Privacy policy

Controller

[TITULAR], owner of Acotario

Purposes

Providing the service (account, projects and exports), sending account emails, handling your feedback, protecting the service, compiling our own cookieless usage statistics and, if you subscribe, sending you the newsletter and the alerts you choose.

Legal bases

Performance of the contract (the terms of use), legitimate interest in keeping the service secure, and your consent for the newsletter.

Recipients

The providers that host and run the service on our behalf. We do not sell data or share it for advertising.

Your rights

Access, rectification, erasure, objection, restriction and portability. You can delete your account from Account.

Controller

[TITULAR]

Tax ID (NIF/CIF)

[NIF/CIF]

Address

[DOMICILIO]

Email

[EMAIL]

We have not appointed a data protection officer because we are not required to. For any privacy question, write to [EMAIL].

• Account data: your email address, your name if you give it, your preferred language and your password, which we store as a hash and never in readable form. If you sign in with Google, Google shares your name, your email address and, if you have one, your profile picture.
• Your project content: projects, spaces, saved sheets with their values, notes and each project’s user profile (stature, age group, wheelchair use and handedness).
• Technical and security data: the IP address and browser linked to each session, server logs (date, page requested, errors) and anti-abuse counters that store the IP address in pseudonymised form.
• Usage statistics: product usage events — for example, that a sheet was opened or exported or that a search found nothing — with the page, language, sheet and date. Visitors without an account are counted with a pseudonymous code that changes every day (a hash of the IP address and browser with a random key that is replaced every 24 hours and never stored), so visits on different days can't be linked; we do not store your IP address or your browser. Events that describe your own account's actions (creating a project, saving a sheet) are linked to it. We use no cookies or browser storage for this, and if your browser sends the Global Privacy Control or Do Not Track signal we record nothing.
• Newsletter and alerts: if you subscribe, your email address, language, what you want to receive (newsletter and/or new-sheet alerts), proof of your consent — the form, the version of the wording you accepted, date and time, and when you confirmed it from the email — and a delivery log (date and technical result of each send). We use no tracking pixels: we can't tell whether you open our emails or which links you click.
• Feedback you send through “Send feedback”: the type and text of the message, a reply email if you give one and, only if you tick “Attach the page and parameters”, your account, the page you write from, the sheet’s values and technical browser data (language, theme, units, screen size and browser).
• Communications: whatever you tell us when you write to us.

If you use the library without an account, your preferences (language, units, theme and user profile) stay in your browser: we neither receive them nor link them to you. The details are in the cookie policy.

A project’s user profile describes the people you design for — for example, “adult, 1.70 m, wheelchair user” — and is only used to compute the sheets. It does not need to identify anyone: please do not put details that identify other people, or information about their health, in names, notes or descriptions.

You must be at least 14 years old to create an account (article 7 of Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights, LOPDGDD).

We do not build marketing profiles or make automated decisions with legal effects on you. We do not sell your data, and the application uses no advertising tools or ad trackers.

If we offer a paid plan in the future, we will also process the billing data it requires, on the basis of the contract and our tax obligations, and we will explain it here before it goes live.

Only the providers we need to run the service. They act as processors, on our behalf and following our instructions, under a contract that includes the safeguards of article 28 GDPR:

If you choose “Continue with Google”, Google verifies your identity and shares your name, email address and profile picture with us. For that processing Google acts as an independent controller under its own privacy policy.

Other than that, we only disclose data to authorities and courts when the law requires us to.

Some providers are based in the United States or may access data from there. Those transfers rely on the standard contractual clauses approved by the European Commission and, where the provider participates, on the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023), with supplementary measures where appropriate. You can ask us for a copy of these safeguards at [EMAIL].

• Account and projects: for as long as you keep your account. If you delete it, we erase them from the database straight away; backups are overwritten within 30 days at most.
• Sessions: expire after 30 days without use.
• Server logs and anti-abuse counters: only as long as their purpose requires, 30 days at most.
• Usage statistics: events are deleted automatically after 13 months; the aggregated totals computed from them identify no one.
• Newsletter and alerts: until you unsubscribe or withdraw your consent. If you never confirm the subscription, we delete the address 30 days after sending you the confirmation email. After you unsubscribe we keep only the address, the unsubscribe date and the proof of consent, blocked, for 3 years so we can show we respected your choice; then they are deleted.
• Emails and feedback you send us: as long as we need to deal with them and improve the service. If you delete your account, your feedback is no longer linked to it; you can ask us to delete it.

If the law requires us to keep any data, or we need it to handle or defend claims, we will keep it blocked, with restricted access, for the applicable limitation periods (article 32 LOPDGDD).

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw your consent without affecting the lawfulness of earlier processing.

• From Account you can review and correct your profile details and delete your account, together with all your projects, spaces and saved sheets.
• To unsubscribe from the newsletter, use the “Unsubscribe in one click” link in every email (your email app may also show an “Unsubscribe” button); if you have an account, also from Account → Notifications. Unsubscribing takes effect immediately.
• For any other right, write to [EMAIL] from your account’s email address and tell us which right you want to exercise. If we have reasonable doubts about your identity, we may ask for additional information.

We will reply within one month; for complex requests this may be extended by two further months, and we will let you know.

If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es), C/ Jorge Juan 6, 28001 Madrid, Spain, or with the supervisory authority of your country of residence in the European Union.

We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), hashed passwords, secure session cookies, limits on sign-in attempts, restricted access to our systems and providers that offer sufficient guarantees.

If a security breach affected your data, we would notify the supervisory authority and, where required, you, as articles 33 and 34 GDPR require.

We may update this policy to reflect changes in the service or in the law. If a change is significant, we will let you know by email or in the application before it applies. The date of the last update is shown at the top of this page.

History: 17 October 2026 — newsletter with double opt-in (proof of consent, one-click unsubscribe, Resend as processor) and our own cookieless usage statistics.