Privacy policy

1. Who the controller is

X MAXIMUS LABS, S.L., a Spanish company based in Madrid.
Contact email: info@xmax.es
Tax ID: B93990026
Address: Calle Moratín 4 · 28014 Madrid, Spain.

2. This website (xmax.es)

We use no cookies. There are no first-party or third-party cookies, no analytics, no tracking pixels and no advertising. That is why you will not see a cookie banner here: there is nothing to consent to.

The site is hosted by Vercel Inc. (United States), acting as our processor. Like any web server, its infrastructure keeps technical records of the requests it receives — IP address, date and time, requested address, browser type — in order to serve the pages, detect abuse and keep the service running. Those records are not combined with any other information, are not used to profile anyone, and are kept for the short period the provider itself sets.

The legal basis is our legitimate interest in operating and protecting the site (Art. 6(1)(f) GDPR). Transfers to the United States rely on the European Commission’s standard contractual clauses.

The domain is registered through Arsys Internet, S.L.U. (Spain). DNS and forwarding of the domain email are provided by Cloudflare, Inc. (United States), and the email you send us is read in a Google (Gmail) mailbox. Transfers to the United States rely on the European Commission’s standard contractual clauses.

3. The apps

The apps we publish on the App Store and Google Play collect no personal data. There are no accounts, no sign-up and no analytics.

Where your progress is stored

Your answers, saved mistakes, starred questions, mock history and chosen exam date are stored only in your device’s local storage. They never leave it, they are not sent to any server, and we cannot see them. You can erase everything under Settings → Erase my progress, and uninstalling the app removes it with the app.

Question bank and network

The question bank ships inside the app, and the app works fully offline. When there is a connection, it checks this site (xmax.es) for a newer version of the bank and, if there is one, downloads it encrypted, so corrections and new rules arrive without waiting for an app update. That request carries no identifier of yours; the server only sees what any website sees — IP address, date and time, requested address — handled as described in point 2.

We include no measurement, tracking or profiling SDK, there are no advertising identifiers and there is no cross-app tracking.

Reminders

If you allow it, the app schedules study reminders on your own device (local notifications). They are not sent from any server, need no identifier, and you can turn them off in the system settings.

Read aloud

Reading aloud is done by your device’s operating system with its built-in voices, on text already on your screen. We do not record or transmit audio, and the app does not access the microphone.

Nanu: white noise and sleep sounds

Nanu creates its sounds on your own device: it downloads no audio and connects to no server of ours to play them. Your last sound, mix, timer and settings are stored only in your device’s local storage and disappear when you uninstall the app. Nanu does not use the microphone and has no accounts, advertising or analytics.

If you send the sound to another speaker (AirPlay or Bluetooth) or use Siri and the Shortcuts app to start it, your device’s operating system handles that; Nanu receives no data from it. Nanu Plus purchases work as described below.

In-app purchases

Payment is processed by Apple. We never receive your name, your email or your payment details: Apple does not share them with us. To recognise whether you have bought full access we use RevenueCat, a company based in the United States, which receives Apple’s purchase receipt, an anonymous app-generated user identifier, the device vendor identifier (IDFV, which Apple assigns to this developer’s apps on your device and which changes if you uninstall them all) and technical request data: device model, iOS version, app version, store language and country.

On Android, payment is processed by Google Play, which does not share your name, email or payment details with us either; RevenueCat then receives Google’s purchase receipt instead of Apple’s.

None of it identifies you by name, and none of it is used for advertising or tracking. The legal basis is performance of the contract (Art. 6(1)(b) GDPR), the transfer to the United States relies on the European Commission’s standard contractual clauses, and the identifier is kept for as long as the purchase remains valid.

4. If you write to us

When you write to info@xmax.es we keep your message and your email address for as long as we need to answer you and, if necessary, to show that we did. The legal basis is our legitimate interest in replying to people who contact us. We do not use that address to send you anything you did not ask for.

If you ask for a business quote, the form on the For business page prepares an email that you send from your own mail program; the site stores nothing. With that email we receive the company name, its tax ID and billing address, and the name and email of the contact person. We use them to prepare the quote, issue the invoice and send the activation codes. The legal basis is performance of the contract or of the pre-contractual steps you ask for (Art. 6(1)(b) GDPR) and, for invoices, our legal obligation to keep them (Art. 6(1)(c) GDPR) for the periods required by Spanish commercial and tax law.

5. Your rights

Regulation (EU) 2016/679 gives you rights of access, rectification, erasure, restriction, portability and objection. You can exercise them by writing to the email or postal address in point 1. In practice, since we hold no personal data about you arising from your use of the apps, there is nothing on our side to access, correct or erase: it is all on your device and under your control.

If you believe your request has not been handled properly, you can complain to the Spanish Data Protection Agency or, for our British apps, to the Information Commissioner’s Office.

6. Children

Our apps are aimed at adults preparing for professional licensing exams. They are not directed at children and collect no data from them.

7. Changes

If this policy changes, this page is updated and so is the date shown above.

Governing law: Spanish law. Jurisdiction: the courts of Madrid, Spain.

Legal notice · Terms