Privacy Policy

1. Data controller

• Name: Julien Jean Bellet Ribes
• Trading name: IA Escola
• Address: Banyeres del Penedès, 43711, Tarragona, Catalonia, Spain
• Email: info@ia-escola.com

2. Data we collect

We only collect data needed to provide the requested service:

• Contact form: name, email, message, and (optionally) business type.
• Course registration: name, email, phone (optional), institution, and payment method.
• Newsletter: email address.
• Analytics cookies (optional, with consent only): anonymized IP, browser, pages visited.
• Communications: if you email us, we keep the conversation to provide continuity.

3. Purposes and legal basis

We process data with the following purposes and legal bases (GDPR art. 6):

• Respond to your inquiry or request (contract performance / pre-contractual measures — art. 6.1.b GDPR).
• Manage your course registration and invoicing (contract performance — art. 6.1.b GDPR).
• Send you information about courses and content (explicit consent — art. 6.1.a GDPR; you can withdraw it any time).
• Compliance with legal obligations (tax, accounting — art. 6.1.c GDPR).
• Aggregated analysis of website usage with cookies (explicit consent — art. 6.1.a GDPR).

3.1. Resources and follow-up emails

When you download a resource from /recursos and tick the optional "I'd like practical AI tips" checkbox, we send a confirmation email with the download link and — if you ticked the checkbox — a short follow-up sequence (D+3 and D+7) with practical AI-for-SMB content. You can unsubscribe from this series at any time via the link at the bottom of every email. We retain consent data until you withdraw consent; the unsubscribe record and proof of consent (text version and hash) are retained indefinitely as legal proof of processing, even after withdrawal. We do NOT consult the Spanish Lista Robinson (do-not-mail list) before sending, because LOPDGDD Art. 23.2 states that this check is unnecessary when the data subject has consented to receive communications from the specific sender. You may still register at https://www.listarobinson.es to opt out of marketing from OTHER companies.

4. Retention

We retain your data only for as long as necessary:

• Inquiry data: 1 year from last communication.
• Registration data: 5 years (tax and commercial obligations).
• Newsletter: until consent is withdrawn.
• Analytics cookies: up to 2 years (Google Analytics 4, _ga, only with consent) / 24 hours (Vercel Analytics). Plausible uses no cookies.

5. Recipients and transfers

We do not sell or share your data. We share the minimum necessary with the providers that operate the service:

• Vercel Inc. (USA) — website hosting. Legal framework: SCC + DPF.
• Resend (USA) — transactional email. Legal framework: SCC + DPF.
• Plausible Analytics (EU) — web analytics without persistent cookies.
• Sentry (USA) — technical error logging. Legal framework: SCC + DPF.
• Anthropic (USA) — AI assistants in our services (only if you opt in). Legal framework: SCC.
• Google (Google Ireland Ltd / Google LLC, USA) — Google Analytics 4 (web analytics, only if you accept cookies) and Google Workspace (email hosting of ia-escola.com). Legal framework: SCC + DPF.
• Cloudflare (USA) — anti-bot verification (Turnstile) on forms. Legal framework: SCC + DPF.
• Supabase (EU, Frankfurt) — database. No international transfer.
• Arcjet (USA) — rate limiting and bot detection (processes your IP). Legal framework: SCC + DPF.
• Meta Platforms (Ireland/USA) — WhatsApp Business Cloud API, only if you contact us via WhatsApp. Legal framework: SCC + DPF.

6. Your rights

You have the right to:

• Access: know what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure ("right to be forgotten"): request deletion.
• Restriction: limit processing in certain cases.
• Portability: receive your data in a structured format.
• Object: object to processing on legitimate grounds.
• Withdraw consent at any time without affecting prior lawful processing.
• Lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe your rights have not been respected.

7. How to exercise your rights

Email info@ia-escola.com clearly indicating the right you wish to exercise and attaching a copy of an ID (to verify identity). We will respond within one month.

8. Security

We apply reasonable technical and organizational measures to protect your data: HTTPS encryption site-wide, role-based access, strong passwords, access logging, regular backups, and periodic provider review.

9. Minors

We do not offer our services directly to minors under 14. If a company contracts training for minors, it is responsible for obtaining legal guardians' consent.

