Privacy policy
This page explains what personal data we process when you use Coursio, why, for how long and who we share it with. It is written from what the system actually does, not from what these pages usually say.
Last updated: 2026-07-26
Not yet commercially operated
Coursio is in development and is not yet offered as a paid service, so the identification details required by Spanish LSSI-CE art. 10 do not yet apply. For any privacy or data protection question, write to [email protected] and we will reply.
What we process
Only this. We neither ask for nor store anything else:
- Identification: your email address and, if you provide it, your name. Needed to create the account and identify you at sign-in.
- User.email, User.name
- Credentials: your password, stored only as a bcrypt hash. We do not keep it in plain text and cannot recover it.
- User.passwordHash
- Academy details: the name you give it and the country of your payout account.
- Tenant.name, StripeAccount.country
- Billing: the identifiers Stripe assigns to your customer and connected account. Card details never reach our servers and are not stored here.
- Subscription.stripeCustomerId, StripeAccount.stripeAccountId
- Learning activity: which courses you are enrolled in and your progress through lessons.
- Enrollment, Progress
- Security: the IP address and user agent attached to sensitive actions, in an audit log.
- AuditLog.ipAddress, AuditLog.userAgent
Legal basis
- Performance of a contract (GDPR art. 6(1)(b)): creating and maintaining your account, hosting your courses, processing the subscription and giving enrolled students access.
- Legitimate interest (GDPR art. 6(1)(f)): the audit log with IP and user agent, to detect unauthorised access and abuse.
- Legal obligation (GDPR art. 6(1)(c)): retaining billing records for the periods required by tax and accounting law.
How long we keep data
- Account and academy data: while the account is active. If you delete it, data is erased or anonymised except what we must retain by law.
- Audit logs: 12 months.
- Billing records: the applicable statutory tax and accounting retention periods.
- Videos and content you upload: while you keep the account; deleted when you close it.
Who else receives your data
Only the providers strictly necessary to run the service. We do not sell data or share it for advertising.
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Stripe Payments Europe, Ltd. | Payment and subscription processing | Irlanda (UE) y Estados Unidos | Standard contractual clauses and, where applicable, the EU-US adequacy framework |
| Oracle Cloud Infrastructure | Application and database hosting | Madrid, España | Data hosted inside the European Economic Area |
Where the data is hosted
The application and database run on Oracle Cloud Infrastructure infrastructure located in Madrid, España, inside the European Economic Area. Backups are kept encrypted in the same region.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time by writing to the contact address above. We will respond within one month.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
Security
- All traffic is encrypted with TLS.
- Passwords are stored as bcrypt hashes, never in plain text.
- The database is not exposed to the internet: it is reachable only from the application itself.
- Each academy is isolated: every query is scoped to its own organisation identifier.
- Encrypted backups with periodic verification.
Minors
The service is intended for people over 18. We do not knowingly request or process data belonging to minors. If we identify a minor's account, we will delete it.
This text was written from what the application actually does: the fields in the data model, the cookies it sets and the third parties that are wired up. It is not a substitute for professional review before trading commercially.