Privacy Policy

Privacy Policy

Version 2.1 · 4 September 2026

1. Who is the data controller?

Kluppy S.L. Tax ID: B75131953 Registered office: Mikeletegi pasealekua 65 (Planta Baja, Local 1), 20009, Donostia - San Sebastián, Gipuzkoa Contact email: info@kluppy.com Data protection contact: dpo@kluppy.com

Hereinafter "Kluppy", "we" or "the Platform".

This policy applies to https://kluppy.com and its subdomains (including play.kluppy.com and old.kluppy.com while it remains active) and to the official Kluppy mobile applications.

Controller or processor?

Kluppy's role depends on how you reach the Platform:

Where Kluppy acts as a processor, you exercise your rights before the school or organisation; we will point you to the right contact and assist them.

2. What data do we process?

2.1. Data you provide directly

2.2. Data generated by your activity

When you use Kluppy, we automatically generate data about your educational progress:

• Typing speed (words per minute)
• Accuracy (percentage of correct keystrokes)
• Current level and progress
• Experience points (XP) and achievements
• History of practised texts
• Test and speed-certification results, together with the technical signals needed to detect attempts to falsify a result

This data is necessary for the service to work properly and for you (or your teacher) to see your progress.

2.3. Camera in Level 0 (hand placement)

In Level 0 you can turn on your camera so the Platform can tell you whether your hands are correctly placed on the keyboard.

• It is always optional. If you do not grant permission, or you revoke it, the level is completed in manual mode.
• The video never leaves your device. Hand-position analysis runs entirely in your browser (the MediaPipe Hands library). We do not record, transmit or store any image or frame. Only the level outcome (completed or not) reaches the server.
• This is not biometric data processing within the meaning of Art. 4(14) GDPR: hand landmarks are computed in memory to draw the on-screen guide, discarded immediately, and never used to identify you.
• The analysis model files are downloaded from the public jsDelivr content delivery network, which by virtue of the download learns your IP address.

2.4. Payment data (paid users only)

If you take out a paid plan, Stripe (our payment gateway) will process your card data. Kluppy never stores your card details — Stripe is PCI-DSS Level 1 compliant, the highest payment security standard.

2.5. Technical and error logs

To keep the service running and diagnose faults, we log technical incidents. These logs may include your account identifier, the operation that failed and the error message. They are not used for commercial purposes or to profile you, and they are deleted by automatic rotation (see section 6).

2.6. Visit origin (at account creation)

When you create your account we record where your visit came from (referrer page and UTM campaign tags from our own links) for marketing statistics. It does not include your IP or third-party identifiers, and it is deleted along with your account.

2.7. Data we do NOT collect

• ❌ Postal address (other than the billing address, if you take out a paid plan)
• ❌ Phone number (except in school registration, optional)
• ❌ Date of birth on the learning platform. Exception: Kluppy Academy and the monitor recruitment process do request it, as verifying that the person is of legal age is mandatory; both are governed by their own policies.
• ❌ Biometric data (see section 2.3)
• ❌ Geolocation
• ❌ Browsing history outside Kluppy
• ❌ Health data
• ❌ Social media data (Google or Microsoft login only collects email and name)

3. What do we use your data for?

Where the basis is legitimate interest, we have balanced that interest against your rights and you may object at any time by writing to dpo@kluppy.com.

We never sell your data to third parties, nor use it for advertising.

Automated decision-making

We do not take automated decisions producing legal or similarly significant effects concerning you (Art. 22 GDPR), nor do we profile you for that purpose. Typing metrics are objective measurements of what you type: they record what you do on the Platform, they do not describe who you are.

