Privacy

OfficeDesk AS is the controller responsible for processing Canta los Verbos data. You can contact hola@cantalosverbos.es or call +47 45 42 43 44 to ask about this information or exercise your rights.

Vercel hosts the website and receives the technical data needed to deliver the pages and protect the service, such as your IP address and the request information sent by your browser.

When you press play, your browser connects to bunny.net to receive the audio. This connection also requires the processing of technical request data, such as your IP address. You do not need to create an account to listen to the song in the lesson.

For delivering the website and audio and preventing abuse, the proposed legal basis is legitimate interests under Article 6(1)(f) of the General Data Protection Regulation (GDPR): providing an available and secure service with the minimum data necessary. The assessment of necessity and the balancing of these interests against your rights must be documented. Without technical connection data, we cannot deliver the requested content.

When you choose a language in the selector that says it will be saved on this device, you ask us to remember that preference. The first-party clv_user_locale cookie stores the language and the time of the initial choice for a maximum of 180 days. Visits and language changes do not extend that period. It is used exclusively for language, not advertising, behavioural analysis or profiling. We use the saved choice or the language reported by your browser to suggest a version of the page; the page address still determines its language. A visit or an automatic suggestion does not itself save the preference. If you dismiss the suggestion, the clv_home_language_dismissed cookie retains that decision for the browser session.

In the free lesson, you can choose to remember preferences for displaying question translations, translations after answering, theory translations and grammatical patterns. This option is off by default. If you enable it, the clv-public-first-lesson:display:v2 local storage entry saves these four settings and the acceptance date, but not your answers or account progress. They remain valid for 180 days, and changes do not extend that period. Once expired, they are no longer used to restore preferences and are deleted while the page is open or on the next visit; the browser may retain expired data while the site remains closed.

You can delete the saved language using the button in this section. If you subsequently choose a language in the selector to save it again, a new preference is created. You can turn off remembering the lesson settings through its controls. Deleting these settings does not delete your answers or change the view you already have open. You can also delete or block cookies and local storage through your browser settings. Direct addresses for each language's pages still work without saving a preference.

To remember only the language you choose to save, we apply the exception in section 3-15, second paragraph, of the Norwegian Electronic Communications Act for an expressly requested function. The 180 days allow you to resume the course between visits without keeping the preference indefinitely; this is not a period prescribed by law. To the extent that personal data is involved, the basis is our legitimate interest in providing that requested function under Article 6(1)(f) of the GDPR, with a documented assessment limited to this use. Saving the lesson's display settings remains a separate, default-off and revocable option; the proposed basis for it is consent under Article 6(1)(a) of the GDPR and Norwegian electronic communications legislation. Neither preference is a condition of access to the free lesson. Dismissing the language suggestion only saves that request for the session.

Your answers are sent to the server for marking and to display explanations. The exercise state is returned in encrypted form and is held temporarily in the open page. That state includes results, but not the original text of your answers.

The attempt expires one hour after it begins. Continuing or repeating exercises within that attempt does not extend the time limit. Reloading the page starts another attempt; the free lesson does not add these results to account progress.

Answering is voluntary, but we need the answer you send to mark that exercise. For this function, the proposed legal basis is legitimate interests under Article 6(1)(f) of the GDPR in providing the requested practice, with a documented assessment. Automated marking provides educational feedback; it does not make decisions about your contract or produce legal effects.

If you use an existing account, Supabase manages your email address, user identifier, authentication and session data. Sign-in links are sent by email through Resend. We need a verifiable email address to identify you and send you the link; without it, we cannot give you access to an account.

The learning areas linked to an account save preferences, reading positions and practice results so that you can continue where you left off. They do not save the original text of answers. The public free lesson works without signing in and does not add its exercises to account progress.

Sign-in cookies have a configured lifetime of up to 400 days. The Supabase session has no configured maximum lifetime or inactivity timeout. The access token expires after one hour, but it can be refreshed while the session remains active. The cookie's lifetime and the session's validity are different: closing the browser is not the same as signing out or deleting the account. You can sign out from your account and delete the site data in your browser.

