Privacy policy

1. Data controller

Bit AI School is the trading name of an online training project run by Jordi Bravo, an individual based at 8, Rue de Stavelot, L-2553 Luxembourg (Grand Duchy of Luxembourg). He owns this site, sells the course and is the controller of your personal data. For any legal or privacy matter you can write to hola@bitaischool.com.

2. What data we collect

If you create an account: your email address, a password (stored only as a PBKDF2 cryptographic hash, never in plain text), optionally your name, your chosen language, the date you signed up and your last login date.

Your course progress: which pages you’ve completed, where you left off, and the status of your exercises, so you can pick up from the same place on any device.

If you give us your email without creating an account (on any of the three forms that ask for it: at the end of lesson 3, at the bottom of the full-plan page, or at the end of a lesson page or an article): your address, the consent you ticked, the exact text you accepted, the date, and how far along the series of three emails you asked for has got.

Minimal usage and attribution metrics: events such as “home page viewed”, “lesson started” or “exercise completed”, with a random visitor ID, language, page and date. If you arrive from a campaign, we store its campaign parameters or click identifiers, the page you landed on, only the referring domain — never the full address — and the approximate country our own edge server reports. We do not store your IP in plain text or anything you type in exercises. This data is for our own statistics; the only thing that goes to an advertising platform is the three purchase events described in section 5.

If you buy Bit AI School Complete: the transaction ID, amount, currency, email linked to the purchase, purchase code and date. We do not receive or store your card details: you enter them directly in the payment gateway, which handles them.

If you register interest for your company: the company name, your name, work email, approximate team size, the need you describe and the consent text you accepted.

3. What we use your data for and on what legal basis

Service delivery (art. 6.1.b GDPR): giving you access to your account, keeping you signed in, saving your progress and sending you essential account emails (email confirmation and password reset).

Consent (art. 6.1.a GDPR): sending you, if you ticked the box on any of those three forms, a series of three emails over nine days summarising what the lessons teach and ending with the price and its conditions. We also record which of the three you asked from, so we know which one works and which does not. On the ninth day the series ends by itself and nothing further is sent. Every email carries an unsubscribe link that works in a single click, with no forms and no questions, and unsubscribing does not affect your access to the course. We send nothing to anyone who did not tick that box, and an address that has unsubscribed does not come back to the list even if someone types it into the form again.

Legitimate interest (art. 6.1.f GDPR): aggregated metrics to understand which lessons are effective, knowing which campaign brought someone who signs up or buys — so advertising is not spent blindly — and protection against abuse through request limits. That link between a visit and a person is made on our servers, not in your browser, and we do not use it to build any profile of you or to show you advertising inside the course.

Consent (art. 6.1.a GDPR): measuring how well our advertising works. Only if you accept the cookie notice do we load the Meta pixel in your browser and send Meta the three events described in section 5. If you reject it, or have not answered the notice yet, nothing is loaded and nothing is sent: not the visit, not the started purchase, not the purchase itself. You can withdraw your consent whenever you like from “Cookies” in the footer, with the same single click that gave it; withdrawing it does not affect your access to the course or the lawfulness of what was sent before.

Consent (art. 6.1.a GDPR): storing and responding to a company interest request. The form starts no automatic follow-up or email.

4. Cookies

We use three first-party cookies: aula_sid, which keeps you signed in; aula_lang, which remembers your chosen language; and aula_vid, a random meaningless number that lets us count visits and know which campaign brought you. All three are httpOnly, Secure and SameSite=Lax; the session one lasts 30 days and the measurement one 90. In addition, and only if you accept it in the cookie notice, the Meta pixel is loaded; it is a third party and sets its own cookies (_fbp and, if you arrive from an ad, _fbc) to measure our advertising. Until you accept, it is neither loaded nor contacted: there is no other external tracker on these pages.

aula_vid does not ask for your consent because it is a first-party audience-measurement cookie, exempt under the Spanish data protection authority’s cookie guidance: only we use it, only for our own statistics, with no profiling and no tracking across other sites. Its number is not passed to anyone, Meta included: the transmissions in section 5 never contain it, precisely so this cookie stays what it says it is. Even so, we respect your choice: if your browser sends a do-not-track signal — Global Privacy Control or “Do Not Track” — we do not set it, your visit only counts towards the total, and nothing is sent to Meta either.

