Privacy policy
Last updated: September 2026
1. Data controller
The controller responsible for processing the personal data collected at stair-tfg.me is Alejandro Varela Vázquez, in the context of an academic project (Final Degree Project, UDC). Contact: avarela@stair-tfg.me.
2. Data collected
When creating an account, the email address and a password are collected; the password is stored encrypted (hashed) and never in plain text, along with the account creation date and the email verification status. Providing the email address and password is required to register: without them it is not possible to create the account. During use of the service, the following are also processed: technical data for each session (dates and browser user agent), single-use codes for email verification and password recovery, which are stored encrypted, and failed login attempts, which are logged using an identifier cryptographically derived from the email address, never the email address in plain text. No other personal data (name, address, payment details, etc.) is requested.
3. Purpose of processing
The data is used exclusively to create and manage the user account, keep the session active (via an in-memory access token and a technical httpOnly session-refresh cookie), grant access to features such as training or simulating models, send the emails required for the service (verification codes, password-recovery codes, and security notices about the account), and protect the platform against abuse and unauthorized access. No commercial communications are sent.
4. Legal basis
The processing necessary to create and manage the account, keep the session active, grant access to the features and send the service's own emails is based on the performance of the Terms of use that the user accepts upon registering (Art. 6.1.b GDPR). The security measures — the anti-abuse verification on the forms, the limit on failed login attempts, and the notice sent to the account holder when someone attempts to register an email that already has an account — are based on the controller's legitimate interest in protecting the platform and its users' accounts (Art. 6.1.f GDPR). The user may object to this processing by writing to avarela@stair-tfg.me.
5. Cookies
STAIR uses two cookies, both technical and necessary for the site to function, and therefore exempt from the requirement to request prior consent: NEXT_LOCALE, which is set on any visit — even without being logged in — to remember the chosen language (Path=/, SameSite=Lax, no HttpOnly); and refresh_token, which is only set when logging in, to renew the session without asking for the credentials again (HttpOnly, Secure, SameSite=Lax, Path=/api/v1/auth, 7-day expiry). No analytics, advertising or third-party tracking cookies are used.
6. Data retention
Account and session data is retained for as long as the account remains active and is deleted together with it. Verification and recovery codes stop being valid 30 and 10 minutes after being issued, respectively, and failed login attempt records are deleted after 24 hours. The user may request deletion of their account and associated data at any time by writing to avarela@stair-tfg.me.
7. Disclosure to third parties
Personal data is not disclosed or sold to third parties. As this is a non-commercial academic project, there are no data transfers for advertising or monetization purposes.
8. Data processors
The following processors are used to provide the service, processing data on behalf of the controller: Hetzner Online GmbH (Germany), which hosts the server and the database in a data center located in Finland; Vercel Inc. (USA), which hosts the website, routes the application's requests to the server — including registration and login requests — and provides Vercel Analytics, which does not use cookies or persistent identifiers and only collects aggregated, anonymous usage statistics; Cloudflare, Inc. (USA), which protects and routes traffic to the server and provides Cloudflare Turnstile, the anti-abuse verification for the registration, login, password-recovery and email-verification forms, which processes the IP address and browser signals for the sole purpose of distinguishing humans from bots, and not for advertising purposes; and Brevo (France), which sends the service's emails. Vercel and Cloudflare may process data in the United States; those transfers are covered by their adherence to the EU-U.S. Data Privacy Framework.
9. User rights
The user may exercise their rights of access, rectification, erasure, objection, restriction of processing and portability by writing to avarela@stair-tfg.me, stating the right they wish to exercise.
10. Right to lodge a complaint with the supervisory authority
If you believe that the processing of your personal data does not comply with applicable regulations, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, or through its electronic office at www.aepd.es.
11. Security
Passwords are stored encrypted and access to data is restricted. No system is completely immune to security incidents; if unauthorized access is suspected, it is recommended to change the password and contact the controller.