Privacy Policy

Syntrixo ("we"), the operator identified in the legal notice, is the data controller for personal data processed through Oncethen (oncethen.com). Contact: [email protected]. This policy explains what we collect, why, who we share it with and what you can do about it.

1. Data we collect

• Account data: your email address.
• Questionnaire answers: the answers you give before subscribing, such as your age group, the history topics you like, how much you already know about certain periods, how you like to learn, your goals and your preferred daily pace.
• Learning data: lessons started and completed, quiz answers and scores, and your streak.
• Billing data: plan, subscription status, renewal dates and payment history (amount, date, and the card brand and last four digits as reported by Stripe). Full card numbers never reach our servers.
• Technical data: IP address, browser and device type, pages requested, and the cookie described below. Web-server logs are kept for 30 days.
• Support data: the content of emails you send us.

2. Why we use it, and the legal basis

• To provide the Service (build your personalised plan from your answers, show your lessons, track your progress, run your subscription): performance of our contract with you.
• To take payment and send receipts: performance of the contract and our legal obligations.
• To send sign-in links and security notices: performance of the contract and our legitimate interest in keeping accounts secure.
• To prevent fraud, abuse and payment disputes: our legitimate interests.
• To improve the Service using aggregated statistics that do not identify you: our legitimate interests.
• To comply with tax, accounting and consumer-protection law: legal obligation.

We do not send marketing emails, and we do not sell or rent personal data. Your answers and learning data are not used to train artificial intelligence models. Lessons are produced with automated tools, including AI, without using any learner's personal data.

3. Who we share data with

We share personal data only with processors that act on our instructions to run the Service:

• Stripe Payments Europe Ltd / Stripe Inc.: Payment processing and subscription billing (Ireland, United States).
• Resend (Plus Five Five Inc.) via Amazon Web Services: Transactional email delivery (sign-in links, receipts) (United States, EU (eu-west-1)).
• Cloudflare Inc.: DNS, TLS termination, DDoS protection and CDN (United States, global edge).
• Hosting provider: Application and database hosting (European Union).

We may also disclose data when required by law, to enforce our Terms, or to a successor if the business is sold. Stripe acts as an independent controller for the payment data it holds; see Stripe's privacy policy.

4. International transfers

Some processors are in the United States. Transfers from the UK and EEA rely on the processors' certification under the EU-US Data Privacy Framework and its UK extension or on standard contractual clauses, together with the safeguards those processors publish.

5. Cookies

We use only one strictly necessary cookie, so no consent banner is shown:

• a session cookie (hi_session) that keeps you signed in, set when you subscribe or sign in and deleted when you sign out or after 90 days.

We set no advertising, analytics or third-party tracking cookies. Your questionnaire answers are kept in the page's memory until you subscribe and are not stored in your browser.

6. How long we keep data

• Account, questionnaire and learning data: for as long as your account exists, then deleted within 30 days of a deletion request.
• Billing records: 7 years after the transaction, as required by accounting law, in a form limited to what the law requires.
• Server logs: 30 days.
• Support emails: 2 years.

7. Your rights

Under the EU GDPR (and the UK GDPR if you live in the UK) you can ask us to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent where processing is based on consent. Residents of California and some other US states have comparable rights, including the right to know and to delete. To exercise any right, email [email protected] from the address on your account. We respond within one month.

You can also complain to a supervisory authority: the Spanish Data Protection Agency (AEPD, aepd.es), or the authority of the country where you live.

8. Security

Data is transmitted over TLS, sign-in links expire and can be used once, and access to production systems is restricted. No system is perfectly secure; if a breach affects you we will notify you and the relevant authority as the law requires.

9. Children

The Service is not directed at children. Subscriptions may only be purchased by adults. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes

We may update this policy. The date at the top shows the current version; material changes are announced by email or on the site. See also our Terms and Conditions.