If you browse without an account, your progress is saved in your browser’s local storage (this is not a cookie and is not sent to our servers until you create an account and choose to keep it).

Your choice is stored for a year in the aula_consent cookie — and in your browser’s local storage — and it only says “accepted” or “rejected”: it carries no data about you. Rejecting costs exactly the same as accepting, one click, and not answering counts as rejecting. To change it, press “Cookies” in the footer and the notice comes back with both options. If your browser sends a do-not-track signal, the pixel is not loaded even if you had accepted.

5. Who we share data with

We do not sell or pass on personal data. We use only the essential data processors: the infrastructure provider that hosts the application and its database (servers in the European Union), and the provider for sending transactional emails. Both act under contract and only follow our instructions.

If you make a purchase, the payment gateway processes your payment details as an independent data controller, according to its own policy, to carry out the transaction and comply with anti-fraud and accounting regulations. We only receive confirmation of payment and the minimum details of the transaction.

Advertising measurement (Meta). When we advertise the course on Facebook or Instagram we send Meta Platforms Ireland Ltd. three events: that the sales page was viewed, that a purchase was started, and that a purchase was completed, the last one with its amount and currency. They travel by two routes that Meta merges into one, because they carry the same event identifier: your browser, with the pixel that is only loaded if you have accepted it, and our server. So that Meta can tell which ad they belong to, each transmission carries the click identifier that Meta itself added to the address when it brought you here, plus your email and country hashed with SHA-256, a one-way digest function: Meta receives the digest, never the readable value, and cannot reverse it. There is a single purpose: knowing which ads work. We do not send Meta your progress, your exercises, your activity inside the course, or the number in the aula_vid cookie. Meta processes that information as a joint controller with us for measurement, and under its own policy for its advertising; it may process it outside the European Union under the adequacy decision between the European Union and the United States. None of this happens if you reject the cookie notice, if you have not answered it yet, or if your browser sends a do-not-track signal.

6. How long we keep your data

Your account data and progress are kept as long as your account exists. If you delete your account, your data is erased immediately and irreversibly.

Confirmation and reset tokens expire after 24 hours and 60 minutes respectively, and become invalid after first use.

Usage events and attribution data are kept for a maximum of 24 months and are then deleted automatically. Consent records are kept as long as needed to prove consent was given. Of each transmission to Meta we keep only a technical note — which event, when, and whether it was accepted — with no personal data, deleted after the same 24 months; whatever Meta keeps is governed by its own policy.

If you left us your email without an account, the address and the record of the series are kept until you unsubscribe; when you do, the opt-out is recorded and we never write to you again. You can ask for complete deletion by writing to hola@bitaischool.com.

Purchase data is kept for the periods required by commercial and tax regulations, even if you delete your account. In that case, the purchase is no longer linked to you: it is kept as an accounting record with no connection to any account.

7. Your rights

You can access, correct, delete, restrict or object to the processing of your data, and request your data in a portable format. From your account panel you can download all your data as a JSON file and delete your account completely, without filling in any forms.

You can also write to us at hola@bitaischool.com. If you believe we have not dealt with your request, you can complain to the supervisory authority of the country where you habitually live —in Spain, the Spanish Data Protection Agency (aepd.es)— or to the controller's lead authority, which, as he is established in Luxembourg, is the Commission nationale pour la protection des données (cnpd.public.lu).

8. Security

The application is always served over HTTPS. Passwords are stored with PBKDF2-SHA256 and 210,000 iterations using a random salt for each user. Sessions and one-time tokens are stored as SHA-256 hashes, never in plain text. When you reset your password, all open sessions are automatically closed.

9. Minors

This service is intended for people aged 14 and over. If we detect an account belonging to someone under this age without their guardians’ permission, we will delete it.

10. Changes

If we update this policy, we will change the date above. If the change affects the legal basis or the purposes, we will let you know by email before it takes effect.