Privacy policy
What data I use so you can subscribe to and take part in La IA que sirve, what for and for how long.
Last updated:
Data controller
Manuel Sampedro, Spanish tax ID (NIF) 49573698G, calle de Serrano 61, Madrid, España. Contact: manuel@sampedro.io.
Data and purpose
At checkout, Stripe asks for your name, email, mobile number and billing address. Country and postcode are used to check territorial availability and apply VAT. If you buy as a business, you can add your tax ID so it appears on the invoice.
Your email is used to process the subscription, respond to enquiries and send you account information. The purchase is linked to its reference, payment and subscription status and your acceptance of the terms. Join and cancellation alerts on my management devices may show your name, member number, plan and payment details, approximate visit source and the last three digits of your mobile number.
Your mobile number is used to give you access to the WhatsApp group and to check that the person joining is the person who paid. It is stored with your subscription information and is never published.
If you have the Mano a mano plan, I also use your mobile number to message you on WhatsApp and arrange the sessions. What you tell me there or in the video call is only used to help you. Video calls are not recorded unless we agree, and messages are kept in WhatsApp according to its own settings.
This data is processed to prepare and perform the contract and meet applicable legal obligations. Provide only necessary information and avoid sharing other people’s data or confidential documents.
Who else handles your data
Cloudflare hosts the site and the database, and every visit goes through its network; it also measures the site’s traffic with Cloudflare Web Analytics. PostHog, Inc. measures how the site is used, from its European cloud in Frankfurt; if you visit from the European Economic Area, the United Kingdom or Switzerland, only once you accept it. Cloudflare Web Analytics is explained in the statistics section and PostHog in its own. Stripe takes payments, issues invoices and manages the subscription: you enter your full card details on its page and I never see them. Stripe also processes data for its own legal and fraud prevention obligations. The contact email (manuel@sampedro.io) runs on Spacemail, by Spaceship, so what you write to me is stored there. If I enable alerts on my management devices, they are sent encrypted through the browser notification service, which may be provided by Google, Apple, Mozilla or Microsoft.
WhatsApp, by Meta, is where the community lives, and using it comes with its own terms and privacy policy. Your name, phone number and profile may be visible to other participants depending on your WhatsApp settings. A private community is not anonymous among its members, so check your settings before taking part.
Some of these services may process data outside the European Economic Area, including in the United States. Their terms describe safeguards such as the EU-US Data Privacy Framework, for the entities and transfers it covers, or the European Commission’s standard contractual clauses. The applicable safeguard depends on the provider and service; you can request information about it at the contact email. I do not sell your data or share it for third-party advertising.
Retention
Your subscription data is kept while you are a member. After that, only what the law requires, such as invoices, for the periods it sets (generally up to six years). Each section of this page says how long its data is kept, and if you want to know how long something specific is kept, ask me at the contact email.
The course
The members’ crash course is read on the site. If you open it on other devices with a code, only a hashed fingerprint of each device’s cookie and the date it was last used are kept, to limit how many there can be. Only a hashed fingerprint of the code is kept too.
Every page of the course discreetly shows your member number, so a copy can be identified. What is kept about your progress is explained just below.
Your record and your progress in the course
When you join I ask you to confirm your first name and surname, so I know who is who in the group. At first I fill them in with the name you gave at checkout. If you like, you can add what you do, what you would like AI to help you with and how much you already use it. If you come in with a pass I gave you, without going through Stripe, I also ask for your email and mobile number.
While you read, your account keeps which chapters you open and finish, how long you spend reading each one (only while the page is on screen and you are using it), your answers to each chapter’s questions, which templates you copy and which days of the 30-day plan you tick. If you read the free sample, the same is kept for its chapters next to your email, and only from the browser where you asked for it: if someone else types your email into theirs, they can read the sample but cannot see your progress or change whether I write to you.
If you give your opinion of the course, the score, the comment and whether you allow it to be published are kept. Only with your permission can it appear on the site, with your first name, the initial of your surname and what you do, and I take it down as soon as you ask or withdraw the permission. If you ask for the certificate of completion, a page is created with your name, the course edition and the date, which anyone with its link can see.
