Privacy Policy
Last updated: 27 August 2026
1. Data Controller
In accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), the data controller is:
- Name / Trade name: Oscar Pérez Carrera
- Tax ID (NIF/NIE/CIF): 48816509K
- Registered address: Calle Maestro Rafael Vazquez nº 38, 21120 Aljaraque, Huelva, España
- Email: hola@campusassistant.app
- Activity: Software development and sale of Moodle plugins
2. What personal data we collect
We collect the following categories of personal data depending on how you interact with our services:
2.1 When you register an account
- Email address
- Password (stored as bcrypt hash, never in plaintext)
- Optional: name, surname
2.2 When you purchase a license
- Billing data (name, address, country, tax ID) — collected and stored by PayPal; we only receive the email and the transaction ID
- Email address (for invoice and license delivery)
- Domain where the license will be activated
2.3 When you use the plugin on your Moodle campus
- Messages sent by your users to the AI assistant (processed by the AI provider, not stored by us)
- Usage metrics (number of messages, free-tier counter reset dates)
- License validation requests (timestamp, license key hash, domain)
2.4 When you browse this website
- IP address, browser, device, pages visited (via Google Analytics 4)
- Cookies (functional + analytics; see Cookies Policy)
3. Purpose and legal basis
| Purpose | Legal basis |
|---|---|
| Provide the contracted service | Contract execution (Art. 6.1.b GDPR) |
| Billing and tax compliance | Legal obligation (Art. 6.1.c GDPR) |
| Send transactional emails (license, invoices, password reset) | Contract execution (Art. 6.1.b GDPR) |
| Website analytics | Consent (Art. 6.1.a GDPR) — via cookie banner |
| Customer support | Legitimate interest (Art. 6.1.f GDPR) |
4. Data recipients (processors)
We share your data only with the following processors, all under data processing agreements:
- PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment processing (privacy policy)
- Brevo (Sendinblue) — transactional email (privacy policy)
- AI providers (optional, chosen by the customer): OpenAI, DeepSeek, Google Gemini, Anthropic Claude — only process the messages sent by your end users; we do not share your account data with them
- Google LLC — Google Analytics 4 (anonymized IPs)
- Hosting provider: OVH
5. International transfers
Some processors may process data outside the European Economic Area (EEA). In those cases we ensure an adequate level of protection via:
- European Commission's Standard Contractual Clauses (SCCs)
- EU-US Data Privacy Framework (where applicable)
- Processor's adequacy decisions
6. Data retention
- Account data: until you request deletion + 30 days grace period
- Billing/invoice data: 4 years (Spanish tax law, Art. 66 LGT)
- License validation logs: 12 months
- GA4 analytics: 14 months (Google default)
- AI message content: NOT stored by us. AI providers have their own retention policies (typically 30 days for abuse monitoring, then deleted)
7. Your rights
You have the right to:
- Access — know what data we have about you
- Rectification — correct inaccurate data
- Erasure ("right to be forgotten")
- Restriction — limit how we process your data
- Portability — receive your data in a structured, machine-readable format
- Objection — to processing based on legitimate interest
- Withdraw consent — at any time, without retroactive effect
- Lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es
To exercise any of these rights, write to hola@campusassistant.app with proof of identity. We will respond within 30 days.
8. Security measures
We apply appropriate technical and organizational measures to protect your data: HTTPS/TLS 1.2+ on all communications, bcrypt password hashing, prepared statements against SQL injection, CSRF tokens on all forms, rate limiting, Content Security Policy headers, principle of least privilege in database access, daily encrypted backups. See our Security page for full details.
9. Children's data
Campus Assistant is sold to educational institutions (universities, academies, training centers) and not directly to minors. However, end users (students) may be minors. The institution acts as data controller for those users; we only process messages on behalf of the institution as a processor.
10. Changes to this policy
We will notify registered users by email at least 30 days before any material change takes effect. The "Last updated" date at the top reflects the latest version.
11. Applicable law
This policy is governed by Spanish law and EU regulations, in particular the GDPR and the LOPDGDD. Any dispute will be submitted to the courts of Huelva.