Legal
Privacy policy
On this page we explain what data HabloHack processes, for what purpose, for how long, and what rights you have in that regard.
Last updated: 01/09/2026
1. Who is responsible for your data
In compliance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), we inform you of the following:
- Data controller: Ignacio Kleinman Ruiz (a natural person; HabloHack does not currently operate under a company)
- Address: C/ Teresa Berganza, 76, 28200 San Lorenzo de El Escorial (Madrid, Spain)
- Privacy email: info@hablohack.com
- Website: www.hablohack.com
For any question about data protection, write to us at info@hablohack.com with the subject line "DATA PROTECTION".
2. Who is who
- Visitor: a person who browses hablohack.com without having registered.
- User or Student: a person who creates an account on HabloHack to read stories, save vocabulary, and study with flashcards.
- Subscriber: a User who purchases a paid plan.
- Community content: vocabulary lists or other items that a User publishes so that other Users can view or clone them.
Unlike intermediation platforms, HabloHack has no external "organizers" or "providers": the data processing relationship is direct between HabloHack and each User.
3. What data we process and why
3.1. If you only visit the website
| Data / category | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Technical browsing data (IP address, browser type, pages viewed, date and time of access) | Platform security, usage analysis, and fraud detection | Legitimate interest (Art. 6.1.f GDPR) | 12 months |
| Web analytics data | HabloHack does not currently use any web analytics tools. If any are added in the future, this policy will be updated before they are activated | Consent (Art. 6.1.a GDPR), where applicable | Not currently applicable |
| Name and email address provided in the interest/waitlist form on the landing page | Sending you updates about the launch, content, and product progress | Consent (Art. 6.1.a GDPR) | Until you withdraw your consent |
| Contact details if you write to us | Handling your inquiry | Consent (Art. 6.1.a GDPR) | Until the inquiry is resolved, plus 5 additional years in case we need to defend ourselves against a claim |
3.2. If you register and use the app
| Data / category | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, email address, and encrypted password | Creating and managing your account, authentication | Performance of a contract (Art. 6.1.b GDPR) | For the life of the account and 5 years after closure |
| Reading activity: stories read, reading time, level selected | Providing you with the graded reading service and tailoring recommendations | Performance of a contract (Art. 6.1.b GDPR) | For the life of the account |
| Saved vocabulary, personal lists, and flashcard reviews (including data generated by the FSRS algorithm: review date, success rate, repetition interval) | Providing you with the study and spaced-repetition review service | Performance of a contract (Art. 6.1.b GDPR) | For the life of the account |
| Retention statistics, study streak, and progress | Showing you your own progress dashboard | Performance of a contract (Art. 6.1.b GDPR) | For the life of the account |
| Subscription and payment data (plan purchased, amount, billing history). Full card details are managed directly by Stripe | Managing the charge, issuing confirmation, and after-sales support | Performance of a contract (Art. 6.1.b GDPR) | 6 years, for accounting obligations (Art. 30 of the Spanish Commercial Code) |
| Billing data (name/company name, tax ID, address), if you request an invoice | Issuing invoices and complying with tax obligations | Legal obligation (Art. 6.1.c GDPR) | 6 years (legal obligation, Art. 30 of the Spanish Commercial Code) |
3.3. If you publish or clone community lists
| Data / category | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Public profile name (if different from your account name) and lists you decide to publish | Allowing other Users to find, view, and clone your list | Performance of a contract / consent upon publishing (Art. 6.1.a and 6.1.b GDPR) | As long as the list remains published |
| Number of clones, ratings, or interactions on your list | Showing popularity and relevance within the community | Legitimate interest (Art. 6.1.f GDPR) | As long as the list remains published |
Remember: what you publish as community content is visible to other Users. Do not include personal data about yourself or third parties in your lists that you do not want made public.
4. Providers and data processors
HabloHack relies on the following providers to deliver the service, all of them subject to a data processing agreement under Article 28 GDPR where applicable:
- Application hosting: Railway (Railway Corporation), with infrastructure located in Europe.
