Privacy

Privacy policy

This policy explains the limited personal information processed when you visit the site, choose optional analytics, send a message, or request the newsletter.

Optional analytics · Opt-in only

Who is responsible

The site operator is the data controller.

Rudolf Adlmanninger
Wolfganggasse 11/4
1120 Vienna
Austria

Privacy questions: hello@spanishlonggame.com

Complete provider information is available in the Legal Notice.

Hosting and email

Cloudflare delivers the website; Google Workspace sends and receives contact messages.

The public website and contact form are delivered through Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA. Cloudflare processes the connection and security data needed to deliver, cache, and protect the website and to receive contact requests. This may include the IP address, time of request, requested URL, referrer, browser or device information, security signals, and response status. The legal basis is the legitimate interest in operating a secure and reliable website (Article 6(1)(f) GDPR).

After a contact submission passes the form checks, Cloudflare sends it over an authenticated, encrypted connection to the operator’s Google Workspace mail service. Google processes the fixed sender and recipient addresses, your Reply-To address, subject, message content, and technical security and delivery data needed to transmit the notification to hello@spanishlonggame.com.

The connection is used only for low-volume contact notifications; it does not add your address to a mailing list and does not add open or click tracking.

The sending service and the receiving mailbox are both provided through Google Workspace. The relevant Google contracting entity for an EEA business account is generally Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; the entity stated in the operator’s applicable Workspace agreement controls. Google processes message content, sender and recipient details, and ordinary email metadata so messages can be received, stored, read, and answered. Google may use global infrastructure and subprocessors. Where required, transfers are covered by Google’s contractual safeguards, including applicable adequacy decisions and Standard Contractual Clauses.

More information is available in Cloudflare’s Privacy Policy and Data Processing Addendum, and in Google’s Cloud Data Processing Addendum and Privacy Policy.

Privacy choices

The site uses the self-hosted open-source tool Klaro to record whether you accept or reject optional analytics. Klaro itself does not contact a third party. It stores the necessary cookie slg_consent for up to 180 days so the site can remember your choice.

No analytics option is preselected. You can reject analytics on the first layer of the notice. You can also change or withdraw your choice at any time using Cookie settings in the footer. Withdrawal applies to future processing and does not affect the lawfulness of earlier processing.

Optional audience measurement

Google Analytics 4 loads only after an active opt-in.

The Google Analytics script is blocked until you choose Accept analytics. Before that choice, the site makes no Google Analytics request and sends no analytics data to Google.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you consent, Google Analytics may process the pages visited, time and approximate location, referring source, browser, operating system, device category, interaction events, and identifiers stored in the cookies _ga and _ga_<container-id>. The purpose is to understand which content is useful, how visitors find the site, and where the site experience needs improvement.

If you have accepted analytics and activate a clearly labeled website affiliate link, this site also records an affiliate-link interaction. The information added by this site is limited to the fixed partner and network labels plus the link’s page placement and destination type. They do not include the full destination URL or its query string, and this site does not add a name, email address, contact-form content, or another user-entered personal field to the event. The ordinary Google Analytics request data and consented cookies described above still apply.

The legal basis is your consent (Article 6(1)(a) GDPR and the applicable Austrian telecommunications rules). Advertising storage, Google Signals, ads personalization, and Google Ads linking are disabled. User- and event-level data retention is intended to be set to two months; standard aggregated reports may remain available for longer under Google’s service design.

Google states that EU traffic data is collected on EU-based servers and that IP addresses are discarded before being logged, although other data may then be processed in other countries. Transfers to Google group companies or service providers outside the EEA may rely on an adequacy decision such as the EU–US Data Privacy Framework and, where relevant, Standard Contractual Clauses. More information is available in Google’s Privacy Policy.

Contact form and email

Data you choose to send.

When you use the contact form, the site processes your email address, optional name, selected topic, message, source page, and ordinary request metadata. It validates the fields and checks for automated abuse. The application does not write the form fields or message content to a website database.

If the submission is accepted, the site sends the validated details through the operator’s authenticated Google Workspace mail connection as a plain-text notification addressed only to hello@spanishlonggame.com. Your email address is placed in the Reply-To field so the operator can answer you directly. Open and click tracking are not added to these notifications. The form does not create a marketing contact, subscribe you to the newsletter or another list, send an automated reply, or transfer the inquiry to Rocket Languages. A contact message is not treated as permission to publish, quote, or use it as a testimonial; separate permission would be requested first.

