Privacy
Privacy Policy
Last updated: August 2026
Claudia Miralles Berna, based in Madrid, Spain, is the data controller for the personal data described below. This policy explains what we collect, why, and what rights you have under the GDPR and applicable Spanish data protection law.
1. What We Collect
When you book a session, the checkout itself is handled entirely by Stripe (our payment processor) — your card details never reach our servers. We do receive, via Stripe: your name, email address, and which item you purchased, so we can confirm the booking and follow up. Our server also briefly logs IP addresses for checkout requests, purely to rate-limit abuse (e.g. bot activity) — these logs aren't used for tracking and aren't retained long-term.
We do not use advertising cookies or sell data to advertisers. If you accept the cookie banner, we use Google Analytics (GA4) to understand, in aggregate, how visitors use the site — nothing loads, and no analytics data is collected, unless you accept. See the Cookie Policy for exactly what that involves and how to change your choice at any time.
2. Why We Process This Data
To fulfill the coaching service you've paid for (contractual necessity), to respond to your emails, and to keep the site secure against abuse (legitimate interest). We don't sell your data or use it for anything beyond delivering the service you booked.
3. Who We Share It With
Stripe processes payments and holds the underlying transaction data — see Stripe's own privacy policy. Vercel hosts this site and may process standard server logs (IP, request metadata) as part of running the infrastructure. If you've accepted the cookie banner, Google processes aggregate, anonymized analytics data via Google Analytics — see Google's privacy policy. We don't share your data with anyone else.
4. How Long We Keep It
Booking-related data (name, email, what you purchased) is kept for as long as needed to deliver the service and meet any legal/tax record-keeping obligations, then deleted. Rate-limiting logs are kept only briefly (on the order of minutes) and not archived.
5. Your Rights
Under the GDPR, you can request access to, correction of, or deletion of your personal data, object to or restrict its processing, or ask for a copy in a portable format. Email claudia@thexpatsuite.com for any of these. You can also lodge a complaint with Spain's data protection authority, the AEPD, if you believe your data has been mishandled.
6. Changes to This Policy
We may update this policy as the site changes (for example, if analytics is added later) — the "last updated" date above will reflect that.
7. Contact
Questions about this policy or your data: claudia@thexpatsuite.com.