Privacy Policy
Last updated: 7 November 2026
Who is responsible for your data
The data controller is:
- Owner
- Nerea Carrión Sanchis, trading as Unfold in Love
- Tax ID (NIF)
- 44524502K
- Address
- Calle Lo Rat Penat 9, piso 5, puerta 21, 46023 Valencia, Spain
- welcome@unfoldinlove.com
- Other contact
- The contact form on this website, or WhatsApp
For any question about your data or to use your rights, write to welcome@unfoldinlove.com.
What we collect and why
When you write to us through the contact form
Your name, email and message, to answer you. Legal basis: the steps you ask us to take (Art. 6(1)(b) GDPR) and your consent when you send the form. We delete messages automatically two years after they were sent.
When you buy the course
Your name, email, country and the billing details you enter on the payment page, and the order and payment status. We never see or store your card details: the payment is handled by Stripe. We use this data to give you access to the course, send you your login emails, handle refunds and keep our accounting records. Legal basis: the contract (Art. 6(1)(b) GDPR) and our tax and accounting obligations (Art. 6(1)(c) GDPR). Billing records are kept for as long as Spanish tax and commercial law requires, generally six years.
When you use the student area
Your email, when you log in, which lessons you have completed and which PDFs you have downloaded. This lets us give you access, show your progress, help you if something does not work and protect the course against shared accounts. Legal basis: the contract and our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR). Your account is kept while you have access to the course. You can ask us to delete it at any time; your course access then ends.
When you book a session
Your name, email, the time you book and anything you write in the booking form, to organise and hold the session. Legal basis: the contract. Bookings are handled by Cal.com, with the calendar and video call tool shown in your confirmation.
When you message us on WhatsApp
Your phone number and messages, to answer you. WhatsApp is run by WhatsApp Ireland Limited (Meta) under its own privacy policy.
Technical data
Like every website, our hosting providers keep short-term technical logs (IP address, browser, time of the request) to run the website and protect it against attacks. Legal basis: legitimate interest.
We do not sell your data, we do not use it for advertising and we do not send newsletters unless you have asked to receive them.
Who processes your data for us
These providers process data only on our instructions, to run the service:
- Vercel (USA): website hosting, with our server functions running in Frankfurt.
- Supabase (USA): student accounts, course data and PDF files, stored in Frankfurt (EU).
- Bunny.net (BunnyWay d.o.o., Slovenia, EU): course video streaming.
- Resend (USA): sending login and confirmation emails.
- Cal.com (USA): session bookings.
- GitHub (USA): encrypted database backups.
Stripe (Stripe Payments Europe Ltd., Ireland) processes payments as an independent controller under its own privacy policy.
Where a provider is based outside the European Economic Area, data is transferred under the EU–US Data Privacy Framework, if the provider is certified, or the European Commission's Standard Contractual Clauses.
Your rights
You can ask for access to your data, its correction or deletion, to restrict or object to its use and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to welcome@unfoldinlove.com. If you think we have not handled your data correctly, you can complain to the Spanish Data Protection Agency (aepd.es).
Security
Data is sent over encrypted connections. Course files are private and opened only through links that expire after a short time. Backups are encrypted.
Age
Our services are for adults aged 18 and over.
Changes
If we change this policy, we publish the new version on this page with its date.