Privacy Policy
Version 2.0 · 5 August 2026
1. Who is the data controller?
Kluppy S.L. Tax ID: B75131953 Registered office: Mikeletegi pasealekua 56, 20009, Donostia - San Sebastián, Gipuzkoa Contact email: info@kluppy.com Data protection contact: dpo@kluppy.com
Hereinafter "Kluppy", "we" or "the Platform".
This policy applies to https://kluppy.com and its subdomains (including play.kluppy.com and old.kluppy.com while it remains active) and to the official Kluppy mobile applications.
Controller or processor?
Kluppy's role depends on how you reach the Platform:
| Situation | Data controller | Kluppy's role |
|---|---|---|
| You register yourself or create a family account (B2C) | Kluppy | Controller |
| Your school, business or organisation creates your account (B2B) | The school or organisation | Processor (Art. 28 GDPR), under the signed DPA |
| You join an extracurricular activity run by a school | The school | Processor, under the signed DPA |
Where Kluppy acts as a processor, you exercise your rights before the school or organisation; we will point you to the right contact and assist them.
2. What data do we process?
2.1. Data you provide directly
| Data | Required? | Purpose |
|---|---|---|
| Yes | Create your account and be able to contact you | |
| Full name | Yes | Identify you in the classroom and on the platform |
| Username | Yes | Your public name in rankings and leagues |
| Password | Yes | Protect your account |
| Avatar / profile picture | No | Personalisation |
| Billing details (legal name, tax ID, address) | Only if you take out a paid plan | Issue the invoice |
2.2. Data generated by your activity
When you use Kluppy, we automatically generate data about your educational progress:
- Typing speed (words per minute)
- Accuracy (percentage of correct keystrokes)
- Current level and progress
- Experience points (XP) and achievements
- History of practised texts
- Test and speed-certification results, together with the technical signals needed to detect attempts to falsify a result
This data is necessary for the service to work properly and for you (or your teacher) to see your progress.
2.3. Camera in Level 0 (hand placement)
In Level 0 you can turn on your camera so the Platform can tell you whether your hands are correctly placed on the keyboard.
- It is always optional. If you do not grant permission, or you revoke it, the level is completed in manual mode.
- The video never leaves your device. Hand-position analysis runs entirely in your browser (the MediaPipe Hands library). We do not record, transmit or store any image or frame. Only the level outcome (completed or not) reaches the server.
- This is not biometric data processing within the meaning of Art. 4(14) GDPR: hand landmarks are computed in memory to draw the on-screen guide, discarded immediately, and never used to identify you.
- The analysis model files are downloaded from the public jsDelivr content delivery network, which by virtue of the download learns your IP address.
2.4. Payment data (paid users only)
If you take out a paid plan, Stripe (our payment gateway) will process your card data. Kluppy never stores your card details — Stripe is PCI-DSS Level 1 compliant, the highest payment security standard.
2.5. Technical and error logs
To keep the service running and diagnose faults, we log technical incidents. These logs may include your account identifier, the operation that failed and the error message. They are not used for commercial purposes or to profile you, and they are deleted by automatic rotation (see section 6).
2.6. Visit origin (at account creation)
When you create your account we record where your visit came from (referrer page and UTM campaign tags from our own links) for marketing statistics. It does not include your IP or third-party identifiers, and it is deleted along with your account.
2.7. Data we do NOT collect
- ❌ Postal address (other than the billing address, if you take out a paid plan)
- ❌ Phone number (except in school registration, optional)
- ❌ Date of birth on the learning platform. Exception: Kluppy Academy and the monitor recruitment process do request it, as verifying that the person is of legal age is mandatory; both are governed by their own policies.