Article 6(1)(b) of the GDPR is proposed as the legal basis for providing the access and learning functions covered by the contract, to the extent that each item of data is necessary to perform it. Article 6(1)(f) is proposed for preventing unauthorised access, subject to the appropriate assessment. A test or administration account needs a justification suited to its use.

If you write to us, we receive your address and the content of your message so that we can help you. Providing information is voluntary, although we need a way to reply and the relevant details to resolve your enquiry. Avoid including passwords, sign-in links or full card details.

The hola@cantalosverbos.es inbox is hosted by Domeneshop. Within OfficeDesk AS, access to the messages is restricted to the person responsible for the service so that they can handle enquiries. Domeneshop processes the data needed to provide and protect the email service.

Article 6(1)(b) of the GDPR is proposed for enquiries necessary to prepare or perform a contract. For other enquiries, the proposed legal basis is legitimate interests under Article 6(1)(f) in responding to people who contact us, subject to assessment. When we handle a rights request, the basis is compliance with GDPR obligations under Article 6(1)(c).

Vercel is involved in hosting and running the website; bunny.net in delivering audio; Supabase in accounts and learning data; Resend in sending sign-in emails; and Domeneshop in receiving, storing and sending support emails. Each service receives the data needed for its function. Annual purchases are disabled: we do not present Stripe/Link or a new payment flow as active processing for this free lesson.

According to its public documentation, Vercel provides for processing in the United States and other countries where it operates. Supabase provides for access for operations or support from Singapore and the United States. Resend stores message content and logs in the United States; choosing a European sending region does not change that storage. We do not claim that all data remains in the European Economic Area.

These providers describe European Commission standard contractual clauses and other measures for international transfers. Before the final version is published, the applicable contracts, countries, subprocessors and safeguards for each service, including bunny.net, must be verified. You can ask us for information and a copy of the safeguards that apply to your data.

The verified retention periods for preferences and the free attempt are stated in sections 3 and 4. They must not be confused with providers' technical logs or account data, which do not disappear when a tab is closed.

The person responsible for the service reviews the support inbox each month and deletes ordinary support messages no later than twelve months after the enquiry is closed. Information is retained for longer only when it is still needed for a specific complaint, to establish, exercise or defend a legal claim, or to comply with a legal record-keeping obligation. This review and deletion are manual, not automatic. The twelve-month period is our retention rule, not a period required by law.

The bunny.net documentation states three days for its standard logs; the IP anonymisation shown by its API does not prove that an original IP address was never stored. Resend states thirty days for messages and logs on its Free, Pro and Scale plans, and seven days for backups. These published periods must be checked against the service and configuration in use. Retention of Vercel logs and Supabase backups depends on the plan and configuration.

You can request erasure of your data. Specific information may need to be retained to comply with a legal obligation or to establish, exercise or defend a claim; this does not justify retaining all account data. Backups require a procedure that prevents a restoration from bringing data back into use when it should have remained deleted.

You can request access, rectification, erasure and, where applicable, restriction of processing. You can object to processing based on legitimate interests on grounds relating to your particular situation. Where applicable, portability applies to data you have provided that is processed by automated means on the basis of a contract or consent. If processing is based on your consent, you can withdraw it without affecting the lawfulness of earlier processing. To exercise these rights, write to hola@cantalosverbos.es or call +47 45 42 43 44. We will only ask for additional information to verify your identity when it is necessary and proportionate. We must respond without undue delay and no later than one month after receipt. If the complexity or number of requests justifies an extension of up to a further two months, we must inform you within the first month and explain the reason. Exercising your rights is free of charge, subject to the exceptions provided for in the GDPR.

You can also lodge a complaint with Datatilsynet, the Norwegian data protection authority, or with the competent authority in the country where you live, work or where the alleged infringement occurred.