Privacy Policy

• Name: Julien Jean Bellet Ribes
• Trading name: IA Escola
• Address: Carrer Sant Miquel, 40, 43711 Banyeres del Penedès, Tarragona, Catalonia, Spain
• Email: info@ia-escola.com

We only collect data needed to provide the requested service:

• Contact form: name, email, message and, optionally, business type and province. When you send it we also record where the visit came from: the domain of the external website that brought you (not the full address), the campaign parameters of the link (utm_source, utm_medium, utm_campaign), the entry page (the first page of the visit if you accepted analytics cookies; otherwise the form page) and the language; and the approximate country and region that our hosting provider (Vercel) derives from your IP address. We do not store your IP address in the booking database; Vercel processes it to provide hosting and derive your approximate country and region. These data stay linked to your request and are kept for the period set for inquiry data (section 4).
• Course registration: name, email, phone (optional), institution, and payment method.
• Newsletter: email address.
• Analytics cookies (optional, with consent only): anonymized IP, browser, pages visited and an anonymous browser identifier.
• Communications: if you email us, we keep the conversation to provide continuity.

We process data with the following purposes and legal bases (GDPR art. 6):

• Respond to your inquiry or request (contract performance / pre-contractual measures: art. 6.1.b GDPR).
• Manage your course registration and invoicing (contract performance: art. 6.1.b GDPR).
• Send you information about courses and content (explicit consent: art. 6.1.a GDPR; you can withdraw it any time).
• Compliance with legal obligations (tax, accounting: art. 6.1.c GDPR).
• Aggregated analysis of website usage with cookies (explicit consent: art. 6.1.a GDPR).
• Knowing through which channels and from which areas contact-form requests reach us, to decide where we promote our services (legitimate interest: art. 6.1.f GDPR). We only use the origin and area data in section 2, to produce aggregated statistics and to handle your request knowing how you found us (so they appear in the internal notice we receive when you send it), without including your IP address and without profiling, and you can object to this processing at any time (section 6).

When you download a resource from /recursos, we send you an email with the download link. If you also tick the optional checkbox, you receive 2 commercial emails (after about 3 and 7 days): an offer of a free first meeting and a training example with a free diagnostic; they are marked "Ad". You can unsubscribe from this series at any time via the link at the bottom of every email. Download and email-delivery data (email, company, anonymised IP address, delivery and sequence status) is kept for 24 months from your last request and then anonymised or deleted. If you unsubscribe, we only keep your address and the unsubscribe status so that we do not write to you again. Proof of commercial consent (the accepted text with its version and hash, the date and, where applicable, the withdrawal) is stored in an append-only record that we also use to honour your unsubscribe; we keep it for up to 3 years after you unsubscribe or after the last commercial email we sent you, whichever is later (limitation period for infringements: arts. 32 and 72 LOPDGDD). After that period we delete the IP address, browser, source and text, and keep only the address, the date and the type of event so that we do not write to you again. We do NOT consult the Spanish Lista Robinson (do-not-mail list) before sending, because LOPDGDD Art. 23.2 states that this check is unnecessary when the data subject has consented to receive communications from the specific sender. You may still register at https://www.listarobinson.es to opt out of marketing from OTHER companies.

We only send you the IAescola Docents pack news if you have expressly consented (art. 6.1.a GDPR and art. 21 of the Spanish LSSI), in one of two ways: (1) on the pack form, by ticking the optional news box and then confirming it from the link we email you (it expires after 7 days and can only be used once); without that confirmation we send you no news; (2) in the members area, by turning on the "Receive the pack news by email" switch while signed in with a verified email. As proof we keep the date, the version of the text you accepted and, in the members area, your user identifier. You can withdraw consent at any time: with the switch in the members area or with the unsubscribe link at the bottom of each email, which opens a page where you confirm it (compatible email programs can also do it directly). To avoid duplicate sends, the send log does not store your address but an identifier encrypted with a secret key.