- ❌ Biometric data (see section 2.3)
- ❌ Geolocation
- ❌ Browsing history outside Kluppy
- ❌ Health data
- ❌ Social media data (Google or Microsoft login only collects email and name)
3. What do we use your data for?
| Purpose | Legal basis | Data used |
|---|---|---|
| Create and manage your account | Performance of a contract (Art. 6.1.b GDPR) | Email, name, password |
| Social authentication (Google/Microsoft) | Performance of a contract (Art. 6.1.b GDPR) | Email, name (provided by the OAuth provider) |
| Provide the educational service | Performance of a contract (Art. 6.1.b GDPR) | Typing metrics, progress, level |
| Directory import | Admin's consent (Art. 6.1.a GDPR) | Email, name (from Google Workspace/Classroom or Microsoft 365) |
| Billing | Legal obligation (Art. 6.1.c GDPR) | Email, name, tax and payment details |
| Sending invitation emails and service notices | Performance of a contract (Art. 6.1.b GDPR) | |
| Hand-placement camera guide | Consent, revocable (Art. 6.1.a GDPR) | Image processed on your device only, no storage |
| Security and prevention of fraud in results and certifications | Legitimate interest (Art. 6.1.f GDPR) | Technical signals from the typing session |
| Error diagnosis and service stability | Legitimate interest (Art. 6.1.f GDPR) | Technical logs (section 2.5) |
| Web analytics (Google Analytics) | Consent (Art. 6.1.a GDPR) | Anonymous browsing data |
| Technical support (tickets) | Performance of a contract (Art. 6.1.b GDPR) | Email, message content |
Where the basis is legitimate interest, we have balanced that interest against your rights and you may object at any time by writing to dpo@kluppy.com.
We never sell your data to third parties, nor use it for advertising.
Automated decision-making
We do not take automated decisions producing legal or similarly significant effects concerning you (Art. 22 GDPR), nor do we profile you for that purpose. Typing metrics are objective measurements of what you type, not assessments of you as a person.
4. Use of Artificial Intelligence (Regulation (EU) 2024/1689 — AI Act)
Kluppy uses artificial intelligence (AI) to improve the learning experience. This section explains how AI is used, in compliance with the European AI Act and the GDPR.
4.1. AI systems used
| AI system | Provider | Purpose | Is personal data sent? |
|---|---|---|---|
| Exercise text generation | Google Vertex AI (Gemini) | Create typing practice texts tailored to your level | ❌ No — Only technical parameters (allowed characters, language, text length) |
| Tutorial scripts | Google Vertex AI (Gemini) | Generate instructional audio scripts for learning each key | ❌ No — Only the key character and the language |
| Benchmark texts | Google Vertex AI (Gemini) | Generate paragraphs for typing speed tests | ❌ No — Only language and technical parameters |
| Document analysis (administrators only) | Google Vertex AI (Gemini) | Extract names and emails from uploaded documents (e.g. student lists) | ⚠️ Yes — The document content is processed by the AI |
Hand-placement detection (section 2.3) also uses a vision model, but it runs on your own device and sends nothing to any provider.
4.2. How AI-generated content is identified
When you practise with an AI-generated text, you will see an "✨ AI-generated" label in the exercise interface, ensuring transparency about the origin of the content you interact with.
4.3. Key facts about AI at Kluppy
- No profiling: AI is not used to profile, score or classify users. It only generates educational content.
- No automated decisions: AI makes no decision affecting your rights, your access or your educational results.
- Human oversight: All AI-generated content is subject to review by administrators and can be disabled at any time. If a text seems inappropriate, you can report it from within the Platform.
- Data minimisation: We send AI systems the bare minimum — in most cases, zero personal data.
- EU processing: AI processing takes place in Europe (Vertex AI region: EU
eumulti-region). User data is stored in Europe (Firestore region: eur3, Belgium/Netherlands). - No training on your data: Your personal data is not used to train AI models. Google Vertex AI processes requests without retaining user data for training, per our Google Cloud project configuration (Data Logging disabled, EU
eumulti-region for AI processing). Details in Google Cloud's Data Governance documentation.
4.4. Document analysis (administrators only)
When an administrator uploads a document (PDF or image) to extract emails, the document is sent to Google Vertex AI for processing. This involves processing personal data (names and emails contained in the document).
