Privacy Policy
Last updated: September 11, 2026
1. Data controller
IAcademy (in formation), domiciled in Spain. Contact: [email protected]
2. Data we collect
- Email: when you register for the free course or make a purchase.
- Payment data: processed directly by Stripe. We do not store card data.
- Browsing data: analytics cookies (PostHog, hosted on an EU server).
- Name (optional): when generating a quiz certificate. This data is stored exclusively in your browser (localStorage) and is not sent to our servers.
- Evidence from the competence pilot programme (optional): if you participate in the pilot, the text of your submission, the decision made and its rationale. It is evaluated with the assistance of a language model and human review: only content classified as public is sent to the model provider, while the rest remains within our infrastructure.
- Quiz data: score, date and result are stored in your browser's localStorage. They are not sent to servers except for anonymous events sent to PostHog (module completed, score). If you register on the portal, your progress and results are stored on our servers so that you can consult them.
3. Purpose of processing
- To provide access to the course and purchased resources.
- To send course-related emails (welcome, content and updates).
- To send marketing communications about IAcademy products (you may unsubscribe at any time).
- To evaluate submissions to the competence pilot programme, with AI assistance and human review, and keep a record of the decision so that you can challenge it.
- To improve the user experience through pseudonymised web analytics (aggregate usage measurement without directly identifying you).
4. Legal basis
- Consent: when you register voluntarily.
- Performance of a contract: when you make a purchase and, if you participate, when your submissions to the pilot programme are evaluated.
- Consent: web analytics. It is activated only if you accept analytics cookies, and you may withdraw consent at any time from the cookie notice.
5. Recipients
- Brevo (Sendinblue): email marketing management. EU servers.
- Stripe: payment processing. PCI DSS compliant.
- Cloudflare: hosting and content delivery network. EU-US Data Privacy Framework (DPF) and standard contractual clauses.
- Google: tags and audience measurement (Tag Manager and Analytics) under Consent Mode v2. EU-US Data Privacy Framework (DPF) and standard contractual clauses.
- PostHog: web analytics. EU server (eu.posthog.com).
- Language model provider: receives only content classified as public from pilot submissions. The documentation for its international transfer is still being completed.
We do not sell or share your data with third parties for advertising purposes.
International transfers: Stripe, Cloudflare and Google are based in the United States. Transfers rely on the adequacy decision for the EU-US Data Privacy Framework (DPF) and, where that is insufficient, on standard contractual clauses. We are completing the contractual documentation for each provider.
6. Retention
- Account data: as long as you maintain course access.
- Billing data: 5 years (legal obligation).
- Browsing data: while your consent remains active; the analytics cookie may last up to 12 months.
- Evidence from the competence pilot: 24 months or until you request erasure. Decisions and their hash are retained for 5 years, and AI traces for 90 days.
7. Your rights
You can exercise your rights of access, rectification, erasure, portability, restriction and objection by sending an email to [email protected]. We respond within a maximum of 30 days.
You can also file a complaint with the Spanish Data Protection Agency.
8. Cookies and local storage
| Type |
Provider |
Duration |
Legal basis |
| Technical (session, necessary) |
IAcademy |
Session |
Consent is not required |
| Analytics |
PostHog (EU) |
90 days |
Consent |
| Functional (browser storage: quiz results, certificate name and email, student identifier, session token and video progress) |
Local browser |
Until manually deleted |
These are not technically cookies. They are not sent to servers. |
We do not use advertising or profiling cookies. PostHog and Google analytics are activated only if you accept analytics cookies, and you may withdraw consent at any time from the cookie notice. You can also disable them in your browser settings.
9. Children
IAcademy is not intended for children under 16. We do not knowingly collect data from children. If you are a parent or guardian and believe that a child has provided us with personal data, contact us at [email protected] and we will delete it.
10. Security
We apply technical and organizational measures to protect your data: HTTPS across the entire site, EU-based servers and restricted access to personal data.
11. Changes
We reserve the right to update this policy. The update date will always be visible at the top.