Depending on the inquiry, processing is based on steps requested before a possible agreement (Article 6(1)(b) GDPR) or the legitimate interest in answering questions, feedback, corrections, and disclosure concerns and in preventing abuse of the form (Article 6(1)(f) GDPR). Your email address, topic, and message are required to handle the inquiry; your name is optional. There is no automated decision-making or profiling.

The website does not retain a separate copy of the submitted fields. Because the notification is sent from and to the operator’s Google Workspace account, a copy can also appear in that account’s sent mail. The copies in Google Workspace are kept only as long as reasonably needed to handle and document the inquiry and any follow-up, then deleted unless legal record-keeping or the establishment, exercise, or defense of a legal claim requires longer retention. Please do not submit passwords, payment details, health information, or other sensitive data through this form.

Newsletter and Scorecard

When you request the newsletter and Scorecard, the form asks only for your email address and consent. The contact form remains a separate inquiry channel and never creates a newsletter subscription.

What is processed and why

The service processes your email address; the consent wording and time; your subscription choices; confirmation, delivery, open, click, preference, and unsubscribe records; and bounce or complaint information received from mail providers. Ordinary request and security data can include the IP address, request time, requested page, browser or device information, headers, and security signals. These data are used to confirm the request, deliver the Scorecard, send the Welcome Series and Sunday Field Notes, measure the disclosed email interactions, manage preferences, prevent abuse, troubleshoot delivery, and document and honor consent or withdrawal.

The legal basis for sending the requested newsletter and measuring opens and marked-link clicks is consent (Article 6(1)(a) GDPR and the applicable Austrian electronic-communications rules). Security, double-opt-in evidence, and the minimum records needed to demonstrate consent, honor withdrawal, and avoid sending to undeliverable or complaining addresses are processed on the basis of the legitimate interest in operating a secure and compliant email service (Article 6(1)(f) GDPR) and, where applicable, a legal obligation (Article 6(1)(c) GDPR). The service does not use these records to make automated decisions, score subscribers, or infer language ability.

Double opt in and email choices

After a signup request, a confirmation email is sent to the address provided. Newsletter messages begin only after the confirmation link is used. That link opens a confirmation page provided by the newsletter service; the first Welcome email then brings the link to the Scorecard download page. The requested service includes a six-email Scorecard Welcome Series over 16 days and the ongoing Sunday Field Notes. Each Welcome email includes one clearly marked affiliate link; the consent wording explains the Welcome Series, Sunday Field Notes, sender, open and click measurement, affiliate links, preferences, and global unsubscribe before you submit the form.

Every marketing email includes links to change your preferences or unsubscribe from all marketing email. You can stop the Welcome Series while keeping Sunday Field Notes, change both choices, or unsubscribe globally. Where supported, your mail application may also offer one-click global unsubscribe. Withdrawing consent applies to future processing and does not affect the lawfulness of earlier processing.

Service providers and delivery

Cloudflare delivers and protects the public form and processes the request and security data needed to receive it. The form sends the email address, the two requested lists, and the consent record over an encrypted connection to the newsletter service SendFox. The website does not pass your IP address to SendFox with the signup request.

SendFox is operated by Sumo Group Inc., 1305 East 6th Street, Suite 3, Austin, Texas 78702, USA. It stores the email address, subscription choices, consent evidence, and confirmation, delivery, interaction, bounce, complaint, and unsubscribe records, and it sends the confirmation email, the Welcome Series, and Sunday Field Notes. Its confirmation, preference, and unsubscribe pages are provided by SendFox, which processes the request data of a visit to those pages, including the IP address, and may use cookies there as described in its own policy. According to SendFox’s technical documentation, messages from the project’s sending domain are delivered through the email service SendGrid. The recipient’s chosen mail provider necessarily receives the message. Replies are received in the project’s Google Workspace mailbox.

