Privacy Policy

1. Data Controller

KnowZap (the "Platform") is a registered trademark of Victoriano Madroñal de los Santos (NIF ES14323932S), who acts as the data controller (the "Operator", "we", "us"). For any privacy-related request you can contact us at [email protected].

2. Data We Collect

We only collect the personal data necessary to operate the service:

• Account data: email address, username, display name, and (if you do not use social sign-in) a password, which is always stored encrypted (hashed).
• Profile data: avatar, content interests, and preferred language.
• Authentication data: if you sign in with Google, we receive a Google account identifier and basic profile information.
• Payment data: if you subscribe, payments are processed by Stripe. We store a Stripe customer reference, but we never store or process your card details on our servers.
• Usage data: product and analytics events (e.g. sign-ups, video views, purchases) and technical data such as IP address and device/browser information, collected through cookies and similar technologies.

3. How and Why We Use Your Data (Legal Basis)

• To provide the service (create and manage your account, deliver content) — performance of a contract.
• To process payments and subscriptions — performance of a contract.
• To secure the Platform (fraud and abuse prevention, e.g. Google reCAPTCHA) — legitimate interest.
• To analyze and improve the service (analytics) — your consent and/or legitimate interest.
• To comply with legal obligations (e.g. tax and accounting) — legal obligation.

4. Service Providers (Processors)

We share data only with trusted providers that process it on our behalf and under contract:

• Google Cloud — hosting and database (EU region, europe-west1).
• Cloudflare — content delivery, TLS encryption, and security (WAF/DDoS).
• Stripe — payment processing (PCI-DSS compliant).
• Google — sign-in (OAuth), reCAPTCHA, and analytics (Google Analytics / Tag Manager).
• PostHog — product analytics.

We do not sell your personal data. Some providers may process data outside the European Economic Area; where that happens, transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses.

5. How We Protect Your Data

We apply technical and organizational measures to protect your information, including: encryption in transit (HTTPS/TLS), encryption at rest on our cloud infrastructure, password hashing with bcrypt, signed and expiring authentication tokens, bot/abuse protection (reCAPTCHA), and restricted internal access to personal data.

6. Data Retention

We keep your personal data for as long as your account is active. If you delete your account, we delete or anonymize your personal data, except where we are legally required to retain certain records (for example, billing data for tax purposes).

7. Your Rights

Under the GDPR, you have the right to access, rectify, erase, restrict, and object to the processing of your personal data, as well as the right to data portability and to withdraw consent at any time. To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with your local data protection authority (in Spain, the Agencia Española de Protección de Datos, www.aepd.es).

8. Cookies

We use cookies and similar technologies that are necessary for the Platform to function, as well as analytics cookies to understand how the service is used. You can manage cookies through your browser settings.

9. Children

The Platform is not directed to children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above.