Arena Spanish

Privacy Policy

Política de privacidad

Last updated: September 25, 2026

1. Who we are

Arena Spanish School ("Arena", "we", "us") is a Spanish school that teaches live online lessons from San Juan del Sur, in the department of Rivas, Nicaragua. We are the controller of the personal data we collect through this website, student accounts and the messages you send us. You can reach us at .

We process your data in line with Nicaragua's Law No. 787, Personal Data Protection Law, and its regulations. If you live elsewhere, we also respect the rights your local law gives you (for example the GDPR in the European Union or the CCPA/CPRA in California) where they apply.

2. Information we collect

  • Messages you send us. If you write to us by WhatsApp or email, we receive your name, contact details and what you tell us.
  • Student account. Email address, name, Spanish level, assigned teacher and your learning activity: classes, exercises you submit and your scores.
  • Classes. Date, time, teacher, video-call link and, for the group class, the list of enrolled students. We do not record lessons.
  • Level test. Name, email, your answers, your result and the language you used. Stored only if you tick the consent box.
  • Payments. You pay through PayPal or arrange payment with us directly. We receive the payer's name, email, amount and reference. We never see or store card numbers.
  • Testimonials. Your name, city and your words, published only with your permission.
  • Google Calendar (only teachers who connect it). If a teacher connects their Google account, we receive from Google only the time ranges when they are free or busy and that account's email address. We do not access event titles, descriptions, guests or other details. The access permission (a "token") is stored encrypted, and the teacher can disconnect it at any time from their panel or from their Google account.
  • Technical data. IP address and browser or device details, kept in the logs of the servers we use.
  • Browser storage. We keep your theme (light or dark), language and login session. We do not use advertising cookies.

Sensitive data. We do not ask for sensitive data (for example health, religion, political views or ethnic origin). Please do not include it in messages or exercises.

3. What we use it for, and on what basis

We use your data only for the purposes listed here. If we wanted to use it for something else, we would ask you first.

  • To give you lessons and access to your account (to provide the service you asked for).
  • To answer your questions and arrange bookings and payments (contract, or steps you asked for before one).
  • To send you your sign-in link and essential account messages.
  • To keep the site secure and prevent abuse (our legitimate interest).
  • To contact you about lessons if you took the level test (your consent).
  • To publish a testimonial or send you optional news (your consent, which you can withdraw at any time).
  • To meet legal, accounting and tax obligations.

4. Who we share it with

We do not sell your data. We only share it with providers that help us run the school, and only what they need:

  • Supabase: database, sign-in and file storage. It also sends the sign-in emails. Its servers are in the United States.
  • Hostinger: website hosting.
  • PayPal: payment processing.
  • WhatsApp (Meta): messaging, when you choose to contact us there.
  • The video-call platform your teacher uses (for example Google Meet or Zoom): it receives what you give it when you join a class.
  • Google: website fonts, calendars embedded in the teachers' panel and, for teachers who connect it, the Google Calendar API.
  • Cloudflare: bot protection on the sign-in page.
  • Content delivery networks (Tailwind CDN and jsDelivr): deliver the site's code and, like any website, receive your IP address.
  • YouTube or Vimeo: only if we embed a video on the site and you play it.
  • Our teachers: they see only the details of the students assigned to them and their classes.
  • Authorities: only when a law or a competent authority's order requires it.

Data we receive from Google. Arena's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use that data only to hide, on the website, the times when a teacher is busy. We do not sell it, use it for advertising or to train models, or transfer it to third parties unless the law requires it. Website visitors only see free times, never the contents of a calendar.

5. International transfers

Our teachers are in Nicaragua, but our database is hosted by Supabase in the United States and some providers process data in other countries. By using the service and accepting this policy you consent to these transfers, which are necessary to give you lessons. We choose providers with security measures and contractual data-protection commitments. If you disagree, write to us and we will look for an alternative or close your account.

6. How long we keep it

  • Account and learning records: while your account is active and for up to 2 years after your last activity. Then we delete or anonymize them.
  • Deactivated accounts: can no longer sign in or submit work; the history is kept for that same period, or deleted sooner if you ask.
  • Level-test contacts: 24 months from the test, or less if you ask.
  • Payment records: as long as Nicaraguan tax and commercial law requires.
  • Google Calendar connection: until the teacher disconnects it or their account is deleted. On disconnect we revoke the permission at Google and delete the token.
  • Backups: removed in the provider's normal cycles.

7. Your rights

As the owner of your personal data you have the right to:

  • Access: know what data we hold about you and receive a copy.
  • Rectification and update: correct data that is wrong or incomplete.
  • Cancellation (erasure): ask us to delete your data, except what the law requires us to keep.
  • Objection: object to certain uses of your data.
  • Withdraw your consent at any time, without affecting what was done before.
  • Restriction and portability: ask us to restrict a use, or receive your data in a common, machine-readable format.
  • Not be treated worse for using these rights.

How to use them. Email from the address linked to your account with the subject "Privacy request" and tell us what you need. We may ask you to confirm who you are. It is free. We will reply as soon as possible and no later than 30 days.

Deactivating or deleting. We can deactivate your account (history kept) or delete it completely, with its records, if you ask.

If you are not satisfied. You can complain to Nicaragua's Personal Data Protection Directorate (DIPRODAP), or to the data protection authority in your country of residence.

8. Minors

In Nicaragua, anyone under 18 is a minor. Lessons for minors are arranged only by their mother, father or guardian, who consents to the processing of the minor's data and can ask at any time to see, correct or delete it. We do not knowingly collect data from minors without that consent; if we learn it happened, we delete it.

9. Security

Connections to the site are encrypted (HTTPS). In the database each student can see only their own records, each teacher only their students' records, and administrative access is restricted. Files uploaded by teachers are private and open through temporary links, and Google Calendar permissions are stored encrypted in a space the browser cannot access. Sign-in uses one-time links or protected passwords, with controls against automated abuse. No system is completely secure; if an incident significantly affects your data, we will tell you.

10. Cookies and local storage

We do not use advertising or tracking cookies. We keep in your browser only what is needed: your session, language and theme. Today we do not use analytics tools; if we ever turn them on, we will do it only with your consent and update this page. Embedded third-party videos or calendars may set their own cookies when you use them. You can clear the site's data in your browser settings.

11. Changes to this policy

When we change it, we update the date above. If a change is significant, we will tell account holders by email. Changes do not apply retroactively to what you already accepted.

12. Contact

Questions or privacy requests: . See also our Terms of Service.