Privacy Policy
Política de Privacidad
1. Data controller
The data controller for galleyinsider.com is GalleyInsider. You can contact us at [email protected].
2. What data we collect
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email, first name | Account creation & course access | Art. 6(1)(b) — contract |
| Email, first name | Lead capture (eBook & discount) | Art. 6(1)(a) — consent |
| Payment details | Process payments via LemonSqueezy | Art. 6(1)(b) — contract |
| Progress & quiz scores | Track course completion | Art. 6(1)(b) — contract |
| IP address, browser info | Security, fraud prevention | Art. 6(1)(f) — legitimate interest |
| Cookies | Session management & preferences | See Cookie Policy |
3. How we use your data
- Provide and maintain the Services (course access, progress tracking).
- Send you transactional emails (enrollment confirmation, eBook delivery, discount codes).
- Improve the Website and user experience.
- Comply with legal obligations.
We do not sell, rent, or share your personal data with third parties for marketing purposes.
4. Third-party processors
| Service | Purpose | Location |
|---|---|---|
| LemonSqueezy | Payment processing | USA (SCCs) |
| Mailchimp (Intuit) | Email marketing (if subscribed) | USA (SCCs) |
| Abacus.AI | Hosting & infrastructure | USA (SCCs) |
Transfers to the USA rely on Standard Contractual Clauses (SCCs) in accordance with GDPR Art. 46(2)(c) and the EU Commission's adequacy decisions where applicable.
5. Data retention
- Account data: retained while active, plus 3 years after deletion for legal compliance.
- Lead data: retained for 2 years or until you withdraw consent.
- Payment records: retained for 5 years (Spanish tax obligations).
6. Your rights (GDPR Art. 15-22)
As a data subject you have the right to:
- Access your personal data.
- Rectify inaccurate data.
- Erase your data (“right to be forgotten”).
- Restrict processing.
- Port your data to another service.
- Object to processing based on legitimate interest.
- Withdraw consent at any time (without affecting prior processing).
To exercise any right, email [email protected]. We will respond within 30 days.
7. Supervisory authority
If you believe your rights have been violated, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es, or the supervisory authority in your country of residence.
8. Children
The Services are not directed to individuals under 16. We do not knowingly collect personal data from minors. If you believe a minor has provided data, contact us to have it removed.
9. Changes to this policy
We may update this policy periodically. The “Last updated” date at the bottom reflects the most recent version. Continued use of the Website constitutes acceptance of the updated policy.
Last updated: May 2026