Privacy Policy

1. Who is responsible for your data (the controller)

www.mara-pt.com and app.mara-pt.com are operated by Mara Nóbrega, a language teacher on Madeira Island, Portugal ("Mara", "we"). For GDPR purposes Mara is the data controller, and the competent supervisory authority is Portugal's Comissão Nacional de Proteção de Dados (CNPD, cnpd.pt).

Any privacy question: maranobrega@gmail.com.

2. What we keep, and why

• Student account — your name and email. Your teacher creates the account when you enrol in classes (there is no public signup); it exists so you can sign in and receive login emails. Legal basis: performance of the class contract (GDPR Art 6(1)(b)).
• Study data — the lessons and cards you study, your answers and grades, your progress, and your preferences (for example, interface language). This is the app itself: it lets the spaced-repetition system schedule your study and your teacher follow the class. Legal basis: contract.
• Contact messages — if you use the site contact form (name, email, message), we keep the message only to reply to you. Legal basis: legitimate interest in answering people who write to us.
• Technical logs — error and security logs needed to keep the service working and protected. Legal basis: legitimate interest in secure operation.

We don't ask for your date of birth, collect special-category data (health, religion, etc.), profile you, or make automated decisions with legal effects about you. The marketing site uses Vercel's audience analytics, which is cookieless and doesn't identify visitors — only aggregate numbers (how many visits a page had).

3. Who we share it with (processors)

We don't sell your data and don't share it for advertising. We use the following vendors to run the service — each processes data only on our instructions, under their data-processing terms:

• Supabase — database and authentication (where your account and study data live). Hosted in the US.
• Vercel — hosting for the site and app, plus cookieless audience analytics. US / global edge.
• Resend — login and account email delivery (magic links, recovery). US.
• Cloudflare — DNS and network protection. Global edge.

4. International transfers

The vendors above host data in the United States, so your data is transferred outside the European Economic Area. These transfers rely on the EU–US Data Privacy Framework (where the vendor is certified) and/or the European Commission's Standard Contractual Clauses included in each vendor's data-processing agreement. You can ask us which mechanism applies to which vendor.

5. How long we keep it

• Account and study data — for as long as you are Mara's student. When you leave the course (or whenever you ask), the account and study data are deleted.
• Contact messages — only as long as needed to reply and follow up.
• Technical logs — short periods, for operations and security only.

6. Your rights

You have the right to access your data, rectify it, erase it, restrict or object to processing, and to data portability (take a copy with you). To exercise any of them, write to maranobrega@gmail.com — we respond within one month at most.

If you think we've mishandled your data, you have the right to lodge a complaint with the CNPD (cnpd.pt) — though we'd appreciate the chance to fix it first.

7. Cookies

The app uses only the cookies strictly necessary to sign you in and keep your session secure — which is why there is no consent banner. There are no advertising cookies and no third-party trackers; the site's audience analytics (Vercel) works without cookies. Your language choice is stored in a simple cookie that records only that preference.

8. How we protect it

• All traffic is encrypted (TLS).
• Each student's data is isolated in the database by row-level security — the boundary is enforced by the database itself.
• Admin access is restricted to the teacher and the technical team.
• If a personal-data breach occurs that puts you at risk, we notify the CNPD within the legal deadlines (72 hours where required) and tell you if the risk is high.

9. Children

The service is for students of Mara's classes and is not directed to children under 13. We don't knowingly collect data from children; if you believe that has happened, contact us and we will delete it.

10. Changes to this policy

When our practices or vendors change, we update this page and the date at the top. For material changes we notify students (by email or in-app).