Privacy policy

1. Who handles your data

The data controller is Santi Prats Moreu (NIF 46152987Z), trading as Alpine Pal. You can reach us at info@alpinepal.com about anything to do with your data, including exercising your rights.

2. What data we handle

• Your account: name, email, profile photo and preferred language.
• Your instructor profile, if you apply: biography, resorts, languages, disciplines, rates, availability and your qualification details (licence number, issuing body, dates) plus the supporting document if you upload one.
• Your bookings: resort, date, duration, number of students, each student's name, age and level, including minors, your contact phone, message to the instructor and amount; and, if you rent equipment with the lesson, what each student takes, with the shoe size and height you give so it can be prepared.
• If you book for other people: give us their details only if you may do so; a minor's, only if you are their parent or guardian or have their permission.
• Your conversations: the messages you send through the platform chat.
• What you ask the AI assistant: what you write to it and the page you are on. It is not stored on our systems.
• Your payments: the Stripe transaction identifiers and their status. Your card details never reach us.
• Your browsing: if you accept, usage statistics, anonymised session recordings, heatmaps and which ad or search brought you here.
• If you connect Google Calendar: your Google account's email address, an identifier for that account and the permission you give us to create an "Alpine Pal" calendar in it and write your lessons there (stored encrypted). That permission does not let us see or change your other calendars or events. If you also turn on "Block the hours I'm busy" (instructors only), you give us permission to see when your main calendar is busy: the start and end of each busy stretch, never the title, place, guests or anything else about your events.
• If you arrive through one of our sales partners' links and sign up as a school or an instructor: which partner brought you. Only Alpine Pal's administrators see it.
• If you are paid through Alpine Pal as an instructor or a school: your name or company name, tax number, VAT number and tax address, to issue the invoice for our commission and meet our tax obligations. They are not shown on your profile. If you have earned anything, we keep them with your invoices; if not, we delete them when you close your account.

3. What we use it for, and on what legal basis

We do not sell your data and we make no automated decisions that significantly affect you. If you accept advertising, Google may use your browsing of this site to measure our ads and personalise the ones it shows you; if you do not, nothing is stored on your device and nothing is personalised.

• Providing the service: creating your account, handling bookings, payments and messages. Basis: performance of the contract.
• Verifying instructors: checking their qualification before their profile goes live; their identity is verified by Stripe when they set up their payouts. Basis: legitimate interest in a trustworthy, safe platform, and compliance with legal obligations.
• Telling you what affects you: requests, confirmations, time changes and refunds. Basis: performance of the contract.
• Invoicing and tax obligations. Basis: legal obligation.
• Fraud prevention and platform security. Basis: legitimate interest.
• Answering what you ask the website's AI assistant. Basis: legitimate interest in helping whoever asks us.
• Usage analytics with Microsoft Clarity and Google Analytics. Basis: your consent, which you can withdraw at any time.
• Measuring and personalising our advertising with Google Ads: knowing which ad ended in a booking, and showing you ours again. Basis: your consent, which you can withdraw at any time.
• Putting your lessons in your Google Calendar, if you connect it: creating the "Alpine Pal" calendar and adding, moving or removing each lesson in it. Basis: your consent, which you withdraw by disconnecting it from your profile or from your Google account. If you turn on "Block the hours I'm busy": reading every few minutes, and at the moment of each booking, when you are busy in your main calendar, so those hours cannot be booked. Basis: your consent, which you withdraw by turning it off in your profile.
• Knowing which sign-ups each of our sales partners brings, to pay them what we agreed. Basis: legitimate interest. The link is only remembered on your device if you accept advertising, as the cookie policy explains.

4. Who else sees it

For the platform to work we use providers that process data on our behalf:

• Clerk — sign-up and sign-in.
• Stripe — payments, refunds and identity verification for instructors receiving money. Stripe acts as an independent controller for what payments regulation requires of it.
• Cloudflare — hosting, database and file storage.
• Resend — sending the service emails.
• DeepL — translates the biography on your instructor profile and your school's description into the site's other languages when they are saved.
• Anthropic — generates the AI assistant's answers, only if you use it. It does not use these conversations to train its models.
• Microsoft Clarity — usage analytics, only if you accept it.
• Google — Google Analytics to measure the site and Google Ads to measure and personalise our advertising, only if you accept it.