SendFox acts as a processor under its Data Processing Agreement, which provides for the European Commission’s Standard Contractual Clauses for transfers outside the EEA. SendFox is a United States provider and does not publish its storage locations or a list of its subprocessors, so newsletter data should be regarded as processed in the United States, where the level of data protection can differ from that in the EEA. More information is available in the SendFox Privacy Policy. Contact-form notifications are not sent through SendFox; they go through Google Workspace as described above.

Email tracking and necessary storage

Open and marked-link click measurement are enabled as disclosed with the form. A small remote image can carry a message- and recipient-specific reference. If a mail application requests it, SendFox can record an open, its time, and associated request data. Image blocking, caching, privacy proxies, and automatic loading can make that record incomplete or inaccurate; it does not prove that a person read the message.

Marked links can pass through SendFox before reaching their destination. SendFox can record the recipient, message, link, time, and associated request data. Mail-security and preview systems can request a link automatically, so a recorded click does not necessarily mean that the recipient deliberately selected it. The affiliate link in each Welcome email can also pass through the site’s aggregate redirect before reaching Rocket Languages or ClickBank; that separate processing is explained in the affiliate section below.

The recipient’s mail provider also processes delivery and security data under its own terms. Each marketing email also carries a footer added by SendFox with the operator’s postal address, the preference and unsubscribe links, and a SendFox notice with a link to SendFox’s own website.

Retention

An email request that is not confirmed is kept for no more than 14 days and then deleted. A confirmed contact is kept while the subscription is active. Unsubscribing stops future marketing email. Profile, preference, interaction, and delivery data that is no longer needed is deleted or anonymized. The minimum email, consent, and withdrawal evidence may be kept only as long as needed to honor the withdrawal, demonstrate compliance, or establish, exercise, or defend a legal claim.

SendFox states that a deleted contact is removed from the account while the underlying record remains in its systems until permanent deletion is requested; after a deletion request, the operator asks SendFox for that permanent deletion. Backups and independent service and security logs maintained by Cloudflare, Google, and SendFox follow the providers’ controlled backup, deletion, and legal-retention cycles.

Withdrawal and control

In addition to the links in every marketing email, you may request access, correction, deletion, restriction, or portability through the contact address in the Legal Notice. The general rights and complaint route below apply in full.

External links

Affiliate destinations have their own privacy terms.

Rocket Languages affiliate links are clearly labeled. Activating one sends you to an official Rocket Languages destination, either directly from a website page or through the fixed same-origin address used in Welcome emails and the printable Workbook. Merely viewing a page on this site does not load the Rocket destination. If you have accepted optional site analytics, the website may record the page placement and destination category of a marked link. Newsletter click measurement and automatic requests by mail-security or preview systems are described above.

After a click, Rocket Languages may receive the ordinary request data needed to serve and attribute the visit, such as your IP address, time of request, requested URL, referrer, browser or device information, and affiliate identifier carried by the link. If you continue to checkout, ClickBank may provide checkout and payment processing and may receive the referral, order, and payment data needed for those services. Rocket Languages and ClickBank may use cookies or other identifiers under their own privacy and retention policies. Browser privacy controls, cookie settings, and content blockers can affect that attribution. No affiliate commission has been earned.

The same-origin affiliate address used in Welcome emails and the Workbook creates an aggregate request count before redirecting. This site stores only the fixed destination category, link category, count, and provider timestamp for that measurement—not an IP address, referrer, browser, full URL, query string, cookie, or visitor identifier. Cloudflare still processes ordinary connection and security data. Aggregate data is retained for three months. A count may include repeat requests, bots, or link-preview checks and is not a count of unique people or purchases. This limited measurement is based on the legitimate interest in understanding use of the published short address without building a visitor profile (Article 6(1)(f) GDPR).

Sharing and sale

No sale of personal information.

Personal information is not sold. It is shared only with providers needed for hosting, email, optional consented analytics, or compliance with a valid legal obligation, within their documented roles and safeguards.

Your rights

Access and control.

Where the GDPR applies, you may request access, correction, deletion, restriction, or portability of your personal data, and you may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it for the future.

To make a privacy request, email hello@spanishlonggame.com. Reasonable information may be requested to confirm identity before personal data is disclosed or changed.

You may also lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria, or with the data-protection authority responsible for your place of residence.

Last updated: October 10, 2026.