We only send you «Novetats IA», the email with the artificial intelligence news we explain on the blog (written in Catalan and Spanish), if you have expressly asked for it (art. 6.1.a GDPR and art. 21 LSSI): you enter your email in the form on the blog or in the footer, tick the box (it is not pre-ticked) and confirm it from the link we email you (it expires after 7 days and can only be used once). Without that confirmation we send you nothing. As proof we keep the date, the exact text you accepted, its version and its fingerprint (hash), and the page you signed up from. You can withdraw your consent at any time with the unsubscribe link at the foot of every email, which opens a page where you confirm it (compatible email programs can also do it directly). If the email bounces permanently or you mark it as spam, we stop sending it. We send these emails with Resend (section 5) and do not measure opens or clicks.

We retain your data only for as long as necessary:

• Inquiry data: 1 year from last communication.
• Registration data: 5 years (tax and commercial obligations).
• Newsletter: until consent is withdrawn.
• «Novetats IA»: while you are subscribed. After you unsubscribe we keep the address, the date and the proof of consent blocked for up to 3 years (limitation period for infringements: arts. 32 and 72 LOPDGDD and art. 45 LSSI) and then delete them. Requests you do not confirm: 30 days after they expire.
• Analytics cookies: up to 400 days (Google Analytics 4, _ga and _ga_*, only with consent). Vercel Analytics uses no cookies or browser storage. PostHog (cookie ph_<key>_posthog): 180 days, only with consent.

We do not sell or share your data. We share the minimum necessary with the providers that operate the service:

• Vercel Inc. (USA): website hosting. Legal framework: SCC + DPF.
• Resend (USA): transactional email. Legal framework: SCC + DPF.
• Sentry (USA): technical error logging. Legal framework: SCC + DPF.
• Anthropic (USA): AI assistants in our services (only if you opt in) and drafting replies to the messages you send us on WhatsApp; every reply is reviewed and sent by a person at IAescola. Legal framework: SCC.
• Google (Google Ireland Ltd / Google LLC, USA): Google Analytics 4 (web analytics, only if you accept cookies) and Google Workspace (email hosting of ia-escola.com). Legal framework: SCC + DPF.
• PostHog Inc. (USA, with data hosted in the EU, in Frankfurt): site usage analytics, only if you accept cookies. Legal framework: SCC. More information: https://posthog.com/privacy and https://posthog.com/dpa.
• Cloudflare (USA): anti-bot verification (Turnstile) on forms. Legal framework: SCC + DPF.
• Supabase (EU, Frankfurt): database. No international transfer.
• Meta Platforms (Ireland/USA): WhatsApp Business Cloud API, only if you contact us via WhatsApp. Legal framework: SCC + DPF.

You have the right to:

• Access: know what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure ("right to be forgotten"): request deletion.
• Restriction: limit processing in certain cases.
• Portability: receive your data in a structured format.
• Object: object to processing on legitimate grounds.
• Withdraw consent at any time without affecting prior lawful processing.
• Lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe your rights have not been respected.

Email info@ia-escola.com clearly indicating the right you wish to exercise. If we have reasonable doubts about your identity, we will ask only for the additional information strictly necessary to verify it. We will respond within one month.

We apply reasonable technical and organizational measures to protect your data: HTTPS encryption site-wide, role-based access, strong passwords, access logging, regular backups, and periodic provider review.

We do not offer our services directly to minors under 14. If a company contracts training for minors, it is responsible for obtaining legal guardians' consent.

We may update this policy to reflect legal or operational changes. The date of the last update appears at the top. If changes are substantial, we will notify you by email (if you have an account) or with a prominent notice on the site.

This section describes how we handle data when you use the free CV analysis tool available at /recursos/analitzador-cv-ia. Read it together with the rest of this policy.

