Privacy policy
What data I use so you can subscribe to and take part in La IA que sirve, what for and for how long.
Last updated:
Data controller
Manuel Sampedro, Spanish tax ID (NIF) 49573698G, calle de Serrano 61, Madrid, España. Contact: manuel@sampedro.io.
Data and purpose
At checkout, Stripe asks for your name, email, mobile number and billing address. Country and postcode are used to check territorial availability and apply VAT. If you buy as a business, you can add your tax ID so it appears on the invoice.
Your email is used to process the subscription, respond to enquiries and send you account information. The purchase is linked to its reference, payment and subscription status and your acceptance of the terms. Join and cancellation alerts on my management devices may show your name, member number, plan and payment details, approximate visit source and the last three digits of your mobile number.
Your mobile number is used to give you access to the WhatsApp group and to check that the person joining is the person who paid. It is stored with your subscription information and is never published.
If you have the Mano a mano plan, I also use your mobile number to message you on WhatsApp and arrange the sessions. What you tell me there or in the video call is only used to help you. Video calls are not recorded unless we agree, and messages are kept in WhatsApp according to its own settings.
This data is processed to prepare and perform the contract and meet applicable legal obligations. Provide only necessary information and avoid sharing other people’s data or confidential documents.
Who else handles your data
Cloudflare hosts the site and the database, and every visit goes through its network. Stripe takes payments, issues invoices and manages the subscription: you enter your full card details on its page and I never see them. Stripe also processes data for its own legal and fraud prevention obligations. The contact email (manuel@sampedro.io) runs on Spacemail, by Spaceship, so what you write to me is stored there. If I enable alerts on my management devices, they are sent encrypted through the browser notification service, which may be provided by Google, Apple, Mozilla or Microsoft.
WhatsApp, by Meta, is where the community lives, and using it comes with its own terms and privacy policy. Your name, phone number and profile may be visible to other participants depending on your WhatsApp settings. A private community is not anonymous among its members, so check your settings before taking part.
Some of these services may process data outside the European Economic Area, including in the United States. Their terms describe safeguards such as the EU-US Data Privacy Framework, for the entities and transfers it covers, or the European Commission’s standard contractual clauses. The applicable safeguard depends on the provider and service; you can request information about it at the contact email. I do not sell your data or share it for third-party advertising.
Retention
Your subscription data is kept while you are a member. After that, only what the law requires, such as invoices, for the periods it sets (generally up to six years). Each section of this page says how long its data is kept, and if you want to know how long something specific is kept, ask me at the contact email.
The course
The members’ crash course is read on the site. If you open it on other devices with a code, only a hashed fingerprint of each device’s cookie and the date it was last used are kept, to limit how many there can be. Only a hashed fingerprint of the code is kept too.
Every page of the course discreetly shows your member number, so a copy can be identified. What is kept about your progress is explained just below.
Your record and your progress in the course
When you join I ask you to confirm your first name and surname, so I know who is who in the group. At first I fill them in with the name you gave at checkout. If you like, you can add what you do, what you would like AI to help you with and how much you already use it. If you come in with a pass I gave you, without going through Stripe, I also ask for your email and mobile number.
While you read, your account keeps which chapters you open and finish, how long you spend reading each one (only while the page is on screen and you are using it), your answers to each chapter’s questions, which templates you copy and which days of the 30-day plan you tick. If you read the free sample, the same is kept for its chapters next to your email, and only from the browser where you asked for it: if someone else types your email into theirs, they can read the sample but cannot see your progress or change whether I write to you.
If you give your opinion of the course, the score, the comment and whether you allow it to be published are kept. Only with your permission can it appear on the site, with your first name, the initial of your surname and what you do, and I take it down as soon as you ask or withdraw the permission. If you ask for the certificate of completion, a page is created with your name, the course edition and the date, which anyone with its link can see.
