Privacy

Controller for all personal data on this site: Bilal Sbaiby, Travesía del Nuevo Alamín 11, 2D, 19005 Guadalajara, Spain (support@civiqpass.com).

No cookies, no account. Your mock answers stay in your browser and are not sent to us (your score is sent only if you leave your email).

We count visits and actions without identifying you: for each day we add up page views, mock starts and mock completions by language and by the utm_source, utm_medium and utm_campaign in the link you came from. We store no IP address, device id or cookie for this. We also count, per day and language, the faults the page reports. For each fault we keep only the script file and line, with no message or address. We also record how the page performs (loading time, layout shifts, response to a tap), rated good, needs improvement or poor. Nothing in these counts identifies you.

We also count visits with PostHog (EU servers), without cookies and without storing anything on your device. Each event carries the page path, the referring site, campaign tags (utm), your language, time zone, screen size and browser type. It carries no name, email or advertising id. PostHog uses your IP address only to count one visit per day and does not store it. PostHog stays off when your browser sends Do Not Track or Global Privacy Control. Events are kept for up to 12 months. Legal basis: our legitimate interest in measuring and improving the site (GDPR art. 6(1)(f)); you can object at any time by writing to support@civiqpass.com.

When you sign up or buy, we also note which page your visit started on that day and what kind of site sent you there (for example a search engine or a chat assistant), and keep it with your sign-up record or your access and payment record, so we learn which pages bring customers. We work this out on our own server from its technical log. No cookie is used and it goes to no one except the recipients listed.

Our server's access log records, for each request, your IP address, browser type (user agent), the page address, the referring page and the time. We use it to keep the site running and secure and to see which kinds of site send visitors, and it is kept for at most 15 days and then deleted. Legal basis: our legitimate interest in running a secure site (GDPR art. 6(1)(f)).

A few pages show a video from YouTube. The page shows our own picture, and nothing from YouTube is loaded or stored in your browser until you press the play button. When you press it, your browser asks youtube-nocookie.com (Google) for the video, so Google receives your IP address, your browser type and the address of our site, and YouTube's player saves a few settings in your browser's storage. What YouTube stores and what it does with it is described in Google's privacy policy. Legal basis: our legitimate interest in showing you the video you ask for (Art. 6.1.f GDPR).

When you use “Explain this to me”, we count your asks for the day with a one-way hash of your IP address (or of your pack link, if you bought the pack) that uses a salt which changes every day and is deleted at the end of the day. Legal basis: our legitimate interest in limiting abuse and cost (GDPR art. 6(1)(f)). The text of your question is sent to Anthropic, our AI provider, to produce the answer and is not stored by us. Legal basis: providing the answer you ask for (art. 6(1)(b)). Anthropic Ireland, Limited serves customers in the European Union and acts as our processor under its data processing addendum; it may process data outside the European Union, including in the United States, under standard contractual clauses. Please do not write personal data in a question or a report. A report about a wrong answer or translation contains only what you type and choose, the question it is about and the page language; we keep it for 90 days to correct the error, then delete it (legitimate interest, art. 6(1)(f)).

If you leave your email to be told when the DELE A2 pack opens, we store the address you type, your language, your mock score, the time, the version of the consent text and the time you confirm. Legal basis: your consent, which you can withdraw at any time with the unsubscribe link in every email (GDPR art. 6(1)(a)). We first send one confirmation email; if you do not confirm within 7 days we delete the address. Every address is deleted 12 months after you sign up, or sooner if you unsubscribe. We use it only to tell you once that the pack can be bought. Providers: Resend (sends the emails) and Hetzner Online GmbH (hosting, Helsinki, Finland); the software tools of Anthropic Ireland, Limited can also read this data, as described under 'Who receives it'. Resend may process data outside the European Union, including in the United States, under standard contractual clauses.