• Your CV is NOT stored on IAescola infrastructure, neither as a file nor in the database. The tool processes the CV text and the job description exclusively in memory and discards them once the response has been generated.
• The text of your CV and the job description are sent to our subprocessor Anthropic (Claude API, USA) to generate the AI report. Anthropic retains this data for a maximum of 30 days under its standard retention policy; Anthropic does NOT use API data to train its models by default. You can review Anthropic's retention policy at privacy.anthropic.com.
• Pre-upload notice: the tool recommends removing especially sensitive data (photo, date of birth, medical information) from your CV before uploading it, to reduce exposure to the risks of Art. 9 GDPR during processing.
• If, after receiving the report, you choose to provide your email (voluntary opt-in), we process two categories of data: (a) as a contact/lead, your email together with technical connection data (masked IP, browser and referring page) and the consent record (date, version and hash of the accepted text), as described in the general section of this policy; and (b) for tool analytics, a row containing the hash of your email (SHA-256), the score, the CV language, the detected role and the CV readability quality. We never store the content of the CV or the job posting.
• Subprocessors involved in the use of this tool: Anthropic (AI generation, USA, up to 30 days); Vercel (hosting and serverless functions, USA, up to 30 days of access logs, request body NOT recorded in logs); Supabase (database, EU Frankfurt; a daily usage counter with no personal data during analysis, and your contact data only if you opt in to email, until you request deletion); Resend (follow-up emails, USA, only if you opt in); Sentry (error monitoring, USA, 90 days; sensitive request-body data such as the CV, the job description and the email are automatically redacted via beforeSend).
• Legal bases: the CV analysis is a service requested by you (Art. 6.1.b GDPR, pre-contractual measures at the data subject's request); if you choose to include special-category data in your CV (health, trade union membership, religion, ethnic origin, sexual orientation, etc.), its processing is based on your explicit consent (Art. 9.2.a GDPR), collected separately before the analysis and limited to generating the report ephemerally without storing it; the subscription to follow-up emails is based on your explicit consent (Art. 6.1.a GDPR), separate, optional and revocable at any time with one click.
• The tool does not make any automated decision about you within the meaning of Art. 22 GDPR. The report is for guidance only and does not produce legal effects or significantly affect you in a similar way.
• To exercise your rights of access, deletion or portability over the stored data (if you opted in), write to info@ia-escola.com with the subject "GDPR Rights, CV Analyzer". We will respond within one month at most.

This section describes how we handle data when you use the free Agent Ready tool available at /agent-ready, which assesses how well a website is prepared for AI agents. Read it together with the rest of this policy.

• Domain analysis: when you enter a web address to analyze, we process the public domain you provide and store the result (score and level) indexed by domain, to speed up later queries. We also send aggregate analytics events (domain, score and level) to Google Analytics 4, provided you have accepted analytics cookies (see section 5). We do not ask you for contact data in this operation; note that a domain may, in some cases, identify a natural person.
• Optional subscription: if you choose to provide your email, we store your email, a technical fingerprint of the connection (IP masked with a SHA-256 hash, browser and referring page) and, if you come from an analysis, a snapshot of it (domain, score and level). The subscription uses double opt-in: we send a confirmation email and you are only subscribed once you click it.
• Legal bases: the domain analysis is a service requested by you (Art. 6.1.b GDPR); the email subscription is based on your explicit consent (Art. 6.1.a GDPR), separate, optional and revocable at any time via the unsubscribe link.
• Subprocessors involved: Vercel (hosting, USA), Supabase (database, EU Frankfurt), Resend (sending the confirmation email and updates, USA, only if you subscribe), Cloudflare (anti-bot protection). See section 5 for transfer details. To exercise your rights, write to info@ia-escola.com with the subject "GDPR Rights, Agent Ready".

This section describes how we process data when you subscribe to the founding group and use Campus IA-Escola (campus.ia-escola.com) and its Android app. Read it together with the rest of this policy. The campus and the app are for people aged 18 and over.

