Privacy policy
Last updated 15 October 2026
1. Introduction & data controller
At Jobsties Academy, we are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, process, and safeguard your personal information when you visit our website, interact with our content, or use our services, or work with us as a member of our coaching team, except the Jobsties Platform, which has its own Privacy Policy (see section 12 below).
We process your data in accordance with the General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 on Data Protection (LOPDGDD), and applicable European Union data protection laws.
Data controller: Ana Maria Nedelcu (trading as Jobsties Academy)
Status: Self-employed (autónomo), registered in Spain
Address: Cortina del Muelle 11, 1st Floor, 29015 Málaga, Spain
Email: service@jobsties.com
2. Information we collect
Information you provide directly
- Name and email address when you fill out forms, quizzes, or contact us
- Professional and career-related information you choose to share (experience, goals, current situation)
- Responses to our Career Persona Quiz
- Messages you send us through our website, including bug reports
- Testimonials, reviews, or feedback (only published with your explicit consent)
If you work with us
We keep a list of our coaching team: your name and email address, when you were added and by whom. It is how we know who is currently part of the team. Holding a place on that list is separate from having a Jobsties Platform account, and the list entry stays if an account is closed.
If you use our internal tools, we also keep a record each time you run one of their document reviews: which tool, when, how long it took and what it cost. It is how we keep an eye on use and cost, and we delete each record after 12 months.
Payment information
Payments are processed through secure third-party providers (e.g. via Skool or integrated payment processors). We do not store or have access to your full payment details such as card numbers.
Automatically collected information
- Device and browser information
- IP address: used to tell which country you are in and to stop repeated form submissions. We keep the country, and a one-way code made from the address, which we delete after 30 days
- Website usage data (pages visited, interactions, time spent)
- Download activity (which resources you download, from which page of our site, and any campaign parameters in the link)
- Cookies and tracking technologies (see Cookie Policy)
3. Legal basis & purpose of processing
We process your data in accordance with GDPR Art. 6. Where we rely on legitimate interest, we ensure it does not override your rights.
| Purpose | Data | Legal Basis |
|---|---|---|
| Sending you a free guide you asked for | Email, country, and your name if you give it | Carrying out your request, Art. 6(1)(b) |
| Sending you the career quiz results you asked for | Name, email, quiz responses, country | Carrying out your request, Art. 6(1)(b) |
| Sending news & updates, if you asked for them (the box on a form, or Subscribe again after unsubscribing) and confirmed through the link we email you | Email, the wording you agreed to, and when you asked, confirmed or unsubscribed | Consent, Art. 6(1)(a) |
| Contact inquiries | Name, email, subject, message, country | Legitimate interest, Art. 6(1)(f) |
| Bug reports | Name, email, your message, and device details if you choose to include them | Legitimate interest, Art. 6(1)(f) |
| Analytics (Google Analytics 4) | Pages visited and how the site is used | Consent, Art. 6(1)(a) |
| Analytics (Microsoft Clarity): heatmaps and session recordings | How you move, click and scroll on our pages, the pages you visit, and your device and browser. What you type into a form is masked and never sent | Consent, Art. 6(1)(a) |
| Advertising: letting Google measure and show our ads (Google Ads, through Google Analytics), if you allow marketing | Your visit as Google Analytics measures it | Consent, Art. 6(1)(a) |
| Testimonials | Name, role, company, review | Consent, Art. 6(1)(a) |
| Paid services delivery | Name, email, payment via provider | Contract, Art. 6(1)(b) |
| Download analytics & growth insight | Resource, the page and campaign parameters, country | Legitimate interest, Art. 6(1)(f) |
| Keeping a record of our coaching team | Name, email | Legitimate interest, Art. 6(1)(f) |
| Keeping track of the use and cost of our internal tools | Which team member ran a document review, the tool, when, how long it took and what it cost | Legitimate interest, Art. 6(1)(f) |
| Launch waitlist (app.jobsties.com) | Name, email, country, and whether you want news & updates | Consent, Art. 6(1)(a) |
| Recording consent choices | Your consent choices, country, and a daily one-way code made from your IP address (not the address itself) | Legal obligation, Art. 6(1)(c) |
| Handling a request to delete your data | Email, what you asked for, a one-way code made from your email | Legal obligation, Art. 6(1)(c) |
| Protecting our forms from bots and repeated submissions | Your IP address, and a one-way code made from it | Legitimate interest, Art. 6(1)(f) |
4. Cookies and tracking
We use cookies and similar technologies to ensure the proper functioning of our website and to improve user experience. Essential cookies are necessary for core functionality. Analytics cookies (Google Analytics and Microsoft Clarity) are used only with your consent. With your separate consent to marketing, Google may also use your visit to measure and show our ads; this sets no cookie of its own and loads no other advertising tag. No non-essential cookies are activated without your prior consent. You can manage or withdraw your consent at any time via the cookie settings available on our website. For full details, see our .
