Legal documents

Privacy Policy

October 20, 2026

1. Data Controller

Aitis is responsible for the personal data processed through the Service.

Commercial Name: Aitis
Identification Details: See our .

2. How Old Do You Need To Be?

You must be at least 18: Aitis is intended for adults only.
We ask for your date of birth: when you sign up, we use it to verify that you are 18 or older.
Accounts belonging to minors: if we discover an account created by someone under 18, we delete the account and the data associated with it on our servers. Data stored locally in the browser must be cleared separately.

3. The Stuff We Collect (And How)

We collect information in three ways: you provide it to us, your device transmits it, or a service you use provides it to us. The categories are:

Account information: email address, display name, date of birth, and a password hash. Passwords are stored only in hashed form and are never readable by Aitis.
Local learning data: some preferences and progress, such as your language, editor theme and layout, and started courses, may be stored in your browser. The current version does not send code submissions, program outputs, challenge duration, streaks, interview activity, or test scores to our servers.
Technical information: IP address in server logs, browser or user-agent information, session tokens, and request timestamps. We use this information for security and service reliability.
Payment information: we do not store card or bank details on our servers. Payments are processed by our payment provider Lemon Squeezy, LLC.

4. Third-Party Services

We do not currently use third-party analytics or advertising trackers. If we introduce these technologies, we will update this Privacy Policy and the Cookie Policy and, where required, request your consent before activating them.

When you make a purchase, our payment provider Lemon Squeezy, LLC processes the payment and related data under its own privacy policy. We receive the information needed to provide your subscription but do not receive or store your full payment card details.

5. Why We're Allowed To Do This (GDPR)

European law requires us to identify the legal basis for each processing activity. We rely on the following bases:

Performance of a contract: providing your account, local learning preferences, the code sandbox, and subscriptions.
Legitimate interests: protecting the Service from abuse, securing the sandbox, preventing fraud, and improving the learning tools.
Legal obligation: retaining records where required by applicable law.
Consent: where we ask for it for a specific optional feature.

6. Where Your Data Is Processed

Our application, backend, and database are hosted by Hetzner in the European Union. Where personal data is transferred outside the EEA, we rely on the safeguards required by applicable law.

7. How Long We Keep Things (And Keep Them Safe)

We keep account data while your account is active. When you delete your account, we delete your user record, date of birth, subscription record, and consent events from our database. Payment records are held by Lemon Squeezy under its own retention policy. Some information may remain in backups or server logs for a limited period, and we may retain records where required by law.

8. Your Superpowers (GDPR Rights)

European law gives you some nice buttons. You have the right to:

Copy it: ask for a structured copy of your personal data (that's "data portability").
Fix it: correct anything that's wrong or out of date.
Erase it: ask us to delete your account and the records we hold on our servers. Data stored locally in your browser is not deleted by us and must be cleared in your browser settings.
Restrict or object: restrict or object to certain processing activities.
Withdraw consent: withdraw any consent you have given at any time, without affecting processing carried out before the withdrawal.

To exercise these rights, use the contact details in section 1 above. You also have the right to lodge a complaint with the Spanish data protection authority (AEPD) at https://www.aepd.es.

2. How Old Do You Need To Be?

You must be at least 18: Aitis is intended for adults only.

We ask for your date of birth: when you sign up, we use it to verify that you are 18 or older.

Accounts belonging to minors: if we discover an account created by someone under 18, we delete the account and the data associated with it on our servers. Data stored locally in the browser must be cleared separately.

3. The Stuff We Collect (And How)

We collect information in three ways: you provide it to us, your device transmits it, or a service you use provides it to us. The categories are:

Account information: email address, display name, date of birth, and a password hash. Passwords are stored only in hashed form and are never readable by Aitis.

Local learning data: some preferences and progress, such as your language, editor theme and layout, and started courses, may be stored in your browser. The current version does not send code submissions, program outputs, challenge duration, streaks, interview activity, or test scores to our servers.

Technical information: IP address in server logs, browser or user-agent information, session tokens, and request timestamps. We use this information for security and service reliability.

Payment information: we do not store card or bank details on our servers. Payments are processed by our payment provider Lemon Squeezy, LLC.

4. Third-Party Services

5. Why We're Allowed To Do This (GDPR)

European law requires us to identify the legal basis for each processing activity. We rely on the following bases:

Performance of a contract: providing your account, local learning preferences, the code sandbox, and subscriptions.

Legitimate interests: protecting the Service from abuse, securing the sandbox, preventing fraud, and improving the learning tools.

Legal obligation: retaining records where required by applicable law.

Consent: where we ask for it for a specific optional feature.

7. How Long We Keep Things (And Keep Them Safe)

8. Your Superpowers (GDPR Rights)

European law gives you some nice buttons. You have the right to:

Copy it: ask for a structured copy of your personal data (that's "data portability").

Fix it: correct anything that's wrong or out of date.

Erase it: ask us to delete your account and the records we hold on our servers. Data stored locally in your browser is not deleted by us and must be cleared in your browser settings.

Restrict or object: restrict or object to certain processing activities.

Withdraw consent: withdraw any consent you have given at any time, without affecting processing carried out before the withdrawal.

To exercise these rights, use the contact details in section 1 above. You also have the right to lodge a complaint with the Spanish data protection authority (AEPD) at https://www.aepd.es.