Privacy policy

1. Who is responsible for your data

The data controller is AcademiaTal.

Contact address for anything relating to personal data: soporte@academiatal.com. There is no other official channel.

2. What data we collect

From your account. Your email address, your name if you enter it — it's optional —, your profile picture if you sign in with Google, your phone number if you decide to leave it — it's optional and you can leave it out, an internal identifier, the language, your preferred currency and the last country you signed in from with the date it was seen. Your password is handled by Firebase, which stores it as a hash and never in plain text: we can't see it or recover it.

About the phone number specifically. We ask for it when you create your account so we can let you know if there's a last-minute change to your lesson, and we also use it to measure advertising: it goes to Meta hashed with SHA-256, like your email, because that's what makes it possible to attribute a purchase to the ad that produced it. Those are two purposes and we're telling you both: if the second doesn't sit well with you, don't leave it — the site works just the same — or ask us to delete it by writing to soporte@academiatal.com. We never share it with other students or with coaches, and we don't give it to anyone to sell you anything.

From what you buy. What you bought, the amount, the currency, the country of purchase, the payment status, the discount code if you used one, and the identifier the provider gave that charge. Never your card number: that's typed into the provider's form and never reaches our servers.

From what you book. The coach or the course, the language, the length, the date and time, the time zone, the format, the notes you write when booking, and the video call link.

From your progress. Which lessons you completed, where you left each video, and which lesson you opened last, so you can pick up where you were.

From your cart. The courses you saved with their title and price, along with your name and your email. It's what lets your cart follow you between devices, and also what lets us remind you about a cart you left unpaid.

From your browsing, to measure advertising. Which course, live-course or coach pages you looked at and how many times; when you opened a payment screen; when you bought, when a payment was left pending and when one failed; how much you spent per currency; how many lessons and sample classes you watched; your IP address; your browser and device; the approximate city and country the network reports; the identifiers of Meta's cookies; and the campaign parameters (utm_*) from the first time you arrived at the site.

If you're a coach, additionally: the public details of your profile — name, title, photo, bio, languages, specialities, rate and availability — and, if you connect your Google calendar, a stored permission that serves two things and nothing more: reading whether a slot of yours is busy, and writing the lesson that was sold. From your calendar we read only whether a slot is free or busy, never what each event is, nor its title, nor who it's with.

3. Cookies and browser storage

Necessary for the site to work. They can't be switched off without breaking the service:

• __session — keeps you signed in. Lasts 14 days and your browser can't read it.
• A readable copy of your session — with your name, your picture, which permissions you have and your phone number if you left one, so the bar can be drawn without waiting and for advertising matching. It contains no credentials.
• site_country and site_currency — the detected country and the currency that corresponds to it, to show you the right price. They last 30 days.
• site_consent — your answer to the analytics banner. Lasts a year.

Analytics. Only written when analytics is allowed (see section 4):

• site_visitor — an identifier for a visitor without an account, so what they did before registering can be joined to what they do afterwards. Lasts a year.
• site_attr — which campaign you arrived from the first time. Lasts a year.
• _fbp and _fbc — Meta's, to attribute a purchase to the ad that produced it. Up to 90 days.

In your browser's local storage we keep the cart, the time zone you chose and a copy of your access permissions, so the site doesn't have to ask for them again. None of that goes to any third party and it's erased when you clear the site's data.

4. Consent: where we ask and what happens if you say no

If you arrive from the European Union, the European Economic Area, the United Kingdom or Switzerland — or if we can't determine where you're arriving from — we show you a banner before writing any analytics cookie and before sending anything to Meta. Both buttons are the same size and rejecting takes a single click.

If you reject, the site works exactly the same. No analytics cookie is written, no event is sent to Meta from your browser or from our server, and no summary of your anonymous browsing is built. The only difference is that we don't know which ad worked.

You can change your mind by clearing the site's cookies from your browser: the banner comes back and you can answer differently. You can also ask us to change it by email.

Where the law doesn't require asking permission, analytics is on by default and you can still object by writing to soporte@academiatal.com.

The team isn't measured. Accounts with admin or coach permissions are left out of all analytics, because they browse in order to work.

5. What we use each piece of data for, and on what basis

• Providing the service — creating your account, giving you access to what you bought, managing bookings, saving your progress, handling your support requests: performance of the contract we have with you.
• Charging, invoicing and keeping accounts: performance of the contract and legal obligation.
• Sending you purchase and booking confirmations, and the password recovery email: performance of the contract.
• Preventing fraud, abuse and account sharing: legitimate interest in protecting the service and the other students.
• Measuring advertising and reminding you about an unpaid cart: consent where the law requires it; legitimate interest in the remaining countries.
• Improving the site and deciding which courses to make: legitimate interest, using aggregated data.

