Last updated: September 14, 2026
Legal Notice · Privacy Policy · Terms of Service · Cookie Policy
alinaflow is operated by Gabriel Labrada Cary, a sole trader (autónomo) established in Spain, and is therefore subject to the EU General Data Protection Regulation 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), regardless of where our customers are located. This policy explains what personal data we process, why, and the rights you have.
Controller: Gabriel Labrada Cary (trade name "alinaflow") — NIF Y9661599A — Carrer d'Estruc, 9, 08002 Barcelona, Spain.
Contact for data protection: hello@alinaflow.com. We have not appointed a Data Protection Officer (DPO), as our processing does not meet the thresholds of Article 37 GDPR.
As Controller, we process the personal data of our own customers, prospects, and website visitors (account and billing details, support requests, marketing and analytics).
As Processor, we process the personal data that our customers (schools, academies, tutoring centers) enter about their own students, families, and staff. In that case the customer is the Controller and decides why and how the data is used; we act only on their documented instructions under a Data Processing Agreement (Article 28 GDPR), which we make available to every customer.
Account & billing: name, email, workspace details, and payment information (processed by our payment providers — we do not store full card numbers).
Usage & analytics: pages visited, features used, device and approximate location data, collected via analytics cookies (see our Cookie Policy).
Communications: the content of messages you send us (email, chat, support).
Customer content (as Processor): the student, family, and staff records our customers enter — names, contact details, enrollment, attendance, and payment history. This may include data of minors, which the customer (as Controller) is responsible for collecting lawfully, including obtaining any parental consent required.
We do not sell your personal data. We share it only with service providers who help us run alinaflow, under contracts that require them to protect it:
Our platform is hosted on AWS infrastructure in the United States (US-East region), and some providers above are located outside the European Economic Area. Where personal data of EU/EEA individuals is transferred outside the EEA, the transfer is protected by an adequacy decision or by appropriate safeguards, in particular the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework to which our main providers (including AWS) are certified.
We keep account data for as long as your account is active. Customer content is deleted within 30 days of account closure or upon the customer's request, except where we must keep certain records (e.g. invoices) to comply with tax and accounting law. Analytics data is retained in aggregated or anonymized form.
Under the GDPR you have the right to access, rectification, erasure, objection, restriction, portability, and to withdraw consent at any time. To exercise them, email hello@alinaflow.com. If the data concerns a student or family member of one of our customers, we will refer your request to that customer (the Controller).
You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es, or with your local supervisory authority.
United States: where our customers handle student education records, we support their compliance with applicable laws such as FERPA by acting only as a service provider and not using student data for our own purposes.
Brazil: we apply equivalent safeguards consistent with the Lei Geral de Proteção de Dados (LGPD) for personal data of individuals in Brazil.
All data is encrypted in transit and at rest. Each workspace is logically isolated, and we apply access controls, monitoring, and industry-standard security practices (Article 32 GDPR). In the event of a personal data breach affecting your rights, we will notify the AEPD and, where required, the affected individuals, without undue delay.
We use strictly necessary cookies plus analytics cookies. Analytics cookies (Google Analytics) are only set after you give consent through our cookie banner. See our Cookie Policy to review and change your choices.
We may update this policy from time to time. We will notify you of significant changes by email or a notice on the platform, and the "last updated" date above will reflect the latest version.
For any question about this policy or how we handle your data, contact hello@alinaflow.com.