Privacy Policy

Effective Date: September 4, 2026

Aitis ("we", "our", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, process, and safeguard your personal information when you use our web service at https://aitis.tech (the "Service").

1. Data Controller Information

For the purposes of the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection (LOPDGDD), the Data Controller contact for this Service is:

• Commercial Name: Aitis
• Project Status: Educational Software Platform (Pre-incorporation / MVP Stage)
• Data Contact: Aitis Team
• Contact Email: contact@aitis.tech
• Identification Details: For full legal identification and payment processing details, please refer to our Legal Notice.

2. Protection of Minors & Age Restrictions

• Minimum Age Requirement: The Service is intended for users who are at least 13 years of age. Registration by children under 13 is strictly prohibited.
• Parental Consent in Spain: Pursuant to Article 7 of Spanish LOPDGDD, processing personal data of users in Spain under 14 years of age requires verified consent from parents or legal guardians. Users aged 13 to 14 residing in Spain must obtain guardian permission before registering.
• Immediate Deletion: We do not knowingly collect personal data from minors under required legal ages without consent. If we discover an account created by an ineligible minor, we will erase the account and associated progress immediately. Guardians may contact us at contact@aitis.tech to request immediate data removal.

3. Categories of Information We Collect

We collect personal information directly from you, automatically through your device, and via third-party authentication services:

• Account & Identity Data: Email address, username, password hash, full name, and profile pictures (when registering via OAuth providers like Google or GitHub).
• Educational & Learning Data: Code submission history, execution outputs, challenge completion times, streak records, grade preparation activity, and test metrics.
• Technical & Device Data: IP address, device type, operating system, browser details, session tokens, and access timestamps collected for security and load monitoring.
• Payment & Financial Data: We do NOT collect or store payment card numbers or bank accounts on our infrastructure. All commercial transactions are exclusively processed by our Merchant of Record, Lemon Squeezy, LLC.

4. Shared Data with Third-Party Analytics and Social Networks

Subject to your explicit consent via our cookie consent banner, we utilize third-party tools that collect interaction and diagnostic data:

• Google Analytics (Google LLC): Web traffic analytics, user engagement flows, and platform performance monitoring.
• Meta Technologies (Meta Platforms Ireland Ltd.): Conversion tracking and advertising campaign optimization (Instagram, Facebook, Threads).
• TikTok Pixel (TikTok Technology Limited): Ad conversion tracking and user interaction analytics.
• X Analytics & Pixel (X Corp.): Ad campaign reach and conversion metrics.

5. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases under GDPR Article 6:

• Contractual Necessity: To manage your account, store learning progress, provide interactive code execution environments, and deliver paid subscriptions.
• Legitimate Interests: To protect our code execution sandboxes, prevent automated scraping or denial-of-service attacks, and improve educational tools.
• Consent: When you opt-in to optional cookies, social media tracking pixels, or updates via our cookie banner.

6. International Data Transfers

Our cloud databases, execution environments, and third-party processors are hosted across the EU and the United States. Where personal data is transferred outside the European Economic Area (EEA), we ensure adequate protection through Chapter V GDPR requirements, relying on European Commission Standard Contractual Clauses (SCCs) and adequacy frameworks such as the EU-U.S. Data Privacy Framework.

7. Official Social Media Profiles

Aitis maintains public channels on third-party platforms (Instagram, Facebook, Threads, TikTok, X). Interactions with these profiles are subject to the privacy policies of the respective platform operators. Aitis acts as a joint controller solely for aggregated engagement statistics.

8. Data Retention & Security

We retain your personal data for as long as your account remains active or as needed to maintain educational records and comply with statutory obligations (up to 7 years for business transaction records). We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or disclosure.

9. Your Privacy Rights (GDPR)

Under European privacy regulations, you have the right to:

• Access & Portability: Request a structured copy of your personal data.
• Rectification: Correct inaccurate or incomplete information.
• Erasure (Right to be Forgotten): Request permanent deletion of your account and learning records.
• Restriction & Objection: Restrict or object to specific processing activities based on legitimate interests.
• Withdraw Consent: Revoke non-essential cookie or marketing consent at any time.

To exercise your rights, email contact@aitis.tech. You may also lodge a regulatory complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) at https://www.aepd.es.

10. Contact Us

For privacy inquiries, contact us at contact@aitis.tech.