This is an English courtesy translation. The Spanish version (Política de privacidad) is the legally binding text and prevails in case of any discrepancy.
Privacy policy
Last updated: 4 July 2026
This Privacy Policy explains how NOVELINGO, S.L. processes the personal data of people who access, register for or use Novelingo Studio, including the information website, the SaaS platform, published interactive experiences, contact forms, demos, commercial communications and related services.
Novelingo Studio is a no-code SaaS platform with artificial intelligence for creating, editing, publishing and exporting interactive experiences, serious games, training content, narratives, scenes, questions and digital resources.
1. Data controller
The data controller is:
NOVELINGO, S.L.
Tax ID (NIF): B44628329
Registered address: Avenida Sor Teresa Prat 15, 29003 Málaga, España
Telephone: +34 951 930 338
Privacy email: lopd@novelingo.com
Website: https://novelingostudio.com
For any matter relating to data protection you can write to us at lopd@novelingo.com.
2. Who this policy applies to
This policy applies to:
Users who visit the Novelingo Studio website.
People who fill in contact, demo request or subscription forms, or who sign up for commercial communications.
Users who create an account on Novelingo Studio.
Customers, companies, institutions, educational centres, museums, consultancies, agencies or organisations that purchase or trial the platform.
Invited users or collaborators who access an account, project or experience.
People who play or access experiences published via link, QR code, SCORM, PWA or other formats.
People who contact Novelingo by email, telephone, social media, at events or in business meetings.
3. Data we process
We may process the following categories of data, depending on how you use the website or platform:
3.1. Identification and contact data
First name and surname.
Email address.
Telephone number.
Company, organisation, job title or department.
Country, language and professional contact details.
3.2. Account and access data
Registration email address.
Access or verification codes.
Sign-up date.
Account language.
Plan, licence, available credits and credit usage.
Access history, basic activity and preferences.
Technical data needed to maintain the session and for security.
3.3. Platform usage data
Projects created.
Experiences generated, edited, published or exported.
Briefs, ideas, texts, prompts, responses, scenes, dialogues, questions, resources, images, settings and materials uploaded by the user.
AI-assisted generation history.
Data relating to publication, export, SCORM, PWA or shared links.
Basic metrics on usage, completion, interaction, errors and performance.
3.4. Player or participant data
When a person accesses a published experience, we may process technical and usage data, such as:
Access to the experience.
Progress.
Completion.
Answers or decisions made within the experience.
Score, result or feedback, if the experience includes them.
Technical identifier, device, browser, approximate IP address, and date and time of access.
If an experience asks for a name, email address, group, classroom, company, participant code or other identifying data, the customer or organisation that publishes the experience must inform participants in advance and have an appropriate legal basis.
4. Data you must not enter into Novelingo Studio
Unless there is a specific written agreement with Novelingo, you must not enter the following into the platform:
Health data.
Biometric data.
Data revealing racial or ethnic origin.
Political opinions.
Religious or philosophical beliefs.
Trade union membership.
Data concerning sex life or sexual orientation.
Data of identifiable minors, unless the responsible organisation has sufficient authorisation and legal basis.
Criminal data or data relating to offences.
Confidential information of third parties without authorisation.
Unnecessary personal data within prompts, briefs, scenes, dialogues or uploaded documents.
The platform is designed for creating training and interactive content. It must not be used as a repository of sensitive data or as a system for the individual assessment of people without specific safeguards.
5. What we use the data for
We process data for the following purposes:
5.1. Managing the website and forms
Handling enquiries.
Responding to requests for information.
Managing demos, meetings or trials.
Sending information requested by the user.
Providing initial commercial or technical support.
5.2. Creating and managing user accounts
Enabling registration and access to the platform.
Sending verification codes.
Managing authentication.
Maintaining the session and account security.
Administering users, plans, licences, credits and permissions.
5.3. Providing the Novelingo Studio service
Creating, editing, saving and managing projects.
Generating interactive experiences with the help of AI.
Saving prompts, responses and content associated with projects.
Enabling experiences to be published via link, QR code, PWA or other formats.
Enabling SCORM export where available.
Managing credits, consumption, limits and features.
Keeping the history necessary for users to review, reuse or modify their content.
5.4. Using artificial intelligence as a creation aid
Novelingo Studio uses artificial intelligence systems to help generate structures, scenes, narratives, dialogues, questions, feedback, resources and content variations.
AI is a support tool. The user must review and validate the generated content before publishing it, exporting it or using it with third parties.
