Politique de confidentialité

This is an English translation. If it differs from the Spanish version, the Spanish version prevails.

Who handles your data

CRUD SOFTWARE, S.L.U. ("CRUD"), tax ID B44837565, Calle Alejandro Dumas 17, 29004 Málaga (Spain). For anything about your data, write to legal@crudsoftware.com.

CRUD has not appointed a data protection officer: given its activity and size, it is not required to.

What this policy covers

The data CRUD handles on its own account, as controller, when you visit coraula.com, write to us, create an account on app.coraula.com, buy Coraula Translate credits, are one of our customers or give us your details at a trade fair.

It does not cover the data our customers manage with Coraula: the people who enrol in their courses, their students, their teachers or the people who attend their classes. Each organisation is the controller of that data, and CRUD only processes it on its behalf and following its instructions (see "If you are a student of one of our customers" below).

What data we handle and why

When you visit coraula.com or app.coraula.com

What data: your IP address, browser, the pages you request and the time. On app.coraula.com, also each sign-in, failed attempts and two-step verification, if you use it.

Why: to serve the page, keep the platform secure and stop abuse (for example, someone trying passwords over and over, or submitting forms automatically).

Legal basis: our legitimate interest in protecting our systems and the people who use them (Article 6(1)(f) of the General Data Protection Regulation, GDPR).

How long: the log of sign-ins and sign-in attempts, one year; then it is deleted automatically. Server technical logs, for the time strictly needed to deal with security incidents.

Bot verification (Turnstile). On the forms for signing in to app.coraula.com and for contacting us we use Turnstile, from Cloudflare, Inc. (United States). When the page opens, it reads technical data from your browser and device, and your IP address, to check that you are a person. Cloudflare does this on our behalf and, in addition, uses those signals on its own account, as a controller, to improve its bot detection, based on its own legitimate interest. It explains this in its Turnstile privacy information.

The cookies and browser storage we use are explained in the cookie policy.

When you write to us through the contact form

What data: your name, your email, your phone number and company name if you give them, and your message. If you write from the affiliates page, the email tells us so.

Why: to reply and, if you ask, to prepare a proposal.

Legal basis: if your enquiry is about contracting Coraula, steps prior to a contract taken at your request (Article 6(1)(b) GDPR); otherwise, our legitimate interest in answering people who write to us (Article 6(1)(f)).

How long: while the conversation lasts and at most one year after the last contact if no business relationship follows. If it leads to a contract, the customers section applies.

The form does not store your data on the platform: it reaches us by email in our mailbox.

When you have an account on app.coraula.com

What data: your name and surname, email, password (which we store transformed so that it cannot be read), language, the organisation you belong to and your role in it, and the sign-in log. If you turn on two-step verification, the data needed to check the codes.

Why: to give you access, know what you can do on the platform and keep your account secure.

Legal basis: if the account is yours, to perform the contract you accept when you create it (Article 6(1)(b) GDPR). If you work for a customer organisation, our legitimate interest in managing the relationship with it through the people it designates (Article 6(1)(f)).

How long: while the account exists. When it is closed, we keep only what is necessary, blocked, for as long as claims can be made.

The emails the platform sends you

We send you the emails your account needs: verification codes, password recovery and security notices.

Emails with codes carry no tracking at all. Other notices may carry a small image that tells us whether the email has been opened, and their links go through our own system before taking you to the page. For each notice we only store the date and time it was first opened, how many times it has been opened and which of its links you have used, not counting the automatic opens made by Apple Mail when it downloads messages. We store neither your IP address, nor your device, nor where you open it from.

We do this to know whether notices, especially those with a deadline, reach you in time and, if not, to stop chasing you or to find another way to reach you. It is part of the service, which is why we do not ask you for separate permission (Article 22(2) LSSI); the legal basis is our legitimate interest in notices getting through (Article 6(1)(f) GDPR). You can object by writing to legal@crudsoftware.com.

When you are a customer

What data: the organisation's data and that of its contact persons and representatives (name, position, email, phone), the contract, invoices, payments and communications.

Why: to provide the service, invoice, collect payment, keep our accounts and meet our tax and commercial obligations.

Legal basis: performance of the contract (Article 6(1)(b) GDPR) and our legal obligations (Article 6(1)(c)). Contact persons' data, our legitimate interest in dealing with the organisation (Article 6(1)(f)).

How long: for the term of the contract and then the periods set by law: generally six years for commercial and accounting records (Article 30 of the Spanish Commercial Code), and those of tax law.

When you buy Coraula Translate credits

What data: your name or your company's, tax ID, address and province, what you buy and what you pay. We also keep proof that you accepted the purchase terms: the exact text, date and time, your IP address and your browser details, encrypted.

Payment is processed by Stripe. We neither see nor store your card details. Stripe handles payment data under its own privacy policy.

Why: to sell you the credits, issue the invoice, handle a withdrawal or a claim, and be able to prove what was accepted.

Legal basis: performance of the purchase contract (Article 6(1)(b) GDPR) and our consumer and tax obligations (Article 6(1)(c)).