- Domain and email: Infomaniak Network SA.
- Database: Supabase, with the database server located in Europe.
- Payment processor: Stripe Payments Europe, Ltd.
- Web analytics: no analytics provider is currently used.
5. International transfers
- Supabase (database): the database server is located in Europe, so there is no international data transfer in this respect.
- Railway (application hosting): the hosting infrastructure is located in Europe, so there is likewise no international transfer in this respect. Even so, since Railway Corporation is a US entity, it is advisable to confirm by contract (DPA) that data processing remains within the European region.
- Infomaniak (domain and email): a Swiss company. Switzerland has an adequacy decision from the European Commission, so transfers to Infomaniak do not require additional safeguards.
- Stripe (payments): Stripe Payments Europe, Ltd. may transfer data to its parent company in the United States. This transfer is covered by Standard Contractual Clauses approved by the European Commission and, where applicable, by the EU-US Data Privacy Framework.
6. Retention periods
| Data category | Retention period |
|---|---|
| Browsing data and web logs | 12 months |
| User account | Life of the account + 5 years |
| Reading activity, vocabulary, and reviews | Life of the account |
| Billing data | 6 years (legal obligation, Art. 30 of the Spanish Commercial Code) |
| Newsletter consent | Until you withdraw it |
| Contact inquiries | 5 years after resolution |
7. Summary of legal bases
- Performance of a contract (Art. 6.1.b GDPR): account management, reading and study service, subscription and billing.
- Consent (Art. 6.1.a GDPR): newsletter, non-essential cookies, voluntary publication of community content.
- Legal obligation (Art. 6.1.c GDPR): retention of invoices and accounting documentation.
- Legitimate interest (Art. 6.1.f GDPR): platform security, fraud prevention, internal statistics.
8. Your rights
As a data subject you may exercise:
- Access: find out what data we process about you.
- Rectification: correct inaccurate data.
- Erasure: request that we delete your data when it is no longer necessary.
- Restriction: request that we suspend processing in certain cases.
- Portability: receive your data in a structured format and transmit it to another service.
- Objection: object to processing based on legitimate interest.
- Withdrawal of consent: at any time, without retroactive effect.
To exercise these rights, write to us at info@hablohack.com with the subject line "DATA PROTECTION - EXERCISE OF RIGHTS", attaching a copy of your identity document. If you believe that the processing of your data infringes the applicable regulations, you may file a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. Minors
HabloHack is also designed for young Spanish learners, so this section deserves special care:
- Using HabloHack requires a minimum age of 14, in accordance with Article 7 of the LOPDGDD on minors' consent.
- If you are under 14, you need the consent of your parent or legal guardian before creating an account.
- We do not knowingly request data from minors below that age without such consent. If we detect that an account has been created in breach of this condition, we will block or delete it.
12. Security measures
We apply reasonable technical and organizational measures to protect your data: encryption in transit (HTTPS/TLS), access controls, periodic backups, and incident response procedures. If a security breach occurs that poses a risk to your rights, we will report it to the AEPD within the legal timeframe and, where applicable, to you as well.
13. International users
HabloHack is available to students from any country. The GDPR applies to the processing of data of individuals located in the European Union. If you reside outside the EU, for any dispute related to the processing of your data, the parties submit to the Courts and Tribunals of Madrid, without prejudice to any rights that the consumer protection regulations of your country of residence may grant you.
14. Language
The reference language of this Privacy Policy is Spanish. In the event of any discrepancy between versions in different languages, the Spanish version shall prevail.
15. Changes to this policy
We may modify this policy to adapt it to legislative changes or changes in our processing activities. If the change is significant, we will notify you through our usual communication channels. The date of the last update appears at the beginning of the document.
16. Contact
- Email: info@hablohack.com
- Postal address: C/ Teresa Berganza, 76, 28200 San Lorenzo de El Escorial (Madrid, Spain)
11. Social media
If you interact with our social media profiles, the processing of that interaction is governed by this policy as regards our own activity, and by the terms and privacy policy of each social network. We are not responsible for the privacy practices of third-party platforms.