Privacy policy

1. Who is the controller

Lepton, S.L. (tax ID B25379025, Joan Fuster, 6 Baixos - 25001 - Lleida, enric@lepton.net).

We have not appointed a data protection officer. For any question or to exercise your rights, write to enric@lepton.net.

2. Who this is for

People over 18 who request access, have an account, or contact us through the website. The platform is not aimed at minors.

3. What data we process and where it comes from

• What you give us when you register or write to us: full name, username, email, phone (if you give one), password (always stored encrypted, never in plain text), how you found the platform and the message you write.
• What your use of the service generates: which lessons you watch and how far you get, your favourites and comments, and, if you use the member tools, your sponsor and mentor, your level and join date.
• If you choose to enter them in “My account” (optional): the expiry date of your ID card (DNI / NIF) and of your driving licence, and whether you want an email reminder 15 or 30 days before; your date of birth and up to two more dates with a name of your choice. We only keep the date: never the number or a copy of the document.
• Usage statistics: when you sign in, which pages and screens you open and how often, device type, browser and system, and approximate country, region and city (as provided by the hosting provider). We do not store your IP address.
• Visits to the public pages (before signing in): which pages are opened, where the visit comes from, device type, browser and system, and approximate country. No cookies, no IP address and no way of knowing who you are: just an anonymous code that changes every day, so you cannot be followed from one day to the next. Kept for 13 months.
• We do not process specially protected data (such as health data) and ask you not to write it in comments, messages or notes.

4. What we use it for, on what legal basis and for how long

• Managing your account and giving you access to the training and the tools you have switched on. Basis: performance of the service you requested (Art. 6.1.b GDPR). Period: while you have the account; if you leave, 30 days for you to export your data and then it is deleted, except what the law requires us to keep.
• Reviewing and approving your registration request and organising the member network (who sponsors or mentors whom). Basis: pre-contractual steps at your request and performance of the service (Art. 6.1.b). Period: the same as the account; if a request is rejected, up to 12 months.
• Replying to the messages and requests you send us. Basis: your request (Art. 6.1.b). Period: the time needed to help you and, afterwards, the limitation period for possible liabilities.
• Understanding how the platform is used, detecting faults and deciding what to improve. Basis: the controller’s legitimate interest (Art. 6.1.f), assessed and limited to minimal data, without your IP and without following you outside the platform; you can object at any time. Period: the detail of each visit, 90 days; the usage summary, while you have an account.
• Maintaining security and a log of changes made on the platform. Basis: legitimate interest and the security obligation (Arts. 6.1.f and 32 GDPR). Period: 12 months.
• Keeping your personal dates for you and reminding you by email that your ID card (DNI / NIF) or driving licence is about to expire, only if you enter the date and ask for the reminder. Basis: your consent (Art. 6.1.a GDPR), which you can withdraw at any time by deleting the date or choosing “No, thanks” in “My account”. Retention: until you delete it or close your account.
• Sending you service notices and, if you are a user or have had a relationship with us, news from Lepton related to what you already know. Basis: prior relationship and legitimate interest (Art. 21.2 LSSI and Art. 6.1.f GDPR). Every email includes a link to unsubscribe or choose what to receive, and we do not write to anyone who has unsubscribed. Period: until you unsubscribe.

5. Who can see your data

• The platform administrator, to provide support, maintain security and comply with the law. They cannot see the personal dates you enter in “My account” (document expiry, date of birth and your own dates): they are yours alone and the system only uses them to send you the reminder you ask for.
• Your sponsor and your mentor see only the minimum: your name, photo, level, join date and status. Your phone and email are visible only to your direct sponsor and mentor and the members you have directly below you. They never see your individual visits, your contacts or your sales.
• Providers that supply the technical service (hosting, database, file storage and email) as data processors, under contract and unable to use your data for other purposes: Vercel Inc., Neon Inc., Cloudflare Inc. and Lepton’s mail server.
• Public authorities, judges and courts when a law requires it. We do not sell or pass your data to third parties for their own purposes.

6. Transfers outside the European Union

Data is hosted on servers in the European Union (Frankfurt). Some providers are companies headquartered in the US (Vercel, Neon, Cloudflare), so access from outside the EU may occur for operation and support. They rely on GDPR safeguards: the adequacy decision of the EU-US Data Privacy Framework or standard contractual clauses, depending on the provider.

7. Am I obliged to give my data?

Fields marked as required are needed to create your account or reply to you; without them we cannot provide the service. The rest is optional. We do not take automated decisions or build profiles that have legal effects on you.

8. Your rights

You can ask us to access your data, correct it, delete it, restrict its processing, object to it, receive it in a format you can take with you (portability), and withdraw at any time any consent you have given, without affecting what was processed before. Write to enric@lepton.net saying which right you are exercising; if there are reasonable doubts about your identity, we may ask you to prove it. We reply within one month at most (extendable by two more if the request is complex, and we will tell you).

If you believe we are not handling your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid), without prejudice to contacting us first.

9. How we protect your data

Encrypted connection (HTTPS), passwords stored with irreversible encryption, lockout after failed attempts, protected session, role-based access, isolation between members, a log of changes and protected backups. If a security breach affected you with a risk to your rights, we would tell you and notify the authority within the legal deadline (72 hours).

10. Changes to this policy

If we change something important, we will tell you on the platform. This is version 2026-10-08.