The data controller is the owner of Growthfolio. For any privacy question you can write to privacidad@growthfolioapp.com.
2. What data we process
Account data: your email address and your name.
Billing data: if you subscribe, Stripe processes your payment; we only store the subscription status, never your card details.
Referral programme payout data: if you request a commission payout, the phone number (Bizum) or IBAN you provide, used exclusively to pay you (legal basis: performance of the programme you take part in).
Family space data: the information that you and the other guardians of the space voluntarily record about your children — learning activities, reading, social life, goals, assessments, health appointments and measurements, and any photos or videos you attach.
Some of this information may include children's health data, which is special-category data. It is processed only because you choose to record it, with your explicit consent.
3. Why, and on what legal basis
The data is used exclusively to provide the service: storing your family journal and showing it to the guardians of the space. The legal basis is your explicit consent (arts. 6.1.a and 9.2.a GDPR), which you give when creating the account and can withdraw at any time by deleting your account. We do not use your data for advertising, we do not sell it or share it with third parties, and we do not build profiles.
4. About children's data
Information about children is entered and controlled exclusively by their parents or legal guardians, in exercise of their parental responsibility. Children do not have accounts or access of their own.
5. Where it is stored and who helps us provide the service
Supabase — database and files, hosted in the European Union.
Vercel — servers that deliver the web application.
Brevo — delivery of sign-in and invitation emails (an EU company).
Stripe — payment and subscription processing. Card details are entered into and held by Stripe directly, with PCI-DSS certification; they never pass through our servers.
Anthropic— only if you use the assisted-writing button (“Write with AI”): the text of your note, together with the grade, curriculum, activity type and subjects, is sent to Anthropic's API to generate the suggestion. Children's names and any other space data are never sent. Anthropic does not use this data to train its models. If you don't use the button, nothing is sent.
These providers act as data processors with the corresponding guarantees. Data travels and is stored encrypted. Each family can only access its own space, with isolation enforced at the database level.
6. How long we keep it
For as long as your account exists. If you delete your account (Settings → Account), your user and — if you are the space owner — all the family space's data and files are deleted immediately and permanently. We keep no copies for our own purposes.
7. Your rights
You can exercise your rights of access, rectification, erasure, portability, restriction and objection at any time:
Portability: download all the space's data in Settings → Account → Export my data.
Erasure: delete your account and data in Settings → Account → Delete account.