the school stops seeing your data, and you keep your account and your progress on the free version, with no time limit. You can carry on practising on your own or join another school with your progress.
Your school can, however, order the permanent erasure of your data, because it is the controller of that data while you study with it: this is what happens, for example, when a family exercises its right to erasure before the school. That erasure is immediate and irreversible and the school carries it out itself from its panel. It does not apply to accounts that have a life of their own beyond the school — those paying their own subscription, those the student created themselves, or those that have kept being used after deactivation: in those cases the request goes through Kluppy, which handles it after verification.
The 180-day periods remaining in the table let you return the following school year without losing your progress: if you rejoin before the period expires, the clock stops and your account is reactivated.
7. Cookies
Kluppy uses essential cookies to operate and optional analytical cookies. See our Cookies Policy for details.
You can manage your cookie preferences at any time from Profile → Privacy → Change cookie preferences.
8. Your rights
You have the following rights over your personal data:
| Right | How to exercise it |
|---|---|
| Access (Art. 15 GDPR) | View all your data and statistics from your profile |
| Rectification (Art. 16 GDPR) | Edit your name, email or avatar from your profile |
| Erasure (Art. 17 GDPR) | "Delete my account" button in Profile → Privacy |
| Portability (Art. 20 GDPR) | "Download my data" button in Profile → Privacy (JSON download) |
| Objection (Art. 21 GDPR) | Write to us at dpo@kluppy.com |
| Restriction (Art. 18 GDPR) | Write to us at dpo@kluppy.com |
| Withdraw consent | From the feature itself (cookies, camera) or by writing to us, without affecting the lawfulness of prior processing |
We will respond within one month of the request, extendable by a further two months if the request is particularly complex.
If your account is managed by a school or organisation, address your request to that organisation: it is the controller, and we assist it.
What happens when you delete your account?
When you click "Delete my account" and confirm by typing "DELETE":
- Immediately, access is disabled: your session is closed, your credentials are revoked and any active paid subscription is cancelled. Processing stops from that moment and you are not charged again.
- For 14 days we keep the account deactivated in case you change your mind. We email you the exact deletion date and how to recover it.
- When that period expires, the purge is automatic, complete and irreversible: profile and personal data, progress, statistics and achievements, avatar and files, text history, friendships and replays, certificates and authentication account.
This grace period exists because immediate deletion cost a user all of her progress after she cancelled over a payment problem. If you prefer immediate deletion without waiting, write to us at dpo@kluppy.com.
9. Minors
In schools and organisations (B2B and extracurricular)
When a school or organisation contracts Kluppy, the school is the Data Controller for its students' data and Kluppy acts as Processor (Art. 28 GDPR), under the Data Processing Agreement (DPA) signed between the parties. The school warrants that it has a valid legal basis for the processing — generally the exercise of its educational function — and that it informs students and families about the use of the platform.
Where the school uses the evidence reports described in section 3 to support its assessment, it falls to the school — as Controller — to inform students and families accordingly, to set and document the weight it gives this block, and to ensure that the grade is always determined by its teaching staff.
In individual use (B2C)
- If you are 14 or older, you can register directly by accepting this policy.
- If you are under 14, the account must be created and managed by your parent or legal guardian, in accordance with Art. 7 LOPDGDD.
Family accounts
Holders of parental authority or guardianship can create and manage the profiles of minors in their care from the family account, keeping control over their data and being able to delete it at any time.
Child protection
Kluppy has an internal child and adolescent protection protocol in accordance with Spanish Organic Law 8/2021 (LOPIVI). Any situation that may affect the safety or wellbeing of a minor can be reported to info@kluppy.com.
10. Security
We protect your data with the following measures:
- 🔒 Encryption in transit: HTTPS/TLS enforced
- 🔒 Encryption at rest: AES-256 (managed by Google Cloud)
- 🔒 Passwords: stored using hash functions, never in plain text
- 🔒 Access control: role system (student, teacher, administrator)
- 🔒 Isolation: server-side security rules preventing access to other people's or organisations' data
- 🔒 Region: all data in the EU (eur3: Belgium/Netherlands)
Data breaches
Should a security breach occur that poses a high risk to your rights, we will notify you without undue delay, and notify the supervisory authority within 72 hours in accordance with Arts. 33 and 34 GDPR.
If you discover a vulnerability, please report it responsibly to info@kluppy.com.
11. Changes to this policy
If we make substantial changes to this policy, we will notify you through a notice on the platform and/or by email before the changes take effect. The version and date at the top of this document always indicate which one is in force.
12. Complaints
If you believe your data is not being processed properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):
- Website: www.aepd.es
- Electronic office: sedeagpd.gob.es
Before turning to the AEPD, we encourage you to contact us directly at dpo@kluppy.com so we can resolve the matter.
13. Contact
- Data protection: dpo@kluppy.com
- General email: info@kluppy.com
- Address: Mikeletegi pasealekua 65 (Planta Baja, Local 1), 20009, Donostia - San Sebastián, Gipuzkoa
Version history
| Version | Date | Changes |
|---|---|---|
| 2.2 | 8 September 2026 | Actual retention when a school withdraws a licence: the account is no longer blocked and deleted after 180 days, but continues as a free personal account with its progress. Permanent erasure becomes an express instruction from the school, carried out from its own panel, with exceptions for accounts that have a life of their own. The 180-day cycle is preserved for deactivations made before September 2026. |
| 2.1 | 4 September 2026 | Evidence reports supporting assessment in schools and organisations: new purpose in section 3, scope and limits (proposal not a grade, human decision, no AI, not the sole or main basis), and the school's obligations as Controller in section 9. |
| 2.0 | 5 August 2026 | Controller vs. processor by segment; Level 0 camera (on-device processing); technical logs; legitimate interest and right to object; automated decision-making; actual retention (14-day grace and 180-day cycles); response deadlines and breach notification; data protection contact. |
| 1.1 | July 2026 | Processor role in schools; AI region. |
| 1.0 | June 2026 | Initial version. |
This policy is governed by the General Data Protection Regulation (EU) 2016/679 and Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).