5. Data processors & third parties
We do not sell, rent, or trade your personal data. We may share your data with trusted third-party service providers necessary to operate our services, including:
- Website hosting providers (Vercel: USA, EU Standard Contractual Clauses)
- Database (Supabase: EU region, Frankfurt, Germany)
- CMS hosting (Contabo, Germany): the pictures on this site are served from it, so it receives your IP address when your browser loads one, as any web server does
- Email delivery (Resend: EU, Ireland): the emails you ask for, and news if you subscribed
- Email and document storage (Google Workspace, Google: EU and USA, EU-US Data Privacy Framework and EU Standard Contractual Clauses): your messages to us, and encrypted backup copies of our database
- Error monitoring (Sentry: EU data region, Frankfurt, Germany). When something on the site breaks, it receives a technical report: the error, where in our code it occurred, the page address without its parameters, the pages you visited just before it, and your browser, operating system and device type. Reports are stripped of email addresses, sign-in and deletion-link tokens, cookies and form contents before they leave our servers or your browser, IP addresses are not stored, and it sets no cookies
- Bot protection (Cloudflare Turnstile): checks that our forms are being filled in by a person rather than a bot. It receives your IP address and technical details of your browser and connection, and Cloudflare also uses them to improve its own bot detection. Cloudflare’s network is global, so unlike our other providers this check is not guaranteed to take place inside the EU; it is covered by Cloudflare’s data processing agreement. It sets no cookies on our site
- Analytics (Google Analytics 4, Google: USA, EU-US Data Privacy Framework), only with your consent. If you also allow marketing, Google may use the same data to measure and show our ads (Google Ads)
- Heatmaps and session recordings (Microsoft Clarity, Microsoft Ireland: stored in Microsoft’s Azure cloud, with transfers to Microsoft in the USA under EU Standard Contractual Clauses), only with your consent to analytics. It records how you use our pages (clicks, scrolling, mouse movement, the pages you visit, your device and browser) so we can see where the site is hard to use. What you type into a form is masked in your browser and never sent to Microsoft
- Video player (YouTube, Google: USA, EU-US Data Privacy Framework), only when you press play on one of our videos. YouTube then receives your IP address and may store its own cookies
- Community and membership platform (Skool)
All providers process data under appropriate data processing agreements in accordance with GDPR.
6. International data transfers
Some of our service providers may process personal data outside the European Economic Area (EEA), particularly in the United States. In such cases, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework. Your CMS data is stored on servers in Germany (Contabo). Personal data submitted through our forms is stored within the European Union (Supabase, Frankfurt, Germany).