How long: purchase data, for the tax and commercial periods; proof of acceptance, for as long as claims can be made about that purchase.

When you give us your details at a fair or event

What data: the professional details you give us, on your card or in person (name, position, organisation, email, phone), where and when we met and a note about what we talked about. If you allow us to write to you afterwards, we record that you did and when.

How we turn cards into text: we use an artificial intelligence service (OpenRouter) that reads the photo of the card. In the notes we send it, we first hide the email, phone number and ID number, but the photo of the card reaches it as it is. We review each contact by hand.

Why: to pick up the conversation we started at the event and, if you allowed us, to email you information about Coraula.

Legal basis: to keep the contact and resume the conversation, our legitimate interest in following up a professional relationship you started (Article 6(1)(f) GDPR). To send you marketing emails, your consent (Article 21 LSSI and Article 6(1)(a) GDPR), which you can withdraw at any time through the unsubscribe link in each email or by writing to us.

What we measure in those emails, and with what permission: when they are opened and which links are clicked, with the date and time, IP address, approximate location and type of device. Only we use it, to know what interests you. Measuring it requires your consent, which is separate from the permission to write to you (Article 22(2) LSSI): that is why, when we ask for your permission, we also tell you that we will know whether you open our emails and what interests you. You can withdraw it by writing to us; as we cannot currently send those emails without measuring them, if you withdraw it we will stop sending them.

How long: while we keep the professional contact. If you ask us to stop writing to you, we keep only your email on the unsubscribe list so that we do not do it again. If you ask us to delete your data, we delete it, photos included.

If you join the affiliate programme

Once the programme is running and you sign up, we will process your identification, tax and bank details, the customers attributed to you and your commissions, to perform the affiliate contract (Article 6(1)(b) GDPR) and meet our tax obligations (Article 6(1)(c)), during the relationship and for the legal periods afterwards.

If you are a student of one of our customers

If you have enrolled in a course or attend a class of an organisation that uses Coraula, that organisation is the controller of your data. Its privacy policy is on its portal. CRUD processes that data only to provide the service to it, following its instructions, and does not use it for anything of its own: neither for advertising nor to train artificial intelligence models.

If you write to us to exercise your rights over that data, we will pass your request on to the organisation, which decides.

Who else sees your data

We do not sell or share your data. We only disclose it to third parties when a law requires it (for example, to the tax authority or a court) or when it is needed for what you ask (for example, to Stripe to take a payment).

To operate, we use providers that process data on our behalf, under contract:

• Arsys Internet, S.L.U. (Spain): the servers where the platform and the database run, and file storage.
• Cloudflare, Inc. (United States): the domain name system (DNS) and the verification that stops bots on some forms (Turnstile). In Turnstile, as explained above, Cloudflare also uses those signals on its own account. It also stores Coraula Live recordings, but those are our customers' data, not covered by this policy.
• Hostinger International Ltd. (Cyprus): the email service the platform uses to send its notices and where we receive contact form messages.
• OpenRouter, Inc. (United States): reading the photos of the business cards we collect at fairs.
• The accounting firm that keeps our books and handles our taxes.

Some pages load technical files (styles and icons) from external content delivery services such as jsDelivr and cdnjs. To serve them, those services receive your IP address. They do not set cookies.

Data leaving the European Economic Area

Platform data is hosted in Spain, and Coraula Live recordings are stored in the European Union. But some providers are American or belong to groups headquartered in the United States (Cloudflare, OpenRouter and Stripe), and process some data outside the European Economic Area. Hostinger, which is European, in turn uses American providers.

When that happens, it is done with one of the safeguards required by the GDPR (Chapter V):

• Cloudflare, Inc.: we contract directly with it, in the United States, and its data processing agreement provides for processing outside the European Economic Area. The safeguard is the EU-U.S. Data Privacy Framework, under which Cloudflare, Inc. is certified (we checked on 5 November 2026) and, should it cease to be, the standard contractual clauses approved by the European Commission that the same agreement incorporates.
• OpenRouter, Inc.: according to its privacy policy, the standard contractual clauses approved by the European Commission.
• Hostinger International Ltd.: its data processing agreement applies the standard contractual clauses to anything leaving the European Economic Area.
• Stripe, which processes payment data on its own account: the safeguards explained in its own privacy policy.

If you want more detail about a provider's safeguard, ask us.

Your rights

You can ask us to:

• access the data we hold about you;
• correct it if it is wrong;
• erase it when it is no longer needed or we have no basis to keep it;
• object to processing based on legitimate interest, and always to marketing emails;
• restrict its use while a complaint is resolved;
• receive it in a format you can take elsewhere, when we process it under a contract or your consent;
• withdraw your consent at any time, without affecting what was done before.

Write to legal@crudsoftware.com saying what you want. We will reply within one month at most. If we have reasonable doubts about your identity, we will ask you to prove it.

If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Automated decisions

We do not make automated decisions about you or profile you in ways that affect you.

Changes to this policy

If we change this policy, we will publish a new version with its number and date. Earlier versions are kept.