If you book a lesson from a ski school — with one of its instructors or without a named instructor — the school sees that booking from its panel and may also receive it in the systems it connects to our API (its management software, say). What reaches those systems is your short name (first name and the initial of your surname), your preferred language, the booking message and, if you rent equipment, what each student takes with their shoe size and height; never your email, your phone number or your account id.

If a school adds your instructor profile before you have an account, the data on that profile (name, gender, photo, biography, resorts, disciplines, languages, specialties, years of experience, rates and qualification, with its licence number, which is not published) is provided to us by the school, which declares it has your consent to publish it; we keep who made that declaration and when. If the school sends you the link to claim it, we also keep the email address it was sent to. Until you claim it, the school reads and answers that profile's messages and notices. You can ask us at any time to correct it or take it off the site, or ask the school for the link to claim it and run it yourself.

If you connect Google Calendar, we send Google the details of each lesson that goes in your "Alpine Pal" calendar: date, time, resort, meeting point, level and number of students, the customer's short name and the link to the booking. A school's calendar also shows the instructor's name. If you turn on "Block the hours I'm busy", all we receive from Google is when you are busy in your main calendar. We use what we receive from Google only for this: we do not sell it, use it for advertising or share it with anyone. Alpine Pal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. What other people on the platform see

Your instructor profile is public: name, photo, biography, resorts, languages, rates and reviews. Qualifications are shown stating whether we have verified them or whether they are your own declaration.

Once there is a booking, instructor and customer see each other's name and photo along with the lesson details. The document you upload to evidence your qualification is seen by nobody but you and whoever reviews it. The instructor and the school of that booking also see the students' names and ages and your phone, to prepare the lesson and reach you; if the school uses a booking system connected to Alpine Pal, they reach it there too.

If you sign up with another instructor's referral code, we tell them that you signed up with it and whether you have given your first lesson — never your amounts or payout details.

6. Leaving the European Economic Area

Some of these providers are in the United States. Those transfers rely on the standard contractual clauses approved by the European Commission or on the applicable adequacy framework, with any additional safeguards required.

7. How long we keep it

• Account and profile data: while the account is active, and a reasonable time after in case you reactivate it or a claim arises.
• Bookings and payments: six years, as Spanish commercial and tax rules require.
• Chat messages: while the account is active, in case what was agreed has to be reviewed against a claim.
• Qualification documents: kept while the profile is live, and afterwards for as long as we may need to evidence the check. They are the proof the verification happened. Only the instructor and whoever reviews them can open them.
• Backups: every week we keep a copy of the database in private storage, so it can be recovered if something fails. Each copy is kept for 90 days and then deleted automatically, so whatever we delete from the site (when an account is closed, for example) is also gone from the backups within that time.
• Analytics and advertising data: the retention of Microsoft Clarity, Google Analytics and Google Ads, detailed in the cookie policy.
• Conversations with the AI assistant: we do not keep them. They stay in your browser until you reload the page, and Anthropic keeps them for the limited time its terms set. Of your IP address we only keep a count of messages to limit use, deleted within a day.
• Google Calendar connection: for as long as it is connected. When you disconnect it or close your account, we give the permission back to Google and delete the connection; the "Alpine Pal" calendar stays in your Google account with what it had, unless you ask us to delete it when disconnecting. The busy hours we read are kept only as blocked hours on your Alpine Pal calendar: replaced on every read, gone once the day is over, and all deleted when you turn it off or disconnect.

8. Your rights

You can ask us to give you access to your data, correct it, delete it, restrict or object to its processing, and take it to another service. Write to info@alpinepal.com and we will answer within the legal one-month period.

If you think we have got it wrong, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to your country's supervisory authority.

Where processing relies on your consent — the analytics and the advertising — withdrawing it is as easy as giving it, from the cookie policy.

9. Minors

The platform is not aimed at minors. A minor can take lessons, but the account and the booking are made by an adult responsible for them.

10. Security

All traffic is encrypted. Passwords are held by our identity provider; we never see them. Card details stay with Stripe. Qualification documents are kept in private storage, out of reach of any public URL, and can only be opened by their owner or by whoever reviews them.

No system is infallible. Should a breach affect your data, we will tell you and notify the authority as the law requires.

11. Cookies

Cookies have their own page, with the detail of each one and the control to change your choice.

12. Changes

If this policy changes significantly, we will tell you by email or on the site before it takes effect.

13. Language of this policy

This policy is published in Spanish, English, Italian, French, German, Polish, Dutch and Russian. Where the versions differ, the Spanish version prevails, being the original.