Privacy Policy
How WideSprout Español handles your information, in plain English.
Last updated 19 October 2026
The short version: you can learn A1 without telling us who you are, and your progress stays in your own browser. We only hold your details if you join our weekly email or become a paying member. Payments are handled by Stripe or PayPal, and we never sell your data.
Who we are
WideSprout Español (https://espanol.widesprout.com) is an online Spanish course for English speakers. In this policy, “we” and “us” means WideSprout Español, the data controller for the personal data described here.
For any privacy question or request, email us at imranhsayed@gmail.com.
What we collect and why
Newsletter sign-up
If you join our weekly email on the Newsletter page, we collect your first name and email address, and a record that you ticked the consent box.
- Why: to send you a short weekly email with new lessons and culture notes, and news about the course.
- Legal basis: your consent (GDPR Article 6(1)(a)). You can withdraw it at any time by replying to any email or writing to imranhsayed@gmail.com.
- Where it is kept: in our website’s database, and as a notification email sent to us.
Membership and payments
If you become a member, you create an account at checkout. We collect your username, email address and a password (stored encrypted), the plan you chose (monthly or yearly), and records of your payments: amount, date, plan and the last four digits and type of the card, or your PayPal email. If you are a member, the lessons you mark as done are also saved to your account so your progress follows you to other devices.
We never see or store your full card details. Payments are taken on the secure pages of our payment providers, Stripe (cards, Apple Pay and Google Pay) or PayPal, which act as independent controllers for the payment data under their own privacy policies.
- Why: to create and run your membership, give you access to levels A2 to C2, take payments, send receipts and account emails, and keep your progress.
- Legal basis: performing our contract with you (GDPR Article 6(1)(b)), and our legal obligation to keep accounting and tax records (Article 6(1)(c)).
- Where it is kept: in our website’s database, and with Stripe or PayPal for payment records.
- You can change your details, see your invoices or cancel your membership at any time from My account.
Your learning progress
When you mark a lesson as done, the lesson code and date are saved in your own browser’s local storage (under the name ws-progress). This powers My progress, your streak and the “Lessons” link. If you are not a member, it is never sent to us. If you are a logged-in member, it is also saved to your account as described above. Your Level Check answers are also worked out in your browser and not sent anywhere.
You can delete this data at any time with the “Reset progress” button on My progress, or by clearing your browser’s site data.
Technical data and security
Like every website, our server receives technical information when you visit: your IP address, browser type, the pages you request and the time. Our hosting provider keeps this in server logs for a short period. Our security software also records the IP address of failed attempts to log in to the site’s admin area, to block attacks.
- Legal basis: our legitimate interest in keeping the website running and secure (GDPR Article 6(1)(f)).
Cookies and similar technologies
We use as few cookies as possible. We do not currently use analytics, advertising or tracking cookies. At checkout, Stripe and PayPal set their own cookies on their payment pages to process the payment securely and prevent fraud.
| Name or type | Purpose | How long |
|---|---|---|
| Cookie consent cookie | Remembers the choice you made in our cookie banner. | Up to 12 months |
| WordPress login cookies | Keep members (and site administrators) logged in. | Session, or up to 14 days with “Remember me” |
ws-progress (local storage) | Your lesson progress, kept on your device only. | Until you reset it or clear your browser data |
The advertising spaces on the site are placeholders and do not load any ad network. If we add advertising or analytics in the future, we will update this policy and ask for your consent first where the law requires it.
Third-party services
- Google Fonts. Our fonts (Fredoka and Nunito) are loaded from Google’s servers. When your browser downloads them, Google receives your IP address. Google may process this outside the EU, under the EU–US Data Privacy Framework. See Google’s privacy policy.
- Speaker buttons. The “hear it” buttons use your browser’s built-in speech feature. We do not receive anything. Some browsers use online voices, in which case the browser maker (for example Google or Apple) may process the text being read aloud under its own privacy policy.
- Sharing. The “Copy link” and “Share” buttons use your device’s own sharing tools. No social media trackers are loaded.
- Stripe and PayPal. Stripe Payments Europe, Ltd. (Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) process membership payments. They may transfer data outside the EU under their own safeguards. See Stripe’s privacy policy and PayPal’s privacy statement. n
- Hosting and email. Our website and its emails are run on our hosting provider’s servers, which process data on our behalf under a data processing agreement.
We do not sell, rent or trade your personal data, and we do not use it for automated decision-making or profiling.
How long we keep your data
| Data | Kept for |
|---|---|
| Newsletter name and email | Until you unsubscribe or ask us to delete it. We remove it within 30 days of your request. |
| Member account and progress | While your membership is active. If you cancel, we keep your account for 12 months so you can come back, then delete it, unless you ask us to delete it sooner. |
| Payment and invoice records | As long as Spanish accounting and tax law requires, normally six years. |
| Server logs and security logs | A short period set by our hosting provider and security software, normally no more than a few months. |
| Website backups | Backups of the site may contain the data above for up to 90 days before they are overwritten. |
| Learning progress (non-members) | On your device only, until you delete it. |
Your rights
Under the GDPR and Spain’s data protection law (LOPDGDD), you have the right to:
- access the personal data we hold about you;
- correct it if it is wrong;
- have it deleted;
- restrict or object to how we use it;
- receive it in a portable format;
- withdraw your consent at any time, without affecting anything we did before you withdrew it.
To use any of these rights, email imranhsayed@gmail.com. We will reply within one month. If you are not happy with our answer, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), or to the authority in your own country.
Children
The course is designed for teens and adults. You must be at least 14 to sign up for our weekly email, the age of digital consent in Spain. If you believe a younger child has given us their details, contact us and we will delete them.
Keeping your data safe
The site uses an encrypted connection (HTTPS), keeps its software up to date, limits login attempts and is backed up regularly. Only the site owner can access the sign-up list and member records.
Changes to this policy
We will update this page when the way we handle personal data changes, for example if we add analytics or advertising. The date at the top shows when it was last changed.