10. Changes to this policy

We may update this policy to reflect legal or operational changes. The date of the last update appears at the top. If changes are substantial, we will notify you by email (if you have an account) or with a prominent notice on the site.

11. CV analysis tool (AI CV Analyzer)

This section describes how we handle data when you use the free CV analysis tool available at /recursos/analitzador-cv-ia. Read it together with the rest of this policy.

• Your CV is NOT stored on IAescola infrastructure, neither as a file nor in the database. The tool processes the CV text and the job description exclusively in memory and discards them once the response has been generated.
• The text of your CV and the job description are sent to our subprocessor Anthropic (Claude API, USA) to generate the AI report. Anthropic retains this data for a maximum of 30 days under its standard retention policy; Anthropic does NOT use API data to train its models by default. You can review Anthropic's retention policy at privacy.anthropic.com.
• Pre-upload notice: the tool recommends removing especially sensitive data (photo, date of birth, medical information) from your CV before uploading it, to reduce exposure to the risks of Art. 9 GDPR during processing.
• If, after receiving the report, you choose to provide your email (voluntary opt-in), we process two categories of data: (a) as a contact/lead, your email together with technical connection data (masked IP, browser and referring page) and the consent record (date, version and hash of the accepted text), as described in the general section of this policy; and (b) for tool analytics, a row containing the hash of your email (SHA-256), the score, the CV language, the detected role and the CV readability quality. We never store the content of the CV or the job posting.
• Subprocessors involved in the use of this tool: Anthropic (AI generation, USA, up to 30 days); Vercel (hosting and serverless functions, USA, up to 30 days of access logs, request body NOT recorded in logs); Supabase (database, EU Frankfurt; a daily usage counter with no personal data during analysis, and your contact data only if you opt in to email, until you request deletion); Resend (follow-up emails, USA, only if you opt in); Sentry (error monitoring, USA, 90 days; sensitive request-body data such as the CV, the job description and the email are automatically redacted via beforeSend); Arcjet (bot detection and rate limiting, edge, 24-48 hours of temporary metadata, no persistent data in our database).
• Legal bases: the CV analysis is a service requested by you (Art. 6.1.b GDPR, pre-contractual measures at the data subject's request); if you choose to include special-category data in your CV (health, trade union membership, religion, ethnic origin, sexual orientation, etc.), its processing is based on your explicit consent (Art. 9.2.a GDPR), collected separately before the analysis and limited to generating the report ephemerally without storing it; the subscription to follow-up emails is based on your explicit consent (Art. 6.1.a GDPR), separate, optional and revocable at any time with one click.
• The tool does not make any automated decision about you within the meaning of Art. 22 GDPR. The report is for guidance only and does not produce legal effects or significantly affect you in a similar way.
• To exercise your rights of access, deletion or portability over the stored data (if you opted in), write to info@ia-escola.com with the subject "GDPR Rights, CV Analyzer". We will respond within one month at most.

12. Agent Ready tool (AI-agent readiness audit)

This section describes how we handle data when you use the free Agent Ready tool available at /agent-ready, which assesses how well a website is prepared for AI agents. Read it together with the rest of this policy.

• Domain analysis: when you enter a web address to analyze, we process the public domain you provide and store the result (score and level) indexed by domain, to speed up later queries. We also send aggregate analytics events (domain, score and level) to our provider Plausible (cookieless analytics, EU). We do not ask you for contact data in this operation; note that a domain may, in some cases, identify a natural person.
• Optional subscription: if you choose to provide your email, we store your email, a technical fingerprint of the connection (IP masked with a SHA-256 hash, browser and referring page) and, if you come from an analysis, a snapshot of it (domain, score and level). The subscription uses double opt-in: we send a confirmation email and you are only subscribed once you click it.
• Legal bases: the domain analysis is a service requested by you (Art. 6.1.b GDPR); the email subscription is based on your explicit consent (Art. 6.1.a GDPR), separate, optional and revocable at any time via the unsubscribe link.
• Subprocessors involved: Vercel (hosting, USA), Supabase (database, EU Frankfurt), Resend (sending the confirmation email and updates, USA, only if you subscribe), Cloudflare and Arcjet (anti-bot protection and rate limiting). See section 5 for transfer details. To exercise your rights, write to info@ia-escola.com with the subject "GDPR Rights, Agent Ready".