Privacy Notice

Controller

The controller of your personal data is Iván García Villar, a sole trader based in Norwich, United Kingdom, who provides AI Coding Patterns. For any privacy matter, write to igarcia@sinapser.com.

What data we process and why

• Account. Your email address and, if you provide it or sign in with LinkedIn, your name and profile photo. Used to create your account, give you access and keep you signed in. Legal basis: performance of a contract.
• Progress. Completed lessons, exercise results, time, hints used, certificates and any feedback you leave. Used so you can pick up where you left off and to improve the courses. If you earn a certificate, anyone with its verification code can see your name, the course and your result. Legal basis: performance of a contract and our legitimate interest in improving the service.
• Emails. We send you service emails (access codes, confirmations and invitations), which are needed to use your account; legal basis: performance of a contract. If you subscribe or have an account, we also send you news, new lesson announcements and reminders about courses you have started; legal basis: your consent if you subscribe and, if you have an account, our legitimate interest in keeping you informed about the service you use. These include a link to unsubscribe from that type of email; if you do not want to receive any, write to us. When you subscribe, we store your email address, your language and the page you subscribed from. We keep a record of the emails we send and may record whether they are opened or their links clicked.
• Organisations. If you join through an organisation (for example, a class or a company), its administrator can see your name, email, progress, scores and last activity in its courses, and can export them. Legal basis: the organisation's legitimate interest and our contract with it.
• Analytics and errors. We measure how the website is used (pages, course events) to improve it, and we log technical errors to fix them. This includes technical data such as your IP address, browser, device and approximate location, and may be linked to your account and email address. In the course app, we record a replay of a share of sessions and of sessions with errors. Legal basis: our legitimate interest in running and improving the service.
• Search. What you type into the blog search box is sent to an artificial intelligence provider to find related results. Please do not type personal data into the search box. Legal basis: our legitimate interest in offering search.
• Purchases. If you buy a course, Paddle processes your payment and billing data as Merchant of Record. Paddle shares the order details with us (such as your name, email, country, course and amount) so we can give you access and keep our accounts. We do not receive your card details. Legal basis: performance of a contract and legal obligations.

Who we share it with

We do not sell your data. We only share it with:

• Paddle (Paddle.com Market Ltd and its affiliates), as Merchant of Record for purchases. Its privacy notice explains how it handles your data.
• Supabase: database and authentication, hosted in the European Union.
• Render: hosting for the website, the app and analytics.
• Amazon Web Services (SES): sending emails.
• Sentry: technical error logging.
• Google: blog search (Gemini), fonts in the course app and YouTube videos embedded in some courses.
• Vimeo: videos embedded in some courses.
• LinkedIn: if you choose to sign in with your LinkedIn account.
• The organisation you joined through, if any (see above).
• Professional advisers and public authorities, where required by law.

International transfers

Some of these providers process data outside the United Kingdom and the European Economic Area, for example in the United States. In those cases, the transfer relies on an adequacy decision or on the standard contractual clauses or International Data Transfer Agreement (IDTA) included in those providers' terms.

How long we keep it

We keep your account and progress data for as long as you have an account. If you ask us to delete it, we will do so within one month, except for anything the law requires us to keep. If you unsubscribe from a type of email, we stop sending you that type. Analytics data, error data and the email log are kept for as long as needed to analyse usage and fix problems. We keep sales records for as long as UK tax rules require, and Paddle keeps its own in line with its legal obligations.

Your rights

You can ask us to access, rectify or erase your data, restrict its processing, receive it in a portable format or object to its processing, and you can withdraw your consent at any time. Write to igarcia@sinapser.com and we will reply within one month.

If you think we are not handling your data properly, please write to us first and we will try to resolve it. You can also complain to the UK Information Commissioner's Office or to the data protection authority in your country.

Security

We apply reasonable technical and organisational measures to protect your data: encrypted connections, restricted database access and providers with security guarantees.

Cookies and local storage

We use a first-party session cookie (sb-acp-auth, which may be split into several parts) to keep you signed in across the website and the course app. It lasts up to 400 days or until you sign out, and it is necessary for the service to work. We also store some data locally in your browser: your language, your progress if you do not have an account yet, and app preferences. We do not use our own advertising cookies. If a course includes YouTube or Vimeo videos, those services may set their own cookies when the lesson containing them loads.

Changes to this notice

If we change this notice significantly, we will announce it on the website or by email.