1. Who is responsible for your data
Data controller: Maxim Postnikov, sole trader (NIE Y6205622Y), Barcelona, Spain.
For any data-related questions: [email protected] — I answer personally.
2. What data is collected
- When you enrol: name, email, Telegram handle.
- Student profile: what you fill in yourself — professional context, learning goals, experience.
- Payment: payment status and amount, payment method. Card details are processed by the payment provider Stripe — we never see or store them. For non-card payments (bank transfer, barter) only the amount and method are recorded.
- Learning process: module progress, submitted assignments, attendance. Zoom sessions are recorded — recordings are available to students of the cohort.
- Technical: server logs (IP, request timestamps) and minimal functional cookies: login session, chosen theme, referral-link marker. No advertising trackers.
3. Why and on what legal basis
| What we do | Legal basis |
|---|---|
| Run your account, give access to materials, send you emails about your enrolment and payment | Performance of a contract — GDPR Art. 6(1)(b) |
| Tell people who submitted a request or joined the waiting list about the next cohort opening | Legitimate interest — Art. 6(1)(f); every email includes an opt-out |
| Marketing emails beyond that | Only with separate consent — Art. 6(1)(a) |
| Keep invoices and payment records | Legal obligations (tax, accounting) — Art. 6(1)(c) |
4. Who we share data with
Only with the services the course can’t run without (processors under GDPR Art. 28):
- Stripe — payment processing
- Supabase — platform database
- Hetzner — hosting (servers in the EU)
- Google Workspace — email
- Telegram — course chat and learning bot
- Zoom — live sessions and their recordings
- Anthropic, OpenAI — AI providers: processing of course materials and your profile to personalise assignments, with your consent
We never sell data or hand it to “partners”. If a service processes data outside the EEA, the transfer relies on the EU Standard Contractual Clauses (SCC) or an adequacy decision.
5. How long we keep it
- Enrolment and learning data — for the duration of the course and up to 3 years after (alumni access to materials, invitations to future cohorts) or until you ask us to delete it.
- Payment and accounting records — up to 6 years (required by Spanish law).
- Session recordings — for as long as cohort and alumni access is open.
6. Your rights
At any time you can: request a copy of your data, correct it, delete it (except what we’re legally required to keep), restrict processing, take your data in a machine-readable format, object to processing based on legitimate interest, withdraw consent.
An email to [email protected] is enough. If you believe your rights have been violated, you may lodge a complaint with the Spanish data protection authority — AEPD (www.aepd.es) — or with the supervisory authority in your country.
7. Changes to this policy
When the policy changes, its version (the date at the top of the page) is updated. The consent given at enrolment is tied to the version in force at that time.