← Back to home

Privacy Policy

Last updated: 17 August 2026

1. Data controller

• Owner: Aleksei Potashev (sole trader / autónomo)
• Tax ID (NIF): Z1277417W
• Address: Calle Doctor Zamenhof 22, 2B, 28027 Madrid, Spain
• Contact email: team@carnetflow.com
• Website: carnetflow.com · App: CarnetFlow (iOS)

2. Data we process

• Account data: email address, display name and optional profile picture. If you sign in with Apple or Google, we receive the identifier and email those providers pass to us; with Apple’s “Hide My Email” we only receive a relay address.
• Study data: answers, correct and incorrect results, topics practised, mock exam results, readiness level, exam date and study streak.
• Preferences: interface and question language, colour palette, daily study minutes.
• Technical and diagnostic data: device and installation identifiers, app version, crash reports and aggregated usage events.
• Purchases: the status of your subscription or lifetime purchase. We do not process payment data — the transaction happens entirely in Apple’s App Store and we never see your card.
• Communications: if you write to us or report a question, we process the content of your message.
• Install attribution: if you installed CarnetFlow from an Apple Search Ads advertisement, Apple gives us anonymous information about the campaign, ad group and keyword that led to the installation. This describes the advertisement, not you: it does not identify you, contains no device identifier and cannot be used to follow you across other apps or websites.
• Approximate location: when you start a study session, our server derives the country and city from the connection’s IP address for internal usage statistics. The IP address is not stored; we keep only the approximate country and city.

3. Purposes and legal bases

• Creating your account, saving your progress and syncing it between app and web — performance of the contract (Art. 6(1)(b) GDPR).
• Calculating your readiness and personalising your study plan — performance of the contract.
• Managing purchases and the free session limit — performance of the contract.
• Progress emails and reminders — consent (Art. 6(1)(a)), withdrawable at any time via the unsubscribe link in every email.
• Essential service emails (email verification, password reset) — performance of the contract.
• Usage analytics, product improvement and error detection — consent on the website (cookie banner) and legitimate interest in the app to keep the service stable (Art. 6(1)(f)).
• Abuse prevention and security (App Check, usage limits) — legitimate interest.
• Meeting legal, accounting and tax obligations — legal obligation (Art. 6(1)(c)).

4. Processors and third parties

We work with providers that process data on our behalf under a signed data processing agreement (DPA):

• Google Ireland Ltd. — Firebase: authentication, database (Firestore), image storage, App Check, Crashlytics and Google Analytics for Firebase. Account, study and diagnostic data.
• Resend, Inc.: transactional and progress emails. Email address and name.
• Apple Inc.: app distribution, Sign in with Apple and in-app purchases. Apple acts as controller for the payment; we only receive the purchase status.
• Google Analytics 4 on the website: only if you accept analytics cookies.

We do not sell your data and do not share it with third parties for advertising.

5. International transfers

Some providers may process data outside the European Economic Area (mainly in the USA). Those transfers rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on the EU–US Data Privacy Framework, together with additional technical measures such as encryption in transit and at rest.

6. Retention

• Account and study data: for as long as your account is active.
• If you delete your account: personal data is erased within 30 days at most. Backups rotate and are fully removed within a further 7 days.
• Billing records required by tax law: up to 6 years (held by Apple as seller of record).

7. Your rights

You may exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw your consent at any time, by writing to team@carnetflow.com from the address linked to your account. We answer within one month.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid, Spain.

8. Deleting your account

You can delete your account and all of its data directly in the app: Profile → Reset data → Delete account. The action is immediate, irreversible and does not require contacting us.

9. Minors

CarnetFlow prepares you for the Spanish Permiso B theory exam and is aimed at people eligible to take it. We do not knowingly collect data from children under 14. If we identify such an account, we delete it.

10. Security

We use encryption in transit (TLS) and at rest, per-user access rules in the database, app integrity verification (App Check) and daily backups.

11. Changes to this policy

If we change this policy we will publish the new version on this page and update the date. Substantial changes will also be announced by email.