Privacy Policy

Introduction

When you use MathMax or contact us, we receive information about you. In this privacy policy we explain what personal data we process, why, and what rights you have. We handle your data with care. We may update this policy from time to time, so we recommend reviewing it regularly. This policy was last updated in July 2026.

1. When does this privacy policy apply?

This privacy policy applies to all personal data we process through the MathMax game — on the website https://www.getmathmax.com and in our mobile applications — and through the website itself. Personal data is any information that can be traced back to you as an individual, such as your name, email address or IP address. It applies to everyone who uses MathMax or contacts us — including players of the free version, account holders, members who play under a family or school plan, and the parents or guardians of children who play.

2. Who is responsible for your data?

The controller responsible for processing your personal data is:

• Que?! Communicatie (Debby Grooteman)
• Address: Gran Via de les Corts Catalanes, 672, 08010 Barcelona, Spain
• VAT / NIF: Y1701744B
• Email: privacy@getmathmax.com

Where a school or other institution uses MathMax under a School Plan, the school decides which students receive access. To the extent we process students' personal data on the school's behalf, we do so under the school's instructions and a data processing agreement; for the school's own responsibilities, please also refer to your school.

3. Whose data do we process?

We process the personal data of people who use MathMax or contact us, namely: visitors and players of the free version, registered account holders and subscribers, members who play under a seat of a Family or School Plan (including children), the parents or guardians who create and manage accounts or seats for children, staff of schools that use MathMax, and anyone who contacts us with a question or complaint.

4. How do we obtain your data?

We receive data directly from you when you:

• use the game (including the free version);
• create an account and take out a subscription;
• are invited as a member of a Family Plan, or are given access by your school under a School Plan;
• make a payment; or
• contact us by email, through the contact form, or by other means.

We also collect some data automatically when you use MathMax, such as technical and usage data (see below).

5. What data do we process?

Depending on how you use MathMax, we may process the following categories of personal data:

• Account data: email address, password (stored securely in hashed form), your name or display name, and an optional avatar image.
• Member and seat data: if a family subscriber or a school gives you access, the email address used to invite you, your membership of that family or school group and, for schools, your class placement.
• Subscription and payment data: subscription type and status, and billing data. Payments are handled by our payment provider (Stripe); we do not store your full card details.
• Technical and usage data: IP address, device and browser type, and information about how you use the game. When you submit the sign-up, password-reset or email-verification form, Google reCAPTCHA processes technical data to distinguish people from automated abuse.
• Game and statistics data: if you play without an account, your scores, levels and progress are stored only on your own device (in your browser's local storage) and do not reach our servers. If you play with a subscribed account, your scores, statistics and progress are stored on our servers and linked to your account.
• Communication data: the content of messages you send us and our correspondence with you.
• Approximate location: a country-level code (for example “ES”) worked out from your IP address when you create an account or submit a game score, used to show prices in your local currency and for aggregated analytics. We do not store your IP address itself, only the resulting two-letter country code. This approximate country is determined using the free DB-IP Country Lite database (© DB-IP, https://db-ip.com, licensed under CC BY 4.0) and is never used to decide the tax charged at checkout — that is based only on the billing address you provide.

6. Why do we use your data, and on what legal basis?

We only use your personal data for specific purposes, each with a legal basis under the GDPR:

7. How long do we keep your data?

We keep your personal data no longer than necessary for the purposes above, or for as long as we are legally required to:

• Account data: for as long as your account is active. An account with no recorded activity for three years is deleted or anonymised, as is a closed account within a reasonable period, unless we must keep it longer by law.
• Game statistics: for as long as your account exists. If your subscription lapses, your statistics are retained but hidden, and become visible again if you resubscribe. They are deleted or anonymised when your account is deleted, or earlier on your request.
• School accounts nobody has claimed: a pupil account left dormant after the pupil leaves the school is deleted after around eighteen months, a window sized to the school year.
• Data held without an active legal basis: frozen — readable by nobody and written to by nothing — and deleted when the window above expires, unless a new basis is established first.
• Invoicing and payment data: for the period required under Spanish tax and commercial law (generally up to 6 years).
• Technical and usage data: for a limited period, in line with our security and logging practices.

These windows are enforced by a scheduled job that runs daily, not applied by hand on request.

8. Who do we share your data with?

We do not sell your personal data. We share it only where necessary, with:

• Service providers (processors) who help us run MathMax: our hosting provider, our payment provider (Stripe) and, for protecting the sign-up, password-reset and email-verification forms, Google (reCAPTCHA). They may only process your data on our instructions and under a data processing agreement.
• Your family subscriber or your school: if you use MathMax under a Family or School Plan, the subscriber or your school can see your membership of the group and, where those features exist, your progress within that group.
• Competent authorities, where we are legally required to disclose data.

9. Where is your data stored (international transfers)?

We aim to process your data within the European Economic Area (EEA). Some of our providers — in particular our payment provider (Stripe) and Google (reCAPTCHA) — may process data outside the EEA, notably in the United States. Where that happens, we ensure an appropriate level of protection through a European Commission adequacy decision (including the EU–US Data Privacy Framework) or by using Standard Contractual Clauses.

