Privacy policy

EduRails is provided by 3XA ECOM LLC, a company established in the United States (registered address: 407 Lincoln Rd STE 708, Miami Beach, FL 33139, USA). Privacy contact: privacy@edurails.com. We have not appointed a representative in the European Union (Art. 27 GDPR): for any privacy matter, write to us directly at privacy@edurails.com.

If you use EduRails because your training centre, academy or company (your "organisation") signed you up, the organisation is the controller of your data and decides what it is used for; we process it on its behalf, following its instructions and a data processing agreement. To exercise your rights you can contact your organisation or us, and we will pass the request on.

We are the direct controller when you sign up on your own without an organisation, when you take part in the Valfiguer STEP internship programme, when you visit our public website and for the security of the platform.

Account data: name, email, language, role and organisation and, if you sign in with Google or GitHub, the identifier that provider gives you. We do not use passwords to sign in: we email you a one-time code or you use your Google or GitHub account. We do not store the photo of your Google or GitHub account: your picture in EduRails is a drawn avatar that you customise. We do not ask for your date of birth: only that you confirm you are 18 or over, and we keep that confirmation with the date and the version of the terms you accepted. By continuing on your first sign-in you also accept the terms of use and this policy: we keep the version of each, the date and a pseudonymised fingerprint of your IP address as proof of that acceptance, and if either changes we will ask you to accept it again.

Learning data: courses you are enrolled in, progress, answers, quiz and exam results, certificates and your personal notes.

If your organisation enables them: points, levels, badges and leaderboards (gamification), social activity (duels, feed, ratings) and conversations with the AI tutor.

Technical security data: IP address, browser and sign-in attempts. We do not keep passwords, tokens or the content of your messages in technical logs.

To give you access to courses, record your progress, issue certificates and notify you about your learning. If you come through an organisation, the legal basis is your organisation's (for example, a training centre's educational function or a company's training contract). If you sign up on your own, it is the performance of the terms of use.

To keep the platform secure and prevent abuse, based on our legitimate interest in protecting the service and its users.

To measure the use of our public website, only if you accept analytics cookies. Inside the platform we use no third-party analytics or advertising.

We do not sell your data, we do not use it for advertising and we do not make automated decisions with legal effects about you.

EduRails is not intended for minors and we do not knowingly process data about minors. To use the platform you must be 18 or over and confirm it when you sign up, whether you sign in with a code, with Google or GitHub, through an invitation from your organisation or with your company sign-in.

Organisations undertake not to sign up minors. If we find out that an account belongs to a minor, we will deactivate it and delete its data; if you think that is the case, write to privacy@edurails.com.

Your organisation's leaderboards show your name and your avatar; if you prefer not to appear, you can hide yourself from your settings.

The AI tutor is not available yet. When it is, and only if your organisation enables it, the questions you ask it will be sent to an artificial-intelligence provider to generate the answer. We will not send your name or email, we will mask contact details you type, and the provider will not be able to use those conversations to train its models. Even so, do not type personal data into the chat.

We will keep conversations encrypted for 90 days and then delete them. Your organisation will be able to switch the tutor off at any time.

With your organisation (teachers and administrators of your organisation) and with nobody from other organisations.

With the providers that help us run the service (sub-processors), under contract and with safeguards: Hetzner (servers in Germany, inside the European Union, where the platform data is stored), Resend (sending and receiving email, United States), Anthropic (AI tutor, only if enabled, United States) and, only if you choose to sign in with them, Google or GitHub for sign-in (United States). The complete, up-to-date list is available on request at privacy@edurails.com and will be published on this website.

International transfers: the data is stored in the European Union, but 3XA ECOM LLC is in the United States, as are Resend, Anthropic, Google and GitHub, so there are transfers of data outside the European Economic Area. With providers we rely, depending on the case, on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses; when we process data on behalf of your organisation, the data processing agreement with it includes those clauses. You can ask for information about these safeguards at privacy@edurails.com.

If someone checks a certificate with its code, they will see your name, the course, the date and who issued it. Nothing else.

Your account and learning data, for as long as you have an account or as your organisation decides. If you ask to leave, you have 30 days to change your mind; after that we delete the account.

Shorter periods for technical data: expired sign-in codes, 1 day; sign-in attempts, 90 days; log of notifications sent, 180 days; AI tutor conversations, 90 days; exports of your data, 7 days; audit log of actions on the platform (without your email and with your IP pseudonymised), 12 months. Backups: we do not take scheduled backups; before each platform update we keep a dump of the database in case we need to roll back, and we keep at most the last five (each new update deletes the oldest).

Certificates keep their code so you can keep proving them. If you delete your account, they can still be verified with their code, but verification will only show your initials, unless you ask to keep your name. If you ask for them to be deleted, they are revoked and verification no longer shows your name.

You can ask to access, rectify, erase or take away (portability) your data, restrict or object to its use, and withdraw consent at any time. Write to privacy@edurails.com or, if you come through an organisation, to it.

If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the data protection authority of the EU country where you live or work.

We isolate each organisation's data, encrypt communications, protect sessions with secure cookies, limit who has access and have a procedure to notify your organisation within 48 hours if an incident affects its data.

Every version is dated. If a change is significant, we will tell you inside the platform before it takes effect and, where needed, ask you to accept it again.