Privacy Policy
Last updated: October 22, 2026
1. Data controller
IAcademy (in formation), domiciled in Spain. Contact: info@iacedemy.com
2. Data we collect
- Email: when you register for the free course or make a purchase.
- Payment data: processed directly by Stripe. We do not store card data.
- Browsing data: analytics cookies (PostHog, hosted on an EU server).
- Origin of a purchase: if you accept analytics or marketing cookies and buy from our website, we store with your purchase the campaign you arrived from (the link's
utm parameters and, with marketing consent only, the ad click identifier). It tells us which ads and emails lead to sales. Anything that does not end in a purchase is deleted after 90 days.
- Name (optional): when generating a quiz certificate. This data is stored exclusively in your browser (localStorage) and is not sent to our servers.
- Evidence from the competence pilot programme (optional): if you participate in the pilot, the text of your submission, the decisión made and its rationale. It is evaluated with the assistance of a language model and human review: only content classified as public is sent to the model provider, while the rest remains within our infrastructure.
- Calls to our support line: if you call us, an artificial intelligence assistant answers and tells you so at the start. We process your phone number, what you say during the call (its transcript and, where enabled, the recording) and, if you are transferred to the team's voicemail, the voice message you leave, which reaches us by email. Do not give passwords, access codes or card details over the phone: the assistant does not need them. If you are interested in a course or want us to contact you, the assistant asks for your name, your email and what you are interested in, and asks whether you agree to us writing to you.
- Quiz data: score, date and result are stored in your browser's localStorage. They are not sent to servers except for anonymous events sent to PostHog (module completed, score). If you register on the portal, your progress and results are stored on our servers so that you can consult them.
3. Purpose of processing
- To provide access to the course and purchased resources.
- To send course-related emails (welcome, content and updates).
- To send marketing communications about IAcademy products (you may unsubscribe at any time).
- To evaluate submissions to the competence pilot programme, with AI assistance and human review, and keep a record of the decisión so that you can challenge it.
- To handle your calls with the AI phone assistant and, where needed, pass your message to the team so that we can reply.
- To write to you about the course or topic you are interested in, if you agree to it during the call.
- To answer your questions with the AI tutor and to mark your answers to the open-ended quiz exercises.
- To improve the user experience through pseudonymised web analytics (aggregate usage measurement without directly identifying you).
4. Legal basis
- Consent: when you register voluntarily.
- Performance of a contract: when you make a purchase and, if you participate, when your submissions to the pilot programme are evaluated.
- Legitimate interest and steps taken at your request: handling the call you start and answering your enquiry.
- Consent: writing to you after a call about what you are interested in. You give it verbally during the call and may withdraw it at any time by writing to info@iacedemy.com.
- Consent: web analytics. It is activated only if you accept analytics cookies, and you may withdraw consent at any time from the cookie notice.
5. Recipients
- Brevo (Sendinblue): email marketing management. EU servers. If you agree by phone to us writing to you, it sends you an email to confirm your address and then the information about what you are interested in.
- Stripe: payment processing. PCI DSS compliant.
- Cloudflare: hosting and content delivery network. EU-US Data Privacy Framework (DPF) and standard contractual clauses.
- Google: tags and audience measurement (Tag Manager and Analytics) under Consent Mode v2. EU-US Data Privacy Framework (DPF) and standard contractual clauses.
- PostHog: web analytics. EU server (eu.posthog.com).
- Hetzner Online: hosting of the platform and of our own language model. Servers in Germany (EU).
- Mistral AI (France, EU): language model for the AI tutor, quiz marking and the evaluation of pilot submissions. It receives only the text of your question or answer, without your name, email or any other identifier of your account. Before anything is sent, an automatic filter detects emails, phone numbers, ID numbers, IBANs, cards and health, trade-union, religious or payroll data: that content never leaves for an external provider and is answered by our own model. Processing in the EU under a data processing agreement.
- Zadarma: telephony (phone number, PBX, voicemail and AI voice assistant). It handles the call, its transcript and, where enabled, the recording, in its data centres in Madrid (Spain) and Frankfurt (Germany), within the EU. We delete the recordings there after 90 days at most.
- Mistral AI (France, EU), calls: it transcribes the recording of calls to our support line and extracts from it a summary and, if you gave them to us, your name, email and interest, so that we can alert the team and, if you agreed, write to you. The filter described above does not apply to this use, because that data is precisely what you ask us to keep.
- OpenAI (United States): language model for the phone assistant, through Zadarma. It receives the transcript of what you say during the call in order to generate the reply.
- DeepSeek (China): backup provider. It only receives a request when Mistral is unavailable, with the same content and the same filter. China does not have an adequacy decision from the European Commission.
We do not sell or share your data with third parties for advertising purposes.
International transfers: Stripe, Cloudflare, Google and OpenAI are based in the United States. Transfers rely on the adequacy decisión for the EU-US Data Privacy Framework (DPF) and, where that is insufficient, on standard contractual clauses. We are completing the contractual documentation for each provider. DeepSeek, the AI tutor's backup provider, is in China: see "Recipients".
6. Retention
- Account data: as long as you maintain course access.
- Billing data: 5 years (legal obligation).
- Browsing data: while your consent remains active; the analytics cookie may last up to 12 months.
- Calls to our support line (transcripts, recordings and voice messages): as long as needed to handle your enquiry and no longer than 90 days.
- Contact details you give us by phone so that we can write to you (name, email and interest): until you withdraw consent or, at most, 12 months without contact.
- Evidence from the competence pilot: 24 months or until you request erasure. Decisions and their hash are retained for 5 years, and AI traces for 90 days.
7. Your rights
You can exercise your rights of access, rectification, erasure, portability, restriction and objection by sending an email to info@iacedemy.com. We respond within a maximum of 30 days.
You can also file a complaint with the Spanish Data Protection Agency.
8. Cookies and local storage
| Type |
Provider |
Duration |
Legal basis |
| Technical (session, necessary) |
IAcademy |
Session |
Consent is not required |
| Analytics |
PostHog (EU) |
90 days |
Consent |
| Functional (browser storage: quiz results, certificate name and email, student identifier, session token and vídeo progress) |
Local browser |
Until manually deleted |
These are not technically cookies. They are not sent to servers. |
We do not use advertising or profiling cookies. PostHog and Google analytics are activated only if you accept analytics cookies, and you may withdraw consent at any time from the cookie notice. You can also disable them in your browser settings.
9. Children
IAcademy is not intended for children under 16. We do not knowingly collect data from children. If you are a parent or guardian and believe that a child has provided us with personal data, contact us at info@iacedemy.com and we will delete it.
10. Security
We apply technical and organizational measures to protect your data: HTTPS across the entire site, EU-based servers and restricted access to personal data.
11. Changes
We reserve the right to update this policy. The update date will always be visible at the top.