Prompts, instructions, materials and responses may be processed by Novelingo and by AI technology providers in order to provide the requested service.
You must not include unnecessary personal data in prompts or in the materials you upload to the platform.
Novelingo will not use customers' private content to train its own general-purpose models without express authorisation.
5.5. Publishing and sharing experiences
Making an experience accessible via link, QR code, PWA, SCORM or other formats.
Measuring access, progress, completion and basic usage.
Detecting technical errors.
Improving the user experience.
Generating aggregated information for the creator or customer.
When an experience is published by a customer for employees, students, visitors, end users or citizens, the customer is responsible for informing those participants if it collects personal data or assesses their participation.
5.6. Invoicing, contracting and administrative management
Preparing proposals.
Managing quotes, contracts, orders, invoices, payments, licences, credits, renewals and support.
Complying with tax, accounting and commercial law obligations.
Handling administrative incidents or claims.
5.7. Commercial communications
Sending information about Novelingo Studio, news, features, use cases, events, demos, content, promotions or related services.
These communications will be sent where consent exists or where the regulations permit communications about services similar to those already contracted or requested.
In each communication you will be able to unsubscribe or ask us to stop sending you commercial communications.
5.8. Security, abuse prevention and service improvement
Detecting misuse, unauthorised access, credit abuse, technical errors or attacks.
Keeping security logs.
Preventing fraud or use that breaches the terms of service.
Improving the stability, performance, availability, traceability and quality of the platform.
5.9. Support and customer service
Responding to incidents.
Analysing errors.
Helping with use of the platform.
Reviewing cases reported by users.
Providing guided sessions, demos or technical assistance when requested.
6. Legal bases for processing
We process data on the following legal bases:
6.1. Performance of a contract or taking pre-contractual steps
We use this basis to:
Create and manage accounts.
Enable access to the platform.
Provide Novelingo Studio.
Manage projects, credits, licences, publications and exports.
Provide support related to the service.
Manage proposals, quotes and contracting.
6.2. Consent
We use this basis for:
Contact forms where the user requests information.
Subscription to commercial communications not linked to a prior relationship.
Use of non-essential cookies, where applicable.
Specific processing that requires express acceptance.
You may withdraw your consent at any time.
6.3. Legitimate interest
We use this basis to:
Maintain the security of the platform.
Prevent abuse, fraud or misuse.
Improve the service on an aggregated or technical basis.
Handle enquiries from current or prospective customers.
Send communications about similar services to customers or professional contacts, where the regulations permit.
Manage B2B relationships with companies, institutions, partners, suppliers or professional contacts.
6.4. Compliance with legal obligations
We use this basis for:
Invoicing.
Accounting.
Taxes.
Responding to legal requests.
Retention of contractual or commercial documentation.
Handling data protection rights.
6.5. Processing on behalf of a controller
When a customer uses Novelingo Studio to create, publish or manage experiences aimed at third parties, and those experiences process the personal data of employees, students, visitors, users, customers, citizens or participants, Novelingo may act as the customer's data processor.
In that case, the customer will be the data controller and Novelingo will process the data following the customer's instructions, in accordance with the services contract and the corresponding data processing agreement.
7. When Novelingo acts as controller and when as processor
7.1. Novelingo acts as controller
Novelingo acts as controller when it decides why and how data is processed in relation to:
The Novelingo Studio website.
Contact forms.
Demo requests.
Sales management.
User accounts.
Invoicing.
Support.
Platform security.
Its own commercial communications.
Internal analytics on platform usage.
7.2. Novelingo acts as processor
Novelingo acts as processor when a customer uses the platform to process third-party data within its own experiences, for example:
Employees taking internal training.
Students playing an educational experience.
Visitors to a museum or event.
Participants in a public or private campaign.
End users of an experience created by the customer.
In these cases, the customer must determine the purpose, legal basis, information provided to users, retention periods and applicable rights. Novelingo will process that data solely to provide the service.
8. Customer obligations when using Novelingo Studio with third parties
If you use Novelingo Studio to create experiences aimed at employees, students, minors, visitors, customers, end users or citizens, you are responsible for:
Informing participants about the processing of their data.
Having an appropriate legal basis.
Avoiding the collection of unnecessary data.
Not entering sensitive data unless there is a sufficient legal basis and a specific contract.
Obtaining authorisations when minors take part.
Configuring the experience to collect only the data necessary.
