PRIVACY POLICY

Privacy and Cookie Policy — Animawarriors Stream
Last updated: 25 August 2026

  1. Who is responsible for your data

The data controller is Jorge Vigara, sole trader (trabajador autónomo) · NIF: 09047687Q · Calle Princesa 31, planta 2, puerta 2, 28008 Madrid, Spain · [email protected]. If you have any question about how we handle your personal data, write to us at that address and we will answer.

Animawarriors Stream was previously operated by Animawarriors Online School Inc., a company incorporated in British Columbia, Canada, which was dissolved on 18 December 2025. Since then, Jorge Vigara is the sole data controller. If you registered with us before that date, your data was transferred as part of the transfer of the business.

  1. What data we collect

When you create an account or buy: name and email address; password (stored encrypted — we never see it); country and postal code, which we are required to collect to calculate tax; purchase history (what you bought, when, and how much you paid); billing address, where you provide one.

When you use the library: which courses you open and how far through them you are; login dates and times; IP address, browser and device type.

When you contact us: your email address and whatever you tell us in your message.

Payment data: payments are processed by Stripe Payments Europe, Ltd. We never see or store your full card number. We only see the last four digits, the card type and whether the payment succeeded.

We do not collect special category data, and we do not knowingly collect data from anyone under 16. If you believe a minor has registered, tell us and we will delete the account.

  1. Why we use it, and on what legal basis

Creating your account and giving you access to what you bought — performance of the contract. Taking payment and handling renewals — performance of the contract. Answering your emails and providing support — performance of the contract. Issuing invoices and keeping accounting and tax records — legal obligation. Calculating and reporting VAT and sales tax — legal obligation. Sending you marketing emails about Animawarriors — your consent, or our legitimate interest where you are an existing customer. Preventing fraud and account sharing, keeping the service secure — our legitimate interest.

We do not sell your data, and we do not share it with anyone for their own marketing purposes.

  1. Who processes your data on our behalf

We use a small number of service providers, each acting on our instructions under a data processing agreement: Thinkific Labs Inc. hosts the platform, your account and the course content (Canada); Stripe processes payments (Ireland / United States); Brevo (Sendinblue SAS) sends our marketing emails (France, EU); Google (Google Ireland Limited) hosts the form used to exercise the right of withdrawal, and stores the responses (Ireland / United States).

We may also disclose your data where we are legally required to — for example to a tax authority or a court.

  1. Transfers outside the European Union

Some of our providers are based outside the EU. Canada — Thinkific is Canadian; the European Commission has recognised Canada as providing an adequate level of protection for data handled by commercial organisations subject to PIPEDA, so no additional safeguards are required. United States — where data reaches the United States, transfers are covered by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses. Google — the withdrawal form is hosted by Google. Google Ireland Limited is the contracting entity for users in the European Economic Area, and Google is certified under the EU–US Data Privacy Framework for any data that reaches the United States.

You can ask us for a copy of the safeguards that apply by writing to [email protected].

  1. How long we keep it

Your account and course progress — as long as your account exists. Invoices and accounting records — 6 years, as required by Spanish law. Tax records — 4 years from the end of the filing period, as required by Spanish law. Marketing contact details — until you unsubscribe, then a minimal record so we don't email you again. Support emails — 2 years. Server and access logs — 12 months.

When you close your account we delete or anonymise your data, except what we are legally required to keep.

  1. Your rights

Under the GDPR you have the right to: access the personal data we hold about you; correct anything inaccurate; delete your data, where we have no legal reason to keep it; restrict how we use it; portability (receive your data in a machine-readable format); object to processing based on our legitimate interest; withdraw consent at any time, without affecting anything done before you withdrew it.

To exercise any of these, email [email protected]. We will reply within one month. We may ask you to confirm your identity first.

If you are not satisfied with how we have handled your request, you can complain to the Spanish data protection authority: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You may also complain to the supervisory authority in your own country of residence.

  1. Marketing emails

We will only send you marketing emails if you have consented, or if you are an existing customer and the emails relate to products similar to what you bought. Every email we send includes an unsubscribe link. One click and we stop. You can also email us at [email protected] and we will remove you. Unsubscribing from marketing does not stop transactional emails — order confirmations, renewal notices, access details — because those are part of the service you have paid for.

  1. Cookies

A cookie is a small file stored on your device that lets a website remember something about your visit.

Strictly necessary cookies, which make the site work and do not require your consent: session cookie (keeps you logged in, for the session); CSRF token (protects against cross-site request forgery, for the session); consent preference (remembers your cookie choices, for 12 months).

Third-party content: we embed sample lessons from YouTube. To protect your privacy, the videos do not load until you click play. Nothing is requested from YouTube, and no YouTube cookie is set, until you choose to watch. When you do, YouTube's own privacy policy applies.

Managing cookies: you can accept or reject non-essential cookies through the banner shown on your first visit. If you want to change your choice later, clear the cookies for this site in your browser and reload the page — the banner will appear again. You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the site — including logging in — will stop working.

  1. Security

We take reasonable measures to protect your data. Access to the platform is protected by your password, payments are handled by a certified payment processor, and we limit who can see your data to ourselves and our providers. No system is completely secure, and we cannot guarantee absolute security. If a data breach ever occurred that was likely to affect your rights, we would notify the AEPD within 72 hours and tell you directly where required.

  1. Changes to this policy

We may update this policy. The current version is always the one published on this page, with the date of the last update at the top. If we make a material change, we will tell you by email.

  1. Contact

Jorge Vigara · NIF: 09047687Q · Calle Princesa 31, planta 2, puerta 2, 28008 Madrid, Spain · [email protected]