Privacy policy

Last updated: 26 October 2026

This page explains what personal data the website espanolconnacho.com processes, why, for how long, and what your rights are.

1. Who is responsible for your data?

• Data controller: José Ignacio Fernández Otero (“Español con Nacho”).
• Contact email: hola@espanolconnacho.com

You can write to me at that address about anything related to your data.

2. What data do I process, why, and on what legal basis?

Your account on the website

• Data: your email, your name, your username (@username), your password (always stored encrypted as a hash, never in readable form), the website language you were using when you signed up, the country you connect from (only the country, worked out from your connection; updated at most twice a day), the date you confirmed your email, the date and version of the terms of use you accepted and, if you choose to upload one, your profile photo (reduced to 256×256 pixels and stored with Cloudflare). You can remove the photo at any time from My account.
• Purpose: to create and manage your account, let you log in, give you access to the content you’re entitled to and be able to show that you accepted the terms of use.
• Legal basis: performance of the contract you accept when you create your account (Art. 6(1)(b) GDPR).

Comments and public profile

• Data: the comments you post (text and posting and editing dates). Next to them and on your public profile, your name, your username (@username), your photo (if you’ve uploaded one), the date you signed up, whether you have a paid membership and since when, how long in total you have been a paid member (including past periods), your number of comments and, if you add them in Edit profile, your description, the country you’re from, the country you live in and the languages you speak or are learning with your level are shown. Your email is never shown.
• Purpose: to allow conversation on episodes and show who wrote each comment.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR), under the terms of use.
• Notifications: if someone replies to one of your comments, I store a notice for you (who replied, to which comment and when) that you’ll see under the bell on the website. Only you see it. It’s deleted 90 days after you’ve read it and, at most, after a year (or sooner, if the reply is deleted or you delete your account).
• Reports: if you report a comment, I store who reported it, when and the reason. Only I see this, for moderation, based on my legitimate interest in keeping the website safe and complying with the law (Art. 6(1)(f) GDPR).
• Deleted comments: when you delete a comment, or I delete it for breaking the rules, the website only shows a “Comment deleted” notice in its place (without its text or your name), and other people’s replies are kept; if I consider it necessary, I can make it disappear from view completely, together with its replies. If you delete a comment yourself, you have one minute to undo it; if nobody had replied to it, it disappears from view completely. I keep its text, its dates and any reports it had for 12 months. Only I see it, for moderation, to be able to handle possible complaints and to republish it if it was deleted by mistake, based on the same legitimate interest (Art. 6(1)(f) GDPR). After that period, it’s deleted completely.

Last activity

I store approximately (to within a few hours) the last time you used the website while logged in. Only I see it, in the admin panel, to manage accounts (legitimate interest, Art. 6(1)(f) GDPR). It’s not public.

Emails about your account

• Data: your email and your name.
• Purpose: to send you the emails you need to use your account: confirming your email address and resetting your password if you forget it. I don’t send you advertising this way.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Your membership via Patreon

If you choose to connect your Patreon account:

• Data: your Patreon user ID, the membership tier you’re entitled to for Español con Nacho and the access codes Patreon provides to check your membership. I don’t receive your payment details.
• Purpose: to check whether you have an active paid membership and, if so, give you access to member content. I also store the dates on which each period of paid access starts and ends, to show on your profile how long in total you have been a member.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Patreon processes your payment and subscription data as an independent controller, under its own privacy policy.

Waiting list for classes

If you fill in the waiting list form:

• Data: name, email, Telegram username, native language(s), approximate Spanish level, goals, any comments you add and your contact preferences.
• Purpose: to contact you when a spot becomes available for classes and, only if you ticked the box, to send you news from Español con Nacho and announcements about new courses. To check that the email is yours, I first send you a confirmation email: until you confirm it, your request is stored temporarily on this website, and only once you confirm it is it stored in Kit and I receive a copy in my email.
• Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to me or using the unsubscribe link in any email.

When you write to me

• Data: whatever you include in your message.
• Purpose: to reply to you.
• Legal basis: my legitimate interest in answering the enquiries I receive (Art. 6(1)(f) GDPR).