If you send a report on the real processing times page, we store the procedure, the province, the month and year of each step you give, the outcome and, if you answer, whether you found a cita previa without paying and after how many days, together with the day you sent it and the version of the consent text. We never ask for or store your name, email address, phone number, NIE, file number or nationality, there is no free-text field, and we do not store your IP address: to limit abuse, the server keeps in memory only a hash of your address and the day, which changes every day and is never written to disk. Legal basis: your consent, the box you tick before sending (GDPR art. 6(1)(a)). We publish only aggregate data: a province appears only when 5 or more reports hold the same step, as a median, a range and a count, marked as reported by users. After you send, we show you a delete code once; with it you can delete your report at any time on the same page, and we delete every report 4 years after it was sent. Without the code we cannot find your report, because it holds nothing that identifies you. Hetzner Online GmbH hosts the data.

If you ask for file reminders on the file tracker page, we store the address you type, the filing date you type, your language, the time, the version of the consent text, the time you confirm and what we have sent you. We never receive the file number you may type on that page. Legal basis: your consent, which you can withdraw at any time with the unsubscribe link in every message (GDPR art. 6(1)(a)). We first send one confirmation email; if you do not confirm within 7 days we delete the address. We use the data only to send a monthly note until the one-year limit of your file ends and one last note after it. We delete everything 30 days after that last note, or sooner if you unsubscribe, and in any case 2 years after you sign up. Providers: the same as in the paragraph above (Resend sends the emails, Hetzner Online GmbH hosts the data).

If you buy the DELE A2 pack, we keep the email address you enter at checkout, the language of the page, the Stripe payment references, the dates of purchase and expiry, whether your access is active or refunded, and the utm values of the link you came from. We use them to send your link, give you access, answer you and handle refunds and disputes. The legal basis is the contract you make by buying.

Who receives it: Stripe (Stripe Payments Europe, Ltd., Ireland) takes the payment, and your card details go to Stripe and never reach us. Resend (United States) sends the email with your link and, after a refund, the refund confirmation. Our server is at Hetzner in Helsinki, Finland. Anthropic Ireland, Limited (Ireland, EU): the software tools we use to read server logs, support mail and, read-only, the records described on this page (sign-ups for emails and reminders, access and payment records, withdrawal statements and reports of wrong answers) when diagnosing faults, security problems and support requests; it may transfer data to Anthropic, PBC in the United States under standard contractual clauses. For these tools, Anthropic's role depends on the Claude account they run on. On our business (Team) accounts it is our processor under its data processing addendum. On a consumer plan (Claude Pro or Max) it is an independent controller under its own privacy policy (anthropic.com/legal/privacy), which also lets it use the data to prevent fraud and abuse, resolve security issues and meet its legal obligations. On the consumer plan we have switched off the setting that lets Anthropic use our conversations to train its models; its business terms already exclude that. Stripe's own page may set cookies; this site sets none. Mail sent to the contact address goes through Forward Email (Forward Email LLC, United States), which by its own policy does not store it and passes it on to the operator's own mailbox at Google (Gmail, United States); these transfers rely on standard contractual clauses (Resend, Forward Email, Anthropic) or the EU-US Data Privacy Framework (Google).

How long: the copy of each Stripe event is deleted after 90 days, and your access record 12 months after your access ends (expiry or refund). Stripe keeps its own payment records under its own rules.

If you buy the File Pack, we keep the same data as for the DELE A2 pack, for the same purposes and the same time. What you type inside the File Pack (dates, names, letter details, ticks) is kept in your browser only; it is not sent to us.

If you buy the CCSE Pack, we keep the same data as for the DELE A2 pack, for the same purposes and the same time. Your answers and results inside the CCSE Pack are kept in your browser only; they are not sent to us.

If you use the withdrawal form, we keep your name, the email address you type, the pack you choose, your language, the time of your statement (UTC), what we did (refund, already refunded, already closed, period over, refund pending, a repeat of an earlier statement, nothing found) and the time we sent you the confirmation. We use them to act on your withdrawal, to prove that you withdrew and when, and to answer you. The legal basis is the contract and our legal obligation to handle a withdrawal. We delete the record 12 months after your statement. The refund and the confirmation email go through Stripe and Resend, as for any refund. When no purchase matches, a refund does not go through or a confirmation does not go out, a copy of the statement (name, address, choice, time, outcome) is also sent to our support mailbox, support@civiqpass.com, by the mail route described above (Resend, Forward Email, Gmail).

You have the right to access, correct, erase, restrict, object to and move your data: write to support@civiqpass.com. You can complain to your data protection authority (in Spain, the AEPD).