Security & Privacy

Child-safety and data protection are designed into the core of the platform, not added afterwards. We follow privacy-by-design and privacy-by-default, and the strictest applicable standard where rules overlap.

We build to the GDPR, Spain's LOPDGDD (digital-consent age 14, with stricter under-18 guardian gating by policy), the Digital Services Act, the ePrivacy rules, and age-appropriate-design principles for minors.

We process only what each purpose needs (data minimisation), with a defined lawful basis per purpose — for example providing the service, keeping the community safe, and meeting legal obligations.

Minors are hidden by default and never surfaced to strangers. We do not profile minors. Giftedness and neurotype information is special-category-adjacent, strictly opt-in, and never used for advertising or behavioural targeting.

Consent is captured as records with purpose, policy version, and who granted it (a guardian, for minors). It is revocable at any time; withdrawing consent is recorded and never silently deleted.

We use encryption in transit (TLS) and at rest, with column-level encryption for minors' and other sensitive fields. We build to OWASP ASVS (L2 across the app, L3 for authentication and minor-data paths), with CSP, CSRF and XSS protections, signed media URLs, and antivirus and CSAM scanning of uploads before they are served.

Personal data — and unconditionally all minors' data — is processed and stored in the European Union, and our sub-processors must offer EU residency under a compliant data-processing agreement.

If a personal-data breach occurs, we notify the competent supervisory authority within 72 hours where required, and affected members without undue delay.

We detect, preserve, and report child sexual abuse material to the competent authorities as required by law, and never tip off offenders.

You can access, correct, export, or erase your data and withdraw consent. See Your Rights for how to exercise them.