7. Data retention
We retain personal data only for as long as necessary for the purposes described in this policy:
| Data Category | Retention Period |
|---|---|
| Lead data (forms, quizzes) | 24 months after capture |
| News & updates subscription | A request you never confirm: deleted 30 days after you made it. While you are subscribed: kept. After you unsubscribe, or if our emails to you bounce: kept 24 months as the record that we stopped, then deleted |
| Contact & bug-report submissions | 12 months after we receive them |
| Analytics data | 14 months, as set in our Google Analytics account |
| Heatmaps and session recordings (Microsoft Clarity) | 30 days from the recording. Recordings we mark, and a random sample Microsoft keeps, up to 9 months |
| Emails you send to our inbox | Kept as long as needed to answer you and no longer than 12 months, then deleted |
| Testimonials | Until consent is withdrawn |
| Consent records | 36 months, kept as evidence of the consent choices we relied on |
| Internal tools usage record | 12 months |
| Coaching-team record | While you are part of the team. We remove your entry when you leave. |
| Launch waitlist | 24 months after you join |
| Ambassador invitations | Unused invitations: 6 months after they are sent. A used invitation is kept with the testimonial it produced. |
| Ambassador testimonial submissions | Unpublished submissions: 3 years. A published testimonial, and our record of it, stays until you withdraw consent. |
| One-way codes made from your IP address or email address to stop repeated submissions | 30 days |
| Data-deletion requests (your email address and when you asked) | 3 months |
| Download activity | 14 months, used for marketing analysis and to identify potential growth markets |
8. Your rights (GDPR & LOPDGDD)
Under GDPR and the Spanish LOPDGDD, you have the following rights:
- Right to Access (Art. 15): Request a copy of your personal data
- Right to Rectification (Art. 16): Correct inaccurate or incomplete data
- Right to Erasure (Art. 17): Request deletion of your data (“right to be forgotten”)
- Right to Restriction (Art. 18): Limit how we process your data
- Right to Data Portability (Art. 20): Receive your data in a machine-readable format
- Right to Object (Art. 21): Object to processing based on legitimate interest
- Right to Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of prior processing
Stopping our news
We only send news after you ask for it (the box on one of our forms, or Subscribe again on the unsubscribe page) and then confirm through the link we email you; until you confirm, you get nothing but that one email. Every news email, and the guide or quiz email that went with your request, has an unsubscribe link: one click ends it, with no sign-in. Your email app’s own unsubscribe button works too. Emails you ask for, like a guide or your quiz results, are not affected.
Deleting your data
You can request deletion of your data directly via the Delete My Data link in our footer. If we hold data under that address, you’ll receive an email with a secure link (valid 7 days). Confirming erases what we hold under that address automatically, with an option to download a copy first. Messages you sent through our website forms go at once; emails you sent to our inbox are deleted by hand within 30 days of your request. You can also always email service@jobsties.com. This does not delete a Jobsties Platform account: see the Platform Privacy Policy for that.
Deleted data is removed from live systems immediately, and from our encrypted backups within about eight weeks.
To exercise any of these rights, contact us at service@jobsties.com. We will respond within 30 days.
9. Right to complain
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in your country of residence. You may also contact:
- Germany: the data protection authority of your federal state (Land)
- Spain: Agencia Española de Protección de Datos (AEPD): www.aepd.es
10. Data security
We implement appropriate technical and organizational measures to protect your personal information, including secure (TLS/HTTPS) connections, controlled access to systems, and standard security practices designed to prevent unauthorized access, loss, or misuse. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
11. Children's privacy
Our services are intended for adult professionals. We do not knowingly collect personal data from individuals under 14 years of age (minimum age under Spanish law) or under 16 years of age in Germany. If you believe that a minor has provided us with personal data, please contact us immediately and we will take appropriate steps to remove such information.
12. Jobsties Platform accounts
This policy covers our website and our marketing. The Jobsties Platform, at app.jobsties.com, has its own Privacy Policy and Terms of Service. If you have a Platform account, those explain how your account data is handled.
13. Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be published on this page, and the “Last updated” date will be revised accordingly.
Questions?
Write to service@jobsties.com · Impressum
We are not obligated and not willing to participate in dispute resolution proceedings before a consumer arbitration board.