Template prepared on 12 August 2026
Privacy policy
Document customised for the specified operation and marked as reviewed by the person responsible for the installation.
1. Data controller
Owner or registered business name: MYSERVEAI TECHNOLOGIES SL. Tax identification: B23836711. Address: Calle Nerine 1, 28019 Madrid, Spain. General email: contacto@kintavor.com. Privacy email: privacidad@kintavor.com. Registration details: Company registration is pending while the company is being incorporated..
2. Data processed
- Account and purchasing: first name, surname, email, internal identifiers, product, price, payment status and validity period. KINTAVOR must not store complete card details.
- Learning: progress, answers, results, errors, notes, bookmarks, certificates and tutor use.
- Security: a truncated or protected IP address where feasible, browser user agent, device identifier, sessions, login attempts and audit events.
- Support: messages and metadata required to handle an enquiry.
- Cookies and analytics: only in accordance with the choice recorded in the consent panel.
3. Purposes and legal bases
| Purpose | Planned legal basis | Indicative retention period to be validated |
|---|---|---|
| Create and maintain the account, deliver the course and provide support | Performance of the contract | During access and for the periods needed to address liabilities |
| Invoicing, tax obligations and handling consumer rights | Legal obligation and contract | Applicable statutory periods, to be specified with professional advice |
| Security, fraud prevention, authorised device and audit | Legitimate interests subject to a balancing assessment; security obligation | Short, documented period according to risk |
| AI tutor requested by the student | Performance of the service; consent where required | Conversations and metrics according to the configured and communicated retention period |
| Non-essential marketing communications | Consent, which may be withdrawn | Until withdrawal or erasure |
| Non-essential analytics | Consent | According to the provider and cookie panel settings |
4. Processors, recipients and transfers
Hosting, SMTP email, payment, support and consent-based analytics providers, and OpenAI for the tutor, may be involved. Before publication, the actual providers, their roles, locations, data processing agreements, subprocessors and international transfer mechanisms, where applicable, must be identified.
Stripe processes payments under its own applicable notices and roles. Data will not be disclosed except where legally required or where there is a documented need to provide the service.
5. AI tutor and data that must not be submitted
The tutor is limited to educational support. It must not receive passwords, API keys, tokens, sensitive real configurations, non-public business addresses, customer data or secrets. Interface notices must remind users of this before each submission.
No automated decisions with legal or similarly significant effects are envisaged. The readiness score is educational and does not determine employment, certification or access to rights.
6. Rights
You may request access, rectification, erasure, restriction and portability, object to processing, and withdraw consent without affecting earlier processing. Write to privacidad@kintavor.com and state the right you wish to exercise. Additional information to verify your identity will be requested only where necessary and proportionate.
You may also complain to the Spanish Data Protection Agency at https://www.aepd.es/.
7. Security, minors and changes
Access controls, strongly encrypted passwords, secure sessions, limited logging, backups and incident procedures are used. No measure eliminates all risk.
The service is not specifically directed at minors. The actual age and verification policy must be defined and displayed: This service is intended for adults. Special categories of personal data are not requested. Do not enter health data, trade secrets or information that identifies third parties.. Material changes to this policy will be communicated by an appropriate means.
Sources and date accessed
- Regulation (EU) 2016/679 (GDPR) · accessed 2026-08-12
- Organic Law 3/2018 (LOPDGDD) · accessed 2026-08-12
- Law 34/2002 (LSSI-CE) · accessed 2026-08-12
- Royal Legislative Decree 1/2007 (TRLGDCU) · accessed 2026-08-12
- AEPD — Guide on the use of cookies · accessed 2026-08-12