We don't sell your data to anyone and we don't hand it over for third-party advertising beyond what's described in the next section.

6. Advertising and Meta

We use Meta's pixel and its Conversions API. They're two routes for the same fact: the pixel sends from your browser and the Conversions API sends the same thing from our server, with the same event identifier, so that Meta counts it once and nothing is lost to extensions and cookie restrictions.

What is sent: the fact — you viewed a course, added to cart, started a payment, bought —, the amount and the currency, and matching data hashed with SHA-256 before it leaves: your email, your phone if you left one, your name, your country, your city and your internal identifier. Your IP, your browser and Meta's own cookies go unhashed because Meta requires them that way.

What is never sent: your password, any card details, which lessons you watch inside a course, your progress, and anything you write in a booking's notes.

Purchases are reported from our server when the payment actually clears, never from the thank-you screen: an unpaid cash voucher or a held charge doesn't count as a sale until it is one.

Meta also processes that data for its own purposes and as an independent controller; its policy governs that processing. Nothing goes to Meta from a person who rejected analytics, neither from the browser nor from the server.

7. Who it's shared with

We work with providers that process data on our behalf, under contract and only for what's stated:

• Google Firebase — authentication, database and storage of the material.
• Vercel — hosting of the site; it processes every request and its IP address.
• Stripe, Mercado Pago and PayPal — payments, depending on your country. They receive your email and the payment details, and also act as controllers in their own right for their legal and anti-fraud obligations.
• Bunny Stream — hosting and delivery of the course video.
• Meta — advertising measurement, under the conditions in section 6 and only where appropriate.
• Google Calendar — only for coaches who connect it, and only to the extent described in section 2.
• Google Gemini — writes the title and description a course appears with in search engines. No personal data is sent to it: only the course content.
• The domain's email service — sending the transactional emails.

We may also hand over data where a competent authority, a court order or a legal obligation requires it.

8. Where it's stored and international transfers

These providers' servers are outside Uruguay, mainly in the United States and the European Union. That involves an international transfer of data.

Those transfers rely on the mechanisms the providers themselves offer: standard contractual clauses and, where applicable, recognised adequacy frameworks. If you reside in the European Economic Area or the United Kingdom, the standard contractual clauses are the applicable safeguard.

9. How long it's kept

• Your account, your progress and your cart: for as long as the account exists.
• Purchases and bookings: for as long as the account exists and, after deleting it, the minimum record required by accounting and tax rules, minimised to what's essential. Once the period is up, they're deleted.
• The detailed analytics event log: deletes itself after 400 days.
• Payments started and not completed: they delete themselves shortly afterwards, leaving no trace of the purchase that wasn't.
• Cookies: the periods in section 3.

10. Your rights and how to exercise them

You can request access to your data, its rectification, its erasure, objection to or restriction of processing, portability of what you gave us, and to withdraw your consent at any time without that affecting what was done before.

How to request it: write to soporte@academiatal.com from your account's email address. There you can request deletion of your account and all your data, and also a copy of everything we hold about you. We reply within a maximum of 30 days.

What deleting the account involves. Your account, your profile, your progress, your cart, the summary of your browsing and the personal data in your bookings are deleted. What is kept is the accounting record of payments made, reduced to the minimum, for the legal period. And you lose access to the courses you bought: deletion can't be undone, so if you want to keep the PDF notes and the PGN games, download them first.

Some things you can do yourself without asking: edit your profile, empty your cart and clear the site's cookies from your browser.

If you think we're handling your data badly, you can complain to the supervisory authority. In Uruguay that's the Personal Data Regulation and Control Unit (URCDP); if you reside in the European Union, the European Economic Area or the United Kingdom, to your country's authority. We'd still appreciate you writing to us first: almost everything gets sorted by email.

11. Security

The material has a single door. Nothing in storage is readable from the internet: every video, every set of notes and every game is delivered with a short-lived signed link issued only after checking who you are and what you're entitled to.

Passwords are handled by Firebase and we never see them. The session cookie isn't readable by the page's code, travels only over HTTPS, and permissions are re-checked on every request to the server.

No system is infallible. If a breach affecting your data occurred, we'd tell you and notify the authority within the deadlines the applicable rules require.

12. Minors

To have an account you must be over 18. If a minor studies with the material, the account and the responsibility belong to their mother, father or legal guardian.

We don't knowingly collect data from minors. If you think a minor created an account on their own, write to us at soporte@academiatal.com and we'll delete it.

13. Changes to this policy

If anything changes, it's published on this same page with the date above updated. Where the change is substantial — a new purpose, a new recipient — we'll let you know by email before applying it.

14. Contact

For any question or complaint about your personal data: soporte@academiatal.com.