10. How do we keep your data secure?

We take appropriate technical and organisational measures to protect your personal data against loss or unlawful processing, such as encrypted connections, secured systems and access limited to people who need it. Where we share data with processors, they are bound to protect it with the same care. If you have questions about our security, please contact us.

11. What are your rights?

Because we process your personal data, you have the following rights under the GDPR:

• Right to be informed about how we use your data (this policy).
• Right of access to the data we hold about you.
• Right to rectification of incorrect or incomplete data.
• Right to erasure ("right to be forgotten"), unless we must keep the data by law.
• Right to restrict processing in certain cases.
• Right to object to processing based on our legitimate interests.
• Right to data portability.
• Right to withdraw consent at any time, where processing is based on consent.

You can exercise your rights by emailing privacy@getmathmax.com. We respond within one month; for complex or multiple requests this may be extended by up to two further months, and we will let you know. To prevent misuse, we may ask you to confirm your identity.

If you are not satisfied, you have the right to lodge a complaint with the Spanish Data Protection Authority, the Agencia Española de Protección de Datos (AEPD), www.aepd.es. You may also bring the matter before the competent courts in Spain.

12. Children's data

MathMax can be played by children, including from 4 years old, so protecting children's data is central to how the product is built rather than only to what this policy promises.

A plain-language companion page answers the questions parents and schools most often ask (www.getmathmax.com/privacy/children), and a second page sets out which children's privacy rules apply in which country and what we do about each (www.getmathmax.com/privacy/regulations). Both explain this policy; this policy governs.

• No account is needed to play. The full curriculum can be played anonymously, without registration, so we ask children for no personal data in order to play. Progress in that mode stays on the device and does not reach us.
• A child never opens an account for themselves. A paid account and subscription are created and managed by an adult of at least 18 — a parent or legal guardian for consumer plans, or an authorised representative for a school.
• Legal basis, household: where a parent or guardian creates a child's account under a Family Plan, the basis for processing that child's data is the parental consent given by that adult, recorded with its type and date and withdrawable at any time.
• Legal basis, school: where a school assigns a seat to a pupil, the basis is the school's authorisation for an educational purpose, and we process that pupil's data on the school's instructions. The school is responsible for obtaining the authorisations and consents required for its pupils, including under Article 8 GDPR and, in Spain, the LOPDGDD. When a pupil's membership of the school ends, that authorisation is withdrawn automatically.
• Age of digital consent: under Spanish law (LOPDGDD) a child under 14 cannot validly consent to the processing of their personal data for an online service; across the EEA the age set under Article 8 GDPR ranges from 13 to 16, and in the United States COPPA applies below 13. Our model — an adult subscriber or a school granting a child access — is designed so that a child is never asked to consent for themselves, whichever threshold applies.
• We never ask a child their age. A child account's protection level is derived from the grade the responsible adult entered and is clamped so that it can never resolve to an adult level, and a child account cannot change it by declaring an age.
• What we collect from a child: a first name, a grade, a username the product generated, and their results. No email address, no date of birth, no telephone number and no photograph. Where an age band is needed we store only the coarse band, never a date of birth.
• What it is used for: running the game and reporting progress to the adults responsible for that child. We do not sell children's data, we do not advertise to children, we run no analytics or behavioural tracking on any surface, and we do not profile a child for any purpose unrelated to their learning.
• Who can see it: the child's guardian, and in a school the teachers responsible for them — a teacher sees a narrower set of fields than a parent, and only play that took place under the school. Every access to an identifiable child's report is logged with who accessed it, whose data, and when. There is no public ranking, so a child's results are never shown publicly.
• Who can reach the child: only approved friends, family members and their own classmates. A child is not discoverable by search, is never placed into open matching, and cannot be reached by a stranger through any code or link. For a young child, every friend connection requires a guardian's approval.
• Exercising rights: a parent or guardian can review, correct, export and delete their child's data, and a school can do so for its pupils within its relationship. A deletion erases the stored history rather than hiding it. Write to privacy@getmathmax.com, or use the controls in the family area of your account.
• Retention: children's data is kept only as long as needed, under the windows in section 7, and is deleted or anonymised on account closure, on the pupil leaving the school once the window elapses, or on request.

13. Cookies and similar technologies

MathMax uses cookies and similar technologies, such as local storage that saves your game progress on your device. We explain these in detail, and how to manage your choices, in our separate Cookie Policy, available on the website.

14. Which rules apply to this privacy policy?

This privacy policy is based on the General Data Protection Regulation (Regulation (EU) 2016/679) and Spanish data protection law, in particular the Ley Orgánica 3/2018 (LOPDGDD). Spanish law applies to this privacy policy.

15. Changes to this privacy policy

We may amend this privacy policy, for example when we change the game or the providers we work with, or when the rules change. The latest version is always available on the website.

16. Questions or contact

If you have any question about this privacy policy or how we handle your personal data, please contact us at privacy@getmathmax.com. We are happy to help.