• Campus account: first name, surname, email address and username, to create your account and give you access to the courses (performance of the contract: art. 6.1.b GDPR).
• Course use: progress, completed activities, quiz answers and forum messages, so the course works and we can reply to you (art. 6.1.b GDPR).
• Payment on the website (Stripe): payment is processed by Stripe (Stripe Payments Europe Ltd, Ireland). IA-Escola never sees or stores your card details. We store the Stripe customer and subscription IDs, the subscription status, and the date and version of the boxes you ticked when paying, as proof of the contract (art. 6.1.b and 6.1.c GDPR).
• Payment in the app (Google Play): if you subscribe in the app, the sale is made by Google (Google Ireland Ltd), which also charges and invoices you. We receive the purchase receipt to check it with Google and give you access while the subscription is active. We only send Google an encrypted identifier of your account, not your name or email.
• Phone notifications: only if you allow them on your phone. We store a device identifier and send notifications with Firebase Cloud Messaging (Google). You can turn them off at any time in your phone or app settings (consent: art. 6.1.a GDPR).
• Campus emails (contract confirmation, course notices, password recovery): sent from ia-escola.com through Google Workspace.
• Providers: OVH SAS (France) hosts the campus server in the European Union, with no international transfer; Stripe, Google and Firebase as explained above. We do not sell data and there are no ads on the campus or in the app.
• Retention: account and course data while you have an account. Payment and contract data for up to 6 years from the last transaction (art. 30 of the Spanish Commercial Code and tax rules), blocked and used only for those obligations.

You can ask us to delete your Campus IA-Escola account and the related data, including if you use the Campus IA-Escola app from Google Play. How to do it:

• Email info@ia-escola.com from your account's email address with the subject “Delete my campus account”. You can also request it on the campus or in the app from the user menu › Privacy and policies.
• We delete the account, progress, answers and messages within one month at most. We only keep, blocked, the payment and contract data the law requires us to keep (section 13).
• Deleting your account does not cancel your subscription. If you subscribed in the app, cancel it in Google Play › Payments & subscriptions. If you subscribed on the website, tell us in the same email and we will cancel it.

We publish our own videos to IA Escola's TikTok account (@ia.escola) from an internal panel on ia-escola.com, using TikTok's developer tools (Login Kit and Content Posting API). Only the data controller uses this feature, with their own accounts: website visitors cannot connect their TikTok account to it.

• Data we process: when we connect our account, we ask TikTok only for the user.info.basic (see the connected account), video.upload (send drafts) and video.publish (publish) scopes. TikTok returns an access token, a refresh token and the account ID (open_id). We store them encrypted in a strictly necessary technical cookie of the admin panel (HttpOnly and Secure), not in our database. They stay there only while the account is connected: at most until the refresh token expires under TikTok's rules (up to 365 days) or until we click "Disconnect", which deletes the cookie and revokes the tokens with TikTok. The account's display name, username and avatar are only fetched from TikTok to show them in the panel; we do not store them.
• What we do not do: we do not connect other people's accounts, and this tool does not process data about other TikTok users (comments, followers, messages or statistics). The only personal data that goes through it belongs to the controller's own account.
• Purpose and legal basis: publishing IA Escola's videos and captions on its own TikTok profile. The basis is our legitimate interest in promoting the academy and its courses (Art. 6(1)(f) GDPR). The impact is minimal: it only concerns the controller's own accounts, with the bare minimum scopes, encrypted and revocable at any time.
• What happens when we disconnect: the tokens and the account ID are deleted and the authorisation is revoked with TikTok. Videos already published stay on TikTok until we delete them there.
• Providers: Vercel (USA) hosts the panel and Supabase (EU, Frankfurt) stores the videos before they are published, both as processors (see section 5). TikTok receives the videos, captions and the data needed to authorise and publish, and carries out its own processing; for the EEA the controllers are TikTok Technology Limited (Ireland) and TikTok Information Technologies UK Limited (United Kingdom), joint controllers with each other. That processing is governed by TikTok's privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en.