Website security and operation

• Data: technical data such as your IP address, the browser you use and the pages you request.
• Purpose: to make the website work, protect it against abuse (for example, by limiting login attempts) and detect errors.
• Legal basis: my legitimate interest in keeping the website secure and working (Art. 6(1)(f) GDPR).

Visit statistics

• Data: each time you open a page, I record the page, the country you connect from (worked out from your connection), whether you’re visiting without an account, with an account or as a paying member, the page language, the type of device (mobile, tablet or computer) and, if you arrive from another website or through a tagged link, only that website’s name or the link’s tag (for example, “youtube”). To leave out automated programs, the network the connection comes from is checked (for example, an Amazon or Google server), without storing it. I don’t store your IP address or use cookies for this. To count how many different people visit the website, if you don’t have an account a code is calculated that changes every day (from your IP, your browser and a random value that is deleted the next day), so afterwards nobody can tell who you were; if you have an account, a fixed code derived from it is used.
• Purpose: to know how many visits and visitors the website has, which pages and episodes are most interesting and which countries people visit from, in order to improve the content. Only I see it, as aggregated figures.
• Legal basis: my legitimate interest in understanding how the website is used in order to improve it (Art. 6(1)(f) GDPR), with measures that protect your privacy (no cookies, no IP address and no third-party analytics services).

I don’t use third-party analytics or advertising tools, I don’t make automated decisions about you and I don’t create profiles.

3. How long do I keep your data?

• Account: for as long as you keep it. You can delete it yourself at any time from My account; doing so deletes your account and all its associated data, including your comments and any reports you made. Only an anonymous count remains for statistics (the date an account was deleted, when it had been created and whether it had a paid membership), with no data that identifies you.
• Comments: until you delete them, I delete them for breaking the rules, or you delete your account. After they’re deleted, the moderation copy is kept for 12 months (or until you delete your account, if sooner).
• Open sessions: if you ticked “Remember me”, they expire after at most 180 days without using the website; otherwise, when you close your browser (12 hours at most). They are deleted automatically.
• Links sent by email (confirm email, reset password): they expire after 48 hours and 1 hour respectively and are deleted automatically.
• Patreon connection: until you disconnect it from My account or delete your account.
• Waiting list: if you don’t confirm your request, it’s deleted after 48 hours. Once confirmed, until you withdraw your consent or until I stop offering the classes.
• Visit statistics: the details of each visit are kept for about 3 months; after that, only daily summary figures are kept, which don’t identify anyone.
• Technical data: for a short period, as long as necessary for security and troubleshooting.

I may also keep data blocked for the legal periods during which liabilities may arise.

4. Who is your data shared with?

I don’t sell or give your data to anyone. For the website to work, some providers process it on my behalf and following my instructions:

Provider	Purpose	Location
Cloudflare, Inc.	Website and database hosting, security, visit statistics	USA and worldwide network
Zoho Corporation B.V. (ZeptoMail and Zoho Mail)	Sending your account emails and my contact email	European Union
Kit (ConvertKit, LLC)	Managing the waiting list and news emails	USA

In addition:

• Patreon, Inc. (USA) receives and processes your data as an independent controller when you subscribe on Patreon or connect your account.
• YouTube (Google Ireland Ltd.): the videos are hosted on YouTube. They’re only loaded from YouTube when you click to play them; from then on, Google processes the data it collects as a controller, under its privacy policy.

Transfers outside the European Union: when a provider processes data in the USA, the transfer is covered by the EU-US Data Privacy Framework or, failing that, by the standard contractual clauses approved by the European Commission.

5. What are your rights?

At any time you can exercise your rights to:

• access your data;
• rectify inaccurate data;
• erase your data;
• object to processing;
• restrict processing;
• data portability;
• withdraw your consent, where processing is based on it, without affecting earlier processing.

To exercise them, email me at hola@espanolconnacho.com saying which right you want to exercise. I’ll reply within one month.

If you believe I haven’t processed your data properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the data protection authority of your country.

6. Minors

You must be at least 14 years old to create an account. If you’re under 14, you need the consent of your parent or legal guardian.

7. Changes to this policy

If I change this policy, I’ll publish the new version on this page with its update date. If the change is significant, I’ll let you know.