I use it so the course is consistent across your devices and to help you: knowing where you are, what you find hard and what I can suggest in the group or on WhatsApp. I may add my own notes to your record based on what you tell me. I access it through the private panel, and it is stored in Cloudflare, the hosting provider described above. It is not used for third-party advertising. Opinions and certificates are only shown in the cases explained above.
The legal basis is the performance of your subscription, which includes the course and the group, and my legitimate interest in supporting you. You can turn it off at any time from the course index: what your account kept is deleted and nothing more is kept, although your device still shows it. You can also ask me to delete your record by writing to the contact email.
The detail of what you did and when is kept for up to 13 months. The summary for each chapter and your record are kept while you have access and, after that, like the rest of your subscription data. What you read of the free sample is deleted when you unsubscribe or when your email is deleted.
Proposals for teams
If you ask for a proposal for your team, your name, email, company, team size, what you write and the date are stored. I use them to reply to you, and they are deleted after two years. The legal basis is your request, before a possible contract. They are stored in Cloudflare. If I have management alerts enabled, I receive an encrypted alert on my devices with your name, company, team size and language. They are not used for third-party advertising.
Free sample of the course
If you ask for the free sample of the course, your email, language, the page you asked from and the date are stored. A technical cookie stays in your browser for up to 400 days to open the sample chapters; a cryptographic hash is stored, not its original value.
Your email is used to give you access to the sample. Only if you tick the box do I also use it to write to you about La IA que sirve, twice a month at most. The legal basis is your consent, which you can withdraw at any time with the unsubscribe link in every email, by replying to any of them or by writing to the contact address.
When you unsubscribe, I stop writing to you and delete what you read of the sample. If you didn’t tick the box, the email is deleted after two years. If you did, it is kept until you unsubscribe, and after that only what is needed to avoid writing to you again. It is stored in Cloudflare and used with the access and email services described above. It is not shared for third-party advertising.
Visit statistics
To see what works, the site counts visits without storing tracking identifiers in your browser. For each page viewed it records the address and language; where you came from, such as an Instagram link or a campaign; the approximate country, region, city, postcode, coordinates and time zone that Cloudflare infers from your connection, plus your network provider; your device type, system and browser; the time you spend, how far you scroll and which parts you see. This location comes from the network, not GPS or a location permission, and may be inaccurate. The preference to exclude visits is stored as explained in the cookies section.
It also notes a few actions, such as pressing the button to join, choosing a plan, opening a question, switching language or asking for the sample or a team proposal, and where on the home page you tap, to see which parts confuse people. What you type into forms never goes into the statistics.
The application analytics do not store your IP address in plain text; Cloudflare processes it to serve and protect the site. To group visits from the same day, the application combines the IP and browser details with a key that changes daily and is removed during cleanups. The resulting fingerprint changes each day, but the records are not fully anonymous: a reservation can link them to a purchase, as explained below. Cryptographic fingerprints of the connection are also kept for short abuse limits; expired records are removed during cleanups. If your browser enables Do Not Track or Global Privacy Control, these application analytics do not count your visit. Cloudflare Web Analytics, described below, does not take those signals into account.
When you start a reservation, if the visit was measured and can be verified, its identifier is stored along with its source and approximate city, region and country. While payment is being processed and verified, the reservation can link the visit to purchase details. When the subscription is confirmed, the direct link to the visit is removed: the visit is marked as paid, and the subscription retains its source and approximate location. I use this to understand which visits lead to purchases.
When someone joins, the site may show roughly where they are from, using the name of a large city or of their region, never their name. If you arrive with an invitation, its code is kept to apply your discount and the free month for whoever invited you. To stop people inviting themselves, before that month is given the site automatically checks that the two people do not share an email, mobile number or card. That check stores no new data.
Only I see these statistics. They are kept for up to 13 months and processed under legitimate interest in understanding and improving the site. You can object by writing to the contact email.
In addition, every page loads Cloudflare Web Analytics, by Cloudflare, Inc., to measure the site’s traffic. It uses no cookies, stores nothing in your browser and builds no personal profiles. It collects the page address, where you came from, the browser and device type and the approximate country, and shows them in aggregate. Cloudflare acts as a processor under its data processing agreement (DPA). Any international transfers this involves are covered by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. The legal basis is my legitimate interest in measuring the site’s aggregated traffic (art. 6.1.f GDPR).