I use it so the course is consistent across your devices and to help you: knowing where you are, what you find hard and what I can suggest in the group or on WhatsApp. I may add my own notes to your record based on what you tell me. I access it through the private panel, and it is stored in Cloudflare, the hosting provider described above. It is not used for third-party advertising. Opinions and certificates are only shown in the cases explained above.
The legal basis is the performance of your subscription, which includes the course and the group, and my legitimate interest in supporting you. You can turn it off at any time from the course index: what your account kept is deleted and nothing more is kept, although your device still shows it. You can also ask me to delete your record by writing to the contact email.
The detail of what you did and when is kept for up to 13 months. The summary for each chapter and your record are kept while you have access and, after that, like the rest of your subscription data. What you read of the free sample is deleted when you unsubscribe or when your email is deleted.
Proposals for teams
If you ask for a proposal for your team, your name, email, company, team size, what you write and the date are stored. I use them to reply to you, and they are deleted after two years. The legal basis is your request, before a possible contract. They are stored in Cloudflare. If I have management alerts enabled, I receive an encrypted alert on my devices with your name, company, team size and language. They are not used for third-party advertising.
Free sample of the course
If you ask for the free sample of the course, your email, language, the page you asked from and the date are stored. A technical cookie stays in your browser for up to 400 days to open the sample chapters; a cryptographic hash is stored, not its original value.
Your email is used to give you access to the sample. Only if you tick the box do I also use it to write to you about La IA que sirve, twice a month at most. The legal basis is your consent, which you can withdraw at any time with the unsubscribe link in every email, by replying to any of them or by writing to the contact address.
When you unsubscribe, I stop writing to you and delete what you read of the sample. If you didn’t tick the box, the email is deleted after two years. If you did, it is kept until you unsubscribe, and after that only what is needed to avoid writing to you again. It is stored in Cloudflare and used with the access and email services described above. It is not shared for third-party advertising.
Visit statistics
To see what works, the site counts visits without storing tracking identifiers in your browser. For each page viewed it records the address and language; where you came from, such as an Instagram link or a campaign; the approximate country, region, city, postcode, coordinates and time zone that Cloudflare infers from your connection, plus your network provider; your device type, system and browser; the time you spend, how far you scroll and which parts you see. This location comes from the network, not GPS or a location permission, and may be inaccurate. The preference to exclude visits is stored as explained in the cookies section.
It also notes a few actions, such as pressing the button to join, choosing a plan, opening a question, switching language or asking for the sample or a team proposal, and where on the home page you tap, to see which parts confuse people. What you type into forms never goes into the statistics.
The application analytics do not store your IP address in plain text; Cloudflare processes it to serve and protect the site. To group visits from the same day, the application combines the IP and browser details with a key that changes daily and is removed during cleanups. The resulting fingerprint changes each day, but the records are not fully anonymous: a reservation can link them to a purchase, as explained below. Cryptographic fingerprints of the connection are also kept for short abuse limits; expired records are removed during cleanups. If your browser enables Do Not Track or Global Privacy Control, the site does not count your visit.
When you start a reservation, if the visit was measured and can be verified, its identifier is stored along with its source and approximate city, region and country. While payment is being processed and verified, the reservation can link the visit to purchase details. When the subscription is confirmed, the direct link to the visit is removed: the visit is marked as paid, and the subscription retains its source and approximate location. I use this to understand which visits lead to purchases.
When someone joins, the site may show roughly where they are from, using the name of a large city or of their region, never their name. If you arrive with an invitation, its code is kept to apply your discount and the free month for whoever invited you. To stop people inviting themselves, before that month is given the site automatically checks that the two people do not share an email, mobile number or card. That check stores no new data.
Only I see these statistics. They are kept for up to 13 months and processed under legitimate interest in understanding and improving the site. You can object by writing to the contact email.
Your rights
You can ask me what data I hold about you, to correct it, to delete it, to stop using it or limit its use, and to give it to you in a format you can take elsewhere. Write to the contact email and I will reply within a month. If you believe I have not respected your rights, you can complain to the Spanish Data Protection Agency.
Data protection rights, AEPD ↗