Privacy policy

The data controller is Albert Alvarez Estelles, tax ID ES44519666S, with business address at calle 207 nº31-8, 46182 Paterna, España.

For privacy questions or to exercise your rights, email [email protected].

• Account data: email address, password hash, email verification, account status, language or region, and sign-in dates.
• Authentication and security data: session and token records, security events, request identifiers, IP address processed temporarily for rate limiting, and technical request logs where necessary.
• Device and license data: public key, optional device name, platform, architecture, operating system version, app version, activations, license validity and revocation status. We do not use hardware fingerprinting.
• Sign-up and usage data: sign-up method (email or Google) and whether it happened on the website or from the desktop app, approximate country from our CDN's geolocation header (we never store your IP address), operating system inferred from the browser, interface language, number of sign-ins and country of the last one, and how you first reached our website: the referring site's domain only (never the full address), the landing page and any campaign (utm) parameters. We use it only in aggregate to understand where our users come from.
• Anonymous install counter: at most once a day, the desktop app sends a random installation identifier that is not linked to your account, together with the operating system and its version, architecture, app version and release channel. It contains no personal data and stops if you turn off error reports in the app (Help → Diagnostics).
• Error reports: when the desktop app or our servers fail, a technical report is sent with the error and its stack trace, app version and build, operating system, architecture, interface language, the current screen, the approximate project size in ranges and the random installation identifier. Email addresses, file paths, tokens and the content of your timetables are removed before sending. You can turn them off at any time in the app (Help → Diagnostics).
• Subscription data: Stripe customer, subscription, checkout and payment identifiers, amount, currency, status, tax or billing metadata and webhook records. Kaselles does not receive or store full card numbers.
• Support data: your email and the information you choose to include when contacting us.

All your centre's data — teachers, groups, subjects, rooms, constraints and every generated timetable — lives exclusively in a local project file on your computer. It is never uploaded, scanned or processed by us, and we hold no copy of it.

You control that file completely: move it, copy it or delete it whenever you like. Deleting it erases the data for good — subject to any backups you made outside the app.

• To create and secure your account, provide the software license, devices, downloads and support, and perform our contract with you.
• To process payments, refunds, invoices and taxes, and comply with accounting and legal obligations.
• To prevent abuse, investigate security incidents and protect the service, based on our legitimate interests and legal duties.
• Where consent is the appropriate basis, you may withdraw it at any time without affecting earlier processing.

We use Stripe for checkout, subscriptions, payments and tax-related processing; Amazon SES to deliver transactional email; Google when you choose Google sign-in; and GitHub to distribute signed application releases.

We use Sentry to receive and analyse these error reports from the desktop app and our servers.

These providers process data under their own terms and may operate outside your country. Where required, transfers are protected by an adequacy decision, standard contractual clauses or another lawful safeguard.

We use essential session storage to keep you signed in, protect forms, remember language, infer a download platform and, where available, hold an approximate country code for price display. We do not use advertising cookies or third-party analytics on this website.

On your first visit we also keep in that session storage the referring site's domain, the landing page and any campaign parameters, so that we can attribute sign-ups to their source. This information is not shared with third parties.

We keep account and license records while your account or license is active and afterwards only as needed for security, disputes and legal obligations. Payment and invoice records may be retained for statutory accounting periods. Expired or revoked security records and operational logs are kept only for as long as reasonably necessary. Local desktop data remains until you remove it or uninstall the app.

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, and may complain to your data protection authority. You may also revoke active devices and sessions from your account. Email [email protected]; we may need to verify your identity.

We use access controls, encryption in transit, hashed passwords and signed device licenses. No system is completely secure, so please report suspected abuse promptly. Kaselles is not directed to children under 16. We will publish material policy changes here and update the effective date.