Privacy policy

The controller for the data described here is Igor Katsuba (NIF/NIE Z3997683N), Carrer Cabanyal 59, 6-11, 46120 Alboraya, Valencia, Spain. Privacy questions and data-subject requests go to igor@ng.guide.

The operation is small enough that there is no data protection officer, and none is required. The person reading that inbox is the same person who wrote the course.

Everything below is data the service actually writes to its database today. It is not a list of what we might collect one day.

Separately from all of that, we count visits with our own cookieless counter. It sets no cookie, stores nothing tied to your account, and never learns you are signed in — the url is redacted in your browser before it is sent and again on our server before anything is stored, so the Stripe session id on the checkout return page, every admin url, and the address of any invitation link you were sent are removed rather than recorded. What remains per pageview is the page, the referring domain, the country and a visitor hash that changes every day. The full account is in the cookie policy.

Beyond that there is no tracking, no advertising, no profiling for marketing, no session recorder, and no custom analytics events. If that changes, this section changes with it, in the same commit.

A course runs through an agent you bring — Claude Code, Cursor, Zed, Codex. That agent sends what it needs to your model provider, under your account with them. Lesson text, your code, your questions and your answers pass through that channel.

We are not a party to it and we cannot see it. What Anthropic, OpenAI or anyone else does with what your agent sends them is governed by the agreement you have with them, not by this policy.

What reaches us is only what the agent submits to the course server: the answer, the evidence for a completed step, and which lesson you are on.

• Performance of a contract (art. 6(1)(b)) — your account, your licence, your progress, the purchase email. Without these there is no course to deliver.
• Legal obligation (art. 6(1)(c)) — keeping order records for tax and accounting purposes.
• Legitimate interest (art. 6(1)(f)) — session IP and user agent for security, rate limiting, being alerted that an unanswered message is sitting in the inbox, and the aggregated traffic counts from our own analytics. The interest is running the service safely and knowing which pages are worth writing more of; the impact on you is minimal, and you can object at any time.

We do not rely on consent for anything today, because nothing we do needs it — the analytics is cookieless and anonymous, and there is no marketing list. Every email we send is transactional.

These providers process data on our behalf, each under their own data processing agreement. They are not allowed to use it for their own purposes.

Nobody buys this data, and there is no arrangement under which anyone could. We disclose data to authorities only where the law actually requires it.

Some of those providers are US companies or run infrastructure outside the EEA. Where data leaves the EEA it travels under the safeguards in each provider’s data processing agreement — the European Commission’s standard contractual clauses, or an adequacy decision where one applies. If you want to know which safeguard covers a specific provider, ask and we will tell you.

• Account, licence and learning data: for as long as you have an account. A licence is not time-limited, and neither is the progress attached to it.
• Sessions: a session token lasts 7 days. Expired rows are pruned periodically, and all of them go when the account does.
• Order records: for as long as you have an account, and they go with it. Stripe is merchant of record for the sale, so the invoice the law cares about is Stripe’s, not ours — our order row binds a payment to a licence and has no reason to outlive the account.
• Messages between you and us: until you ask us to delete them, or the account goes.
• Vercel request logs: whatever retention Vercel applies to its log products, which we do not extend.

Under the GDPR you can ask for access to your data, a copy of it in a portable format, correction, deletion, restriction of processing, and you can object to processing based on legitimate interest.

There is no self-service button for this yet. Email igor@ng.guide from the address on your account and it is handled by hand, within 30 days. Saying so plainly is better than pointing you at a dashboard control that does not exist.

Erasure means erasure: the account, sessions, connected accounts, agent authorisations, licences, orders, every answer and every scrap of progress, the message thread, and the records keyed by your email address rather than by account id. You get the export first, so you keep a copy of what was deleted.

One boundary worth stating rather than burying: it does not reach Stripe. Stripe holds the payment as merchant of record under its own retention, and that is a request you make to them. The same goes for anything your agent sent to your own model provider — we never held it, so we cannot delete it.

If you are unhappy with how we handled it, you can complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos, or to the authority where you live.

The course decides on its own when a topic is due for review and whether an answer was correct. That is grading and scheduling — it changes which lesson you see next and nothing else. It produces no legal or similarly significant effect on you within the meaning of art. 22, and no human outside the service ever sees it.

Traffic is encrypted in transit, the database is encrypted at rest by the provider, secrets live in the deployment platform rather than the repository, and access to production is limited to the one person who runs it.

Administrators can sign in as a user to debug an account. It is logged on the session record. It is a power worth naming rather than burying, and it is used to reproduce bugs, not to read your messages.

If a breach happens and it is likely to be a risk to you, we notify the supervisory authority within 72 hours and tell you directly where the risk is high.

The service is for adults and is not directed at children. We do not knowingly hold data about anyone under 14 — the age of digital consent in Spain. Tell us if we do, and it goes.

This policy changes when the code changes — a new processor, a new kind of data, a new purpose. The date at the top says when it last did. If a change materially affects how your data is used, the email on your account hears about it before it takes effect.