Reviewing AI-generated content before publishing it.
Verifying that use of the experience is appropriate for its training, educational, cultural, corporate or institutional context.
Not using the platform to make automated decisions with legal or similarly significant effects on individuals without specific legal safeguards.
9. Artificial intelligence and human review
Novelingo Studio includes AI-assisted generation features.
These features can help create drafts of structures, scenes, dialogues, questions, images, texts, feedback and resources. The results may contain errors, inaccuracies, biases or content that is unsuitable for the specific context.
The user is responsible for reviewing, correcting and validating the content before publishing it, exporting it, using it in training, sharing it with third parties or integrating it into an LMS.
Novelingo may apply security, moderation and control measures to prevent misuse, unlawful content, infringements of third-party rights or the generation of content that breaches applicable regulations.
10. Minors
Novelingo Studio is not intended for minors to create user accounts without authorisation.
In Spain, children under 14 must not provide personal data without the authorisation of their legal representatives.
If an educational, cultural, public or private organisation uses Novelingo Studio experiences with minors, that organisation is responsible for providing adequate information, obtaining the necessary authorisations and complying with the applicable regulations on data protection, minors, education and digital rights.
Novelingo recommends not requesting identifying data of minors within experiences unless strictly necessary.
11. Recipients and providers
To provide the service we may share data with providers acting as processors or sub-processors, only where necessary for the provision of the service.
These providers may include:
Web hosting and infrastructure providers.
Server and storage providers.
Database providers.
Email and authentication providers.
Artificial intelligence providers.
Analytics, monitoring, security and performance providers.
Invoicing, accounting, advisory, CRM or support providers.
Providers of communication, forms or customer service tools.
Payment gateways, if online payments are enabled.
Export, publication, SCORM or integration services, where applicable.
These providers may only process the data in accordance with our instructions, with appropriate security measures and under the contracts required by data protection regulations.
We may also disclose data to public authorities, courts, law enforcement agencies or other bodies where there is a legal obligation to do so.
12. AI providers
Novelingo Studio may use external artificial intelligence providers and proprietary or local models to provide assisted generation features.
Currently, the platform may rely on providers such as OpenAI, Google Gemini and local or proprietary models, depending on technical availability, type of feature, cost, performance and product evolution.
When you use AI features, prompts, instructions, materials and results may be processed to generate the requested response. You should therefore avoid including unnecessary personal data or confidential third-party information.
Novelingo may change, replace or add AI providers to improve the service, always seeking to maintain appropriate safeguards for security, confidentiality and data protection.
13. International data transfers
Novelingo prioritises providers and infrastructure located in the European Union or offering adequate safeguards.
However, some technology providers, particularly providers of artificial intelligence, communication, analytics, security or support, may be located outside the European Economic Area or provide services from third countries.
Where international data transfers take place, they will be carried out in accordance with the safeguards provided for in the GDPR (RGPD), such as adequacy decisions, standard contractual clauses, supplementary measures or other legally valid mechanisms.
Sensitive personal data and confidential third-party data must not be entered in prompts or materials sent to AI features unless there is a specific agreement and sufficient safeguards.
14. Data retention
We will keep data for as long as necessary to fulfil the purpose for which it was collected and, afterwards, for the periods required by applicable regulations or for as long as liabilities may arise.
As a general rule:
Contact data: while we handle the enquiry and, if a commercial relationship exists, for the time necessary to follow it up.
Commercial communications: until you withdraw your consent, request to unsubscribe or object to the processing.
Account data: while the account is active and for the period necessary to meet legal obligations or handle claims.
Project data, prompts, responses and content: while the account or project is active, unless the user requests its erasure and there is no obligation to retain it.
Invoicing data: for the applicable tax, accounting and commercial law periods.
Security logs: for the reasonable time needed to ensure security, traceability, abuse prevention and incident resolution.
Backups: for the technical retention period set by Novelingo and necessary for the continuity, recovery and security of the service.
Data processed on behalf of customers: according to the instructions of the responsible customer and the data processing agreement.
When data is no longer necessary, it will be deleted, anonymised or blocked in accordance with applicable regulations.
15. Security
Novelingo applies technical and organisational measures to protect data against unauthorised access, loss, alteration, misuse or unauthorised disclosure.
These measures may include:
Access control.
Authentication by a code sent to the registered email address.
Limits on access attempts.
Permission management.
Backups.
Technical activity logging.
Security measures on servers and databases.
Incident review.
Monitoring for misuse.
