Privacy policy

1. Who handles your data

Alpine Pal is the data controller. You can reach us at info@alpinepal.com about anything to do with your data, including exercising your rights.

2. What data we handle

• Your account: name, email, profile photo and preferred language.
• Your instructor profile, if you apply: biography, resorts, languages, disciplines, rates, availability and your qualification details (licence number, issuing body, dates) plus the supporting document if you upload one.
• Your bookings: resort, date, duration, number of students, message to the instructor and amount.
• Your conversations: the messages you send through the platform chat.
• Your payments: the Stripe transaction identifiers and their status. Your card details never reach us.
• Your browsing: if you accept analytics, anonymised session recordings and heatmaps.

3. What we use it for, and on what legal basis

We do not sell your data, we do not build advertising profiles, and we make no automated decisions that significantly affect you.

• Providing the service: creating your account, handling bookings, payments and messages. Basis: performance of the contract.
• Verifying instructors: checking qualification, identity and insurance before a profile goes live. Basis: legitimate interest in a trustworthy, safe platform, and compliance with legal obligations.
• Telling you what affects you: requests, confirmations, time changes and refunds. Basis: performance of the contract.
• Invoicing and tax obligations. Basis: legal obligation.
• Fraud prevention and platform security. Basis: legitimate interest.
• Usage analytics with Microsoft Clarity. Basis: your consent, which you can withdraw at any time.

4. Who else sees it

For the platform to work we use providers that process data on our behalf:

• Clerk — sign-up and sign-in.
• Stripe — payments, refunds and identity verification for instructors receiving money. Stripe acts as an independent controller for what payments regulation requires of it.
• Cloudflare — hosting, database and file storage.
• Resend — sending the service emails.
• Microsoft Clarity — usage analytics, only if you accept it.

5. What other people on the platform see

Your instructor profile is public: name, photo, biography, resorts, languages, rates and reviews. Qualifications are shown stating whether we have verified them or whether they are your own declaration.

Once there is a booking, instructor and customer see each other's name and photo along with the lesson details. The document you upload to evidence your qualification is seen by nobody but you and whoever reviews it.

6. Leaving the European Economic Area

Some of these providers are in the United States. Those transfers rely on the standard contractual clauses approved by the European Commission or on the applicable adequacy framework, with any additional safeguards required.

7. How long we keep it

• Account and profile data: while the account is active, and a reasonable time after in case you reactivate it or a claim arises.
• Bookings and payments: six years, as Spanish commercial and tax rules require.
• Chat messages: while the account is active, in case what was agreed has to be reviewed against a claim.
• Qualification documents: deleted as soon as the review is complete. We keep the licence number and the date it was checked, not the document.
• Analytics data: Microsoft Clarity's own retention, detailed in the cookie policy.

8. Your rights

You can ask us to give you access to your data, correct it, delete it, restrict or object to its processing, and take it to another service. Write to info@alpinepal.com and we will answer within the legal one-month period.

If you think we have got it wrong, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to your country's supervisory authority.

Where processing relies on your consent — the analytics — withdrawing it is as easy as giving it, from the cookie policy.

9. Minors

The platform is not aimed at minors. A minor can take lessons, but the account and the booking are made by an adult responsible for them.

10. Security

All traffic is encrypted. Passwords are held by our identity provider; we never see them. Card details stay with Stripe. Qualification documents are kept in private storage, out of reach of any public URL, and can only be opened by their owner or by whoever reviews them.

No system is infallible. Should a breach affect your data, we will tell you and notify the authority as the law requires.

11. Cookies

Cookies have their own page, with the detail of each one and the control to change your choice.

12. Changes

If this policy changes significantly, we will tell you by email or on the site before it takes effect.