Evidence reports in schools and organisations

If you practise with Kluppy within a school or an organised activity, that school may request an evidence report: a document that arranges those same measurements by period and places them in achievement bands, to help its teachers assess the keyboard-writing block. Here is exactly what it is and what it is not:

• It is a proposal, not a mark. The report produces no effect by itself: it does not change your level, your access or your progress in Kluppy, and it does not become a grade merely by being issued.
• A person always sets the grade. The school's teaching staff can change or discard any proposed band before transferring it to a report card, and it is they who decide.
• Kluppy cannot be the sole or main basis of your grade. The contract with the school expressly prohibits this, and the tool requires the school to set and document the weight it gives this block within the subject.
• The bands are not decided by AI. They are calculated using fixed arithmetic rules applied to your measurements and to cut-points that the school agrees and publishes. The AI systems described in section 4 play no part in the report.
• We say what we measure. The report always distinguishes what is measured (speed, accuracy, level reached, keystrokes) from its interpretation (the band), and prints the band alongside the data supporting it, never on its own.
• Coverage of the classwork signal. For context, Kluppy infers when your group worked from the group's own aggregate activity, and reflects in how many of those sessions you worked. It is not an attendance record, it is not communicated to anyone as such, and it does not score.

This processing therefore does not constitute an automated decision under Art. 22 GDPR: it is not based solely on automated processing — a person decides — nor does it by itself produce legal or similarly significant effects. If you want to know how a particular band was calculated, you can ask your school or write to us at dpo@kluppy.com: the cut-points and the formula are public and explainable.

This report exists only in the schools and organisations channel. If you use Kluppy as a private individual (B2C), it is not generated.

4. Use of Artificial Intelligence (Regulation (EU) 2024/1689 — AI Act)

Kluppy uses artificial intelligence (AI) to improve the learning experience. This section explains how AI is used, in compliance with the European AI Act and the GDPR.

4.1. AI systems used

Hand-placement detection (section 2.3) also uses a vision model, but it runs on your own device and sends nothing to any provider.

4.2. How AI-generated content is identified

When you practise with an AI-generated text, you will see an "✨ AI-generated" label in the exercise interface, ensuring transparency about the origin of the content you interact with.

4.3. Key facts about AI at Kluppy

• No profiling: AI is not used to profile, score or classify users. It only generates educational content.
• No automated decisions: AI makes no decision affecting your rights, your access or your educational results.
• Human oversight: All AI-generated content is subject to review by administrators and can be disabled at any time. If a text seems inappropriate, you can report it from within the Platform.
• Data minimisation: We send AI systems the bare minimum — in most cases, zero personal data.
• EU processing: AI processing takes place in Europe (Vertex AI region: EU eu multi-region). User data is stored in Europe (Firestore region: eur3, Belgium/Netherlands).
• No training on your data: Your personal data is not used to train AI models. Google Vertex AI processes requests without retaining user data for training, per our Google Cloud project configuration (Data Logging disabled, EU eu multi-region for AI processing). Details in Google Cloud's Data Governance documentation.

4.4. Document analysis (administrators only)

When an administrator uploads a document (PDF or image) to extract emails, the document is sent to Google Vertex AI for processing. This involves processing personal data (names and emails contained in the document).

• For individual users (B2C): This processing is based on performance of a contract (Art. 6.1.b GDPR).
• For schools (B2B): Kluppy acts as Processor (Art. 28 GDPR). The legal basis is the Data Processing Agreement (DPA) signed with the school, which expressly authorises Google Vertex AI as a sub-processor.

Document content is processed in memory and explicitly deleted after processing. It is not saved to any database, bucket or log. The AI provider does not retain request data for training (Data Logging disabled in our Google Cloud configuration).

4.5. Your rights regarding AI

• You have the right to know when content is AI-generated (transparency labels in the interface).
• You can contact us at info@kluppy.com for more information about the use of AI.
• If you consider AI-generated content inappropriate, you can report it from the Platform or through the support system.

5. Who do we share your data with?

We only share data with the providers needed for the service to work:

In addition, if your account is managed by a school or organisation, authorised staff of that organisation can view your educational progress within the Platform. That organisation is the controller in such cases (see section 1).

We may also disclose data where there is a legal obligation (for example, to the tax authorities or to law enforcement upon a valid request).

Is data transferred outside the EU?

All core data is stored and processed in the EU (Europe multi-region: Belgium/Netherlands — eur3). The only possible outflows are:

• Google Analytics, and only if you consent: processing in the USA, covered by the EU-US Data Privacy Framework.
• jsDelivr, the public network from which your browser downloads the hand-placement model if you enable the camera: it receives your IP address as a technical consequence of the download, and no other data.