Confidentiality measures for staff and providers.
No system is completely infallible. If you detect unauthorised access, a vulnerability or an incident, you must report it to lopd@novelingo.com.
16. Publication of content and visibility
When you publish an experience on Novelingo Studio, it may be available to third parties via link, QR code, PWA, SCORM or other formats, depending on the configuration you choose.
Before publishing, you must check that the experience does not include:
Unnecessary personal data.
Data of minors without authorisation.
Confidential information.
Third-party materials without sufficient rights.
Sensitive data.
Unlawful, discriminatory or harmful content.
Publishing an experience may mean that third parties access the content. The user or customer who publishes the experience is responsible for checking that they have the right to share it.
17. Analytics and metrics
Novelingo Studio may generate usage and activity metrics in order to:
Measure access.
Measure completion.
Measure interaction.
Detect errors.
Improve features.
Show basic results to the creator or customer.
Analyse credit consumption.
Improve platform performance.
Wherever possible, metrics will be processed in aggregated or minimised form.
If a customer needs individualised analytics on employees, students or participants, it must have an appropriate legal basis and inform those individuals.
18. Cookies and similar technologies
The website and platform may use cookies and similar technologies to:
Enable the technical operation of the site.
Maintain the session.
Remember preferences.
Measure usage and performance.
Analyse browsing.
Improve the user experience.
Carry out marketing activities, if the user accepts.
You can find more information in the Cookie Policy available on the website.
Non-essential cookies will be used in accordance with the user's consent where it is required.
19. Commercial communications
We may send you commercial communications about Novelingo Studio, products, services, news, events, demos, content or promotions when:
You have requested them.
You have given your consent.
A prior relationship exists and the communication concerns similar products or services.
There is a legitimate interest in proportionate B2B communications related to your professional activity.
You can object or unsubscribe at any time by writing to lopd@novelingo.com or by using the unsubscribe mechanism included in each communication.
20. Social media
Novelingo may have profiles on social networks such as LinkedIn, X, Instagram, YouTube or other platforms.
If you interact with our profiles, your data will also be processed by the relevant social network in accordance with its own privacy policies.
Novelingo will process the data received through social networks in order to respond to messages, manage interactions, publish content, analyse reach and maintain the relationship with users, customers or interested parties.
21. Individuals' rights
You may exercise the following rights:
Access: to know whether we process your data and obtain information about the processing.
Rectification: to correct inaccurate or incomplete data.
Erasure: to request the deletion of your data where applicable.
Objection: to object to certain processing.
Restriction: to request that we temporarily restrict the processing.
Portability: to receive your data in a structured format where applicable.
Withdrawal of consent: to withdraw consent at any time.
The right not to be subject to automated decisions with legal or similarly significant effects, where applicable.
To exercise your rights you can write to:
You can also send your request by post to:
NOVELINGO, S.L.
Avenida Sor Teresa Prat 15
29003 Málaga, España
We may ask you for additional information to confirm your identity if necessary. You must not send a copy of your national ID (DNI) unless we request it with justification.
22. Complaints to the supervisory authority
If you consider that the processing of your data does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD).
Before doing so, we recommend that you contact us at lopd@novelingo.com to try to resolve the matter directly.
23. Third-party data entered by users
If you enter other people's personal data into Novelingo Studio, you warrant that:
You have the right to do so.
You have informed those people where necessary.
You have an appropriate legal basis.
The data is adequate, relevant and limited to what is necessary.
You do not enter sensitive data without express authorisation and a sufficient legal basis.
You do not use the platform for unlawful or discriminatory purposes or purposes contrary to fundamental rights.
Novelingo may delete, block or restrict content if it detects use that is improper or contrary to this policy, the terms of use or applicable regulations.
24. Data processing in SCORM experiences or integrations
When an experience is exported or used in an LMS, SCORM environment, external platform or customer system, the processing of data within that environment may also depend on the configuration and privacy policy of the customer or the destination platform.
Novelingo does not control processing carried out by LMSs, external platforms or third-party systems unless a specific integration has been contracted and regulated in writing.
The customer is responsible for informing its users about the use of the experience in its own environment.
25. Changes to this policy
Novelingo may update this Privacy Policy to adapt it to legal, technical, operational or product changes.
When changes are significant, we will notify you by reasonable means, such as a notice on the website, a notification in the platform or an email.
The current version will always be the one published at /en/privacy-policy/ or in the corresponding legal section of the platform.