Analytics with PostHog and your consent
I also use PostHog, by PostHog, Inc., to understand the path people take through the site before joining. It only runs on sampedro.io. Before loading it, the site asks its own server whether the visit comes from the European Economic Area (the European Union, Iceland, Liechtenstein and Norway), the United Kingdom or Switzerland. Cloudflare infers the country from your connection when serving the page; the answer only says whether to show you the notice, and neither your IP nor your country is stored. If you visit from those countries, or if it cannot be known for sure (the answer takes more than a second and a half or fails, the country is unknown or the connection comes through Tor), PostHog does not load or receive a single request until you press “Accept” on the notice. From other countries it loads directly. It never loads if your browser enables Do Not Track or Global Privacy Control, GPC, or if you have excluded this browser from the statistics.
When it is active, PostHog receives these events: $pageview, when you open a page or the address changes; $pageleave, when you leave it; $autocapture and $rageclick, with clicks on links and buttons, repeated clicks and forms being sent or changed, with the text and type of each element, but never what you type; cta_click, when you press a button to join or to ask me for a session, with which button and where on the page; checkout_started, when you open the Stripe checkout, with the chosen plan; contact_form_submitted, when you send the request for your team, without what you wrote; and cookie_consent, when you press “Accept” on the notice, with that decision (“Reject” sends nothing). Every event carries the page address and title, where you came from and any campaign parameters, your browser, system, device type, language, time zone and screen size, the site name, the internal mark if it is one of my own test visits, and a random visitor identifier and session identifier that last while the tab is open. PostHog uses no cookies and, while it is on, stores nothing in local storage; here it does not record sessions or run surveys.
With PostHog on, four kinds of diagnostic data are also sent. Heatmaps ($$heatmap) collect, every few seconds and per page address, where you click (including repeated clicks and clicks that do nothing), the points where the mouse pointer stops and whether the element was fixed on screen. Dead clicks ($dead_click) are clicks after which nothing on the page changes for about two and a half seconds; on touch screens, swipes that move nothing are counted too ($dead_swipe, at most ten per page). They carry the same element details as other clicks and how long there was no response. Performance ($web_vitals) measures how long the page takes to show its first content and its main element, how much the content shifts while loading and how long it takes to react when you tap or click something (FCP, LCP, CLS and INP); for LCP and INP it adds which element or image it was and the breakdown of those times. Errors ($exception) are the JavaScript failures the page does not handle, with their type, their message and the files, functions and lines of code where they happened. None of them collects what you type or records the screen.
If you pay while PostHog is active, that random identifier travels with the payment and, once it is confirmed, the site sends PostHog the purchase_completed event with the plan, the amount, the currency and the address of the page you opened the checkout from. If PostHog was not active in your browser, the purchase is not reported to it. Your name, email, mobile number or any account identifier never reach it, and no person profiles are created.
PostHog receives your IP address with each event, infers your approximate location from it (country, region and city) and discards it: the project is set up not to store it. PostHog acts as a processor under its data processing agreement (DPA) and stores the data in its European cloud, in Frankfurt (Germany); if its staff access it from outside the European Economic Area, the European Commission’s standard contractual clauses apply. Only I see this data. On PostHog’s free plan, which is the one I use, it is kept for one year.
The legal basis is your consent (art. 6.1.a GDPR) if you visit from the European Economic Area, the United Kingdom or Switzerland, and my legitimate interest in understanding and improving the site (art. 6.1.f GDPR) from other countries.
You can withdraw your consent or object at any time from “Privacy preferences”, at the foot of every page: with “Reject”, PostHog stops sending data, the visit’s identifier is deleted and it does not load again unless you accept. Your browser keeps only your decision and PostHog’s mark that stops it from sending anything, as explained in the cookies section. Withdrawing does not affect what was sent earlier with your consent. You can also object or withdraw by writing to the contact email.
Your rights
You can ask me what data I hold about you, to correct it, to delete it, to stop using it or limit its use, and to give it to you in a format you can take elsewhere. Write to the contact email and I will reply within a month. If you believe I have not respected your rights, you can complain to the Spanish Data Protection Agency.
Data protection rights, AEPD ↗