- For individual users (B2C): This processing is based on performance of a contract (Art. 6.1.b GDPR).
- For schools (B2B): Kluppy acts as Processor (Art. 28 GDPR). The legal basis is the Data Processing Agreement (DPA) signed with the school, which expressly authorises Google Vertex AI as a sub-processor.
Document content is processed in memory and explicitly deleted after processing. It is not saved to any database, bucket or log. The AI provider does not retain request data for training (Data Logging disabled in our Google Cloud configuration).
4.5. Your rights regarding AI
- You have the right to know when content is AI-generated (transparency labels in the interface).
- You can contact us at info@kluppy.com for more information about the use of AI.
- If you consider AI-generated content inappropriate, you can report it from the Platform or through the support system.
5. Who do we share your data with?
We only share data with the providers needed for the service to work:
| Provider | Service | Data shared | Location | DPA |
|---|---|---|---|---|
| Google Cloud / Firebase | Storage, processing, authentication (Google login) | All account data | EU 🇪🇺 (Belgium/Netherlands — eur3) | View DPA |
| Google Vertex AI | Educational text generation | No personal data (technical parameters only) | EU 🇪🇺 (eu multi-region) | Included in Google Cloud DPA |
| Google Workspace / Classroom | Directory import (optional, admin-initiated) | Student email, name | EU 🇪🇺 | Included in Google Cloud DPA |
| Microsoft (Azure AD / Entra ID) | Authentication (Microsoft login), directory import | Email, name | Ireland 🇮🇪 | View DPA |
| Stripe | Payment gateway | Email, card data | Ireland 🇮🇪 | View DPA |
| Holded | Invoicing | Email, name, tax ID (paying customers only) | Spain 🇪🇸 | View DPA |
| Mailjet | Transactional email | Recipient's email | EU 🇪🇺 | View DPA |
In addition, if your account is managed by a school or organisation, authorised staff of that organisation can view your educational progress within the Platform. That organisation is the controller in such cases (see section 1).
We may also disclose data where there is a legal obligation (for example, to the tax authorities or to law enforcement upon a valid request).
Is data transferred outside the EU?
All core data is stored and processed in the EU (Europe multi-region: Belgium/Netherlands — eur3). The only possible outflows are:
- Google Analytics, and only if you consent: processing in the USA, covered by the EU-US Data Privacy Framework.
- jsDelivr, the public network from which your browser downloads the hand-placement model if you enable the camera: it receives your IP address as a technical consequence of the download, and no other data.
6. How long do we keep your data?
| Type of data | Retention period |
|---|---|
| Account and progress data | While your account is active |
| Account you deleted yourself | 14-day grace period, then permanent deletion (see section 8) |
| Account deactivated by your school or organisation | 180 days from deactivation, then permanent deletion |
| Students withdrawn from an extracurricular activity | 180 days from withdrawal, then permanent deletion |
| Billing data | 5 years after the last invoice (Spanish tax obligation) |
| Technical and error logs | 30 days (automatic rotation) |
| Google Analytics | 14 months |
| Support tickets | 2 years after resolution |
The 180-day periods let you return the following school year without losing your progress. If you rejoin before the period expires, the clock stops and your account is reactivated.
7. Cookies
Kluppy uses essential cookies to operate and optional analytical cookies. See our Cookies Policy for details.
You can manage your cookie preferences at any time from Profile → Privacy → Change cookie preferences.
8. Your rights
You have the following rights over your personal data:
| Right | How to exercise it |
|---|---|
| Access (Art. 15 GDPR) | View all your data and statistics from your profile |
| Rectification (Art. 16 GDPR) | Edit your name, email or avatar from your profile |
| Erasure (Art. 17 GDPR) | "Delete my account" button in Profile → Privacy |
| Portability (Art. 20 GDPR) | "Download my data" button in Profile → Privacy (JSON download) |
| Objection (Art. 21 GDPR) | Write to us at dpo@kluppy.com |
| Restriction (Art. 18 GDPR) | Write to us at dpo@kluppy.com |
| Withdraw consent | From the feature itself (cookies, camera) or by writing to us, without affecting the lawfulness of prior processing |
We will respond within one month of the request, extendable by a further two months if the request is particularly complex.
