Privacy policy

This policy explains what personal data we process when you use creactia.com, the book and the GTM Course (the “Service”), what we use it for, on what legal basis, and what rights you have. If you keep using the Service after this policy is updated, your data will be processed under the most recent version.

The Service is not directed at anyone under 18, and we do not knowingly collect data from minors.

Who the data controller is

The data controller is Mario Hernández Pérez-Calvo («creactia»), with tax ID 52596335G and registered address at Av. Ferrer i Domingo 43, 5.º 2.ª, 08191 Rubí (Barcelona) (Spain). For any privacy matter: inquiries@creactia.com, with the subject line “Privacy rights”.

What data we process

We only ask for what we need to run the Service:

1. Data you give us

   • Purchase (book or course): name, email and country. Payment is processed by Stripe: we never see or store your card. We don’t ask for a tax ID or address; we issue a receipt, and an invoice only if you request one.
   • Free sample / trial lesson: your email, so we can send it to you.
   • Course classroom: your email as your access key (magic link), your language, and — if you issue the certificate — the name you want to appear on it.
   • AI tutor: the conversations you have with the tutor and whatever you choose to tell it (your profile, your goals). Each student has their own private memory; the tutor does not use other students’ data, nor yours outside your own classroom.
   • Support: the content of your emails when you write to us.

2. Data generated by using the Service

   • The usual technical data (IP address, device and browser type, pages viewed, date and time), collected by server logs and analytics.
   • Your course progress (completed lessons, quiz results, review cards) is stored in your own browser (localStorage), not on our servers.

3. What we do NOT do: we never sell your data to anyone. We don’t run behavioural advertising or share your data with third parties for their marketing. We don’t buy data about you from external providers. Please don’t send us special categories of data (health, ideology, religion…): we neither need nor want to process them.

What for, and on what legal basis

What you do	What we use	What for	Legal basis (Art. 6 GDPR)
You buy the book or the course	Name, email, country, transaction data	Deliver the product, give you classroom access, send you receipts and the updates included in your purchase	Performance of a contract
You request the free sample	Email	Send it to you (and, at most, one reminder)	Consent
You use the classroom and the AI tutor	Access email, language, conversations with the tutor	Make the classroom and the tutor work and remember your context	Performance of a contract
You issue your certificate	Chosen name + identifier	Generate it and allow public verification by identifier	Performance of a contract
You write to us	Your message and email	Reply to you	Legitimate interest
You browse the website	Technical and usage data	Security, diagnostics and Service improvement; measuring what works	Legitimate interest (and consent for non-essential cookies)
You leave a purchase unfinished	Checkout email	Remind you about it (you can unsubscribe in one click)	Legitimate interest
Legal obligations	Billing and transaction data	Comply with tax and commercial regulations	Legal obligation

Who we share data with (processors)

We use providers that process data on our behalf, under data processing agreements and only for their function:

• Stripe (payments and receipts) — Ireland/USA.
• Anthropic (the AI tutor’s engine: it processes your conversations to answer you) — USA.
• Google Analytics (website analytics) — USA.
• Resend (delivery of purchases, receipts and notices) — US (sending from EU infrastructure).
• Hosting Contabo — EU (Germany).
• Cloudflare (DNS/security) — EU/USA.

Where a provider is outside the EEA, the transfer is covered by the European Commission’s Standard Contractual Clauses or by the EU-U.S. Data Privacy Framework. We may also share data if required by law or to defend our rights, and in the context of a possible sale or restructuring of the business (we would inform you).

How long we keep it

Only as long as needed for each purpose: purchase and billing data, for the periods required by tax regulations (generally 6 years); your classroom access and the tutor’s memory, for as long as your purchase remains active (access is for life, and you can request deletion of the tutor’s memory at any time); sample emails, until you unsubscribe; analytics, for the provider’s standard periods.

Your rights

You can exercise at any time your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent without retroactive effect: write to inquiries@creactia.com with the subject line “Privacy rights”. We will reply within the legal deadline (one month) and may ask you for reasonable identity verification. If you are not satisfied, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es).

Cookies

We use strictly necessary technical cookies (classroom access, language, preferences) and, with your consent, analytics (Google Analytics). Your course progress lives in your browser’s local storage and never leaves it. You can manage or delete cookies from your browser settings; the technical ones are required for the classroom to work.

Security

We apply reasonable technical and organisational measures: TLS encryption on every page, least-privilege access, and per-student isolation of the tutor’s memory. No system is infallible: if you believe your interaction with us is no longer secure, write to us immediately.

Links to other websites

If you leave creactia.com through a link, this policy no longer applies; check the destination site’s policy.