6. How long do we keep your data?

The 180-day periods let you return the following school year without losing your progress. If you rejoin before the period expires, the clock stops and your account is reactivated.

7. Cookies

Kluppy uses essential cookies to operate and optional analytical cookies. See our Cookies Policy for details.

You can manage your cookie preferences at any time from Profile → Privacy → Change cookie preferences.

8. Your rights

You have the following rights over your personal data:

We will respond within one month of the request, extendable by a further two months if the request is particularly complex.

If your account is managed by a school or organisation, address your request to that organisation: it is the controller, and we assist it.

What happens when you delete your account?

When you click "Delete my account" and confirm by typing "DELETE":

1. Immediately, access is disabled: your session is closed, your credentials are revoked and any active paid subscription is cancelled. Processing stops from that moment and you are not charged again.
2. For 14 days we keep the account deactivated in case you change your mind. We email you the exact deletion date and how to recover it.
3. When that period expires, the purge is automatic, complete and irreversible: profile and personal data, progress, statistics and achievements, avatar and files, text history, friendships and replays, certificates and authentication account.

This grace period exists because immediate deletion cost a user all of her progress after she cancelled over a payment problem. If you prefer immediate deletion without waiting, write to us at dpo@kluppy.com.

9. Minors

In schools and organisations (B2B and extracurricular)

When a school or organisation contracts Kluppy, the school is the Data Controller for its students' data and Kluppy acts as Processor (Art. 28 GDPR), under the Data Processing Agreement (DPA) signed between the parties. The school warrants that it has a valid legal basis for the processing — generally the exercise of its educational function — and that it informs students and families about the use of the platform.

Where the school uses the evidence reports described in section 3 to support its assessment, it falls to the school — as Controller — to inform students and families accordingly, to set and document the weight it gives this block, and to ensure that the grade is always determined by its teaching staff.

In individual use (B2C)

• If you are 14 or older, you can register directly by accepting this policy.
• If you are under 14, the account must be created and managed by your parent or legal guardian, in accordance with Art. 7 LOPDGDD.

Family accounts

Holders of parental authority or guardianship can create and manage the profiles of minors in their care from the family account, keeping control over their data and being able to delete it at any time.

Child protection

Kluppy has an internal child and adolescent protection protocol in accordance with Spanish Organic Law 8/2021 (LOPIVI). Any situation that may affect the safety or wellbeing of a minor can be reported to info@kluppy.com.

10. Security

We protect your data with the following measures:

• 🔒 Encryption in transit: HTTPS/TLS enforced
• 🔒 Encryption at rest: AES-256 (managed by Google Cloud)
• 🔒 Passwords: stored using hash functions, never in plain text
• 🔒 Access control: role system (student, teacher, administrator)
• 🔒 Isolation: server-side security rules preventing access to other people's or organisations' data
• 🔒 Region: all data in the EU (eur3: Belgium/Netherlands)

Data breaches

Should a security breach occur that poses a high risk to your rights, we will notify you without undue delay, and notify the supervisory authority within 72 hours in accordance with Arts. 33 and 34 GDPR.

If you discover a vulnerability, please report it responsibly to info@kluppy.com.

11. Changes to this policy

If we make substantial changes to this policy, we will notify you through a notice on the platform and/or by email before the changes take effect. The version and date at the top of this document always indicate which one is in force.

12. Complaints

If you believe your data is not being processed properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):

• Website: www.aepd.es
• Electronic office: sedeagpd.gob.es

Before turning to the AEPD, we encourage you to contact us directly at dpo@kluppy.com so we can resolve the matter.

13. Contact

• Data protection: dpo@kluppy.com
• General email: info@kluppy.com
• Address: Mikeletegi pasealekua 65 (Planta Baja, Local 1), 20009, Donostia - San Sebastián, Gipuzkoa

Version history

This policy is governed by the General Data Protection Regulation (EU) 2016/679 and Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).