If your account is managed by a school or organisation, address your request to that organisation: it is the controller, and we assist it.
What happens when you delete your account?
When you click "Delete my account" and confirm by typing "DELETE":
- Immediately, access is disabled: your session is closed, your credentials are revoked and any active paid subscription is cancelled. Processing stops from that moment and you are not charged again.
- For 14 days we keep the account deactivated in case you change your mind. We email you the exact deletion date and how to recover it.
- When that period expires, the purge is automatic, complete and irreversible: profile and personal data, progress, statistics and achievements, avatar and files, text history, friendships and replays, certificates and authentication account.
This grace period exists because immediate deletion cost a user all of her progress after she cancelled over a payment problem. If you prefer immediate deletion without waiting, write to us at dpo@kluppy.com.
9. Minors
In schools and organisations (B2B and extracurricular)
When a school or organisation contracts Kluppy, the school is the Data Controller for its students' data and Kluppy acts as Processor (Art. 28 GDPR), under the Data Processing Agreement (DPA) signed between the parties. The school warrants that it has a valid legal basis for the processing — generally the exercise of its educational function — and that it informs students and families about the use of the platform.
In individual use (B2C)
- If you are 14 or older, you can register directly by accepting this policy.
- If you are under 14, the account must be created and managed by your parent or legal guardian, in accordance with Art. 7 LOPDGDD.
Family accounts
Holders of parental authority or guardianship can create and manage the profiles of minors in their care from the family account, keeping control over their data and being able to delete it at any time.
Child protection
Kluppy has an internal child and adolescent protection protocol in accordance with Spanish Organic Law 8/2021 (LOPIVI). Any situation that may affect the safety or wellbeing of a minor can be reported to info@kluppy.com.
10. Security
We protect your data with the following measures:
- 🔒 Encryption in transit: HTTPS/TLS enforced
- 🔒 Encryption at rest: AES-256 (managed by Google Cloud)
- 🔒 Passwords: stored using hash functions, never in plain text
- 🔒 Access control: role system (student, teacher, administrator)
- 🔒 Isolation: server-side security rules preventing access to other people's or organisations' data
- 🔒 Region: all data in the EU (eur3: Belgium/Netherlands)
Data breaches
Should a security breach occur that poses a high risk to your rights, we will notify you without undue delay, and notify the supervisory authority within 72 hours in accordance with Arts. 33 and 34 GDPR.
If you discover a vulnerability, please report it responsibly to info@kluppy.com.
11. Changes to this policy
If we make substantial changes to this policy, we will notify you through a notice on the platform and/or by email before the changes take effect. The version and date at the top of this document always indicate which one is in force.
12. Complaints
If you believe your data is not being processed properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):
- Website: www.aepd.es
- Electronic office: sedeagpd.gob.es
Before turning to the AEPD, we encourage you to contact us directly at dpo@kluppy.com so we can resolve the matter.
13. Contact
- Data protection: dpo@kluppy.com
- General email: info@kluppy.com
- Address: Mikeletegi pasealekua 56, 20009, Donostia - San Sebastián, Gipuzkoa
Version history
| Version | Date | Changes |
|---|---|---|
| 2.0 | 5 August 2026 | Controller vs. processor by segment; Level 0 camera (on-device processing); technical logs; legitimate interest and right to object; automated decision-making; actual retention (14-day grace and 180-day cycles); response deadlines and breach notification; data protection contact. |
| 1.1 | July 2026 | Processor role in schools; AI region. |
| 1.0 | June 2026 | Initial version. |
This policy is governed by the General Data Protection Regulation (EU) 2016/679 and Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).