Privacy Policy
This Privacy Policy describes how IB Business Mastery ("we", "us") collects, uses and protects the personal data of users of ibbusinessmastery.com (the "Service").
We aim to comply with the EU General Data Protection Regulation (GDPR), the United Kingdom's UK GDPR, the California Consumer Privacy Act (CCPA) and the Mexican Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), as applicable.
1. Who we are (Data Controller)
IB Business Mastery is the data controller responsible for your personal data.
Contact: privacy@ibbusinessmastery.com
Postal address: Ciudad de México, México.
2. What personal data we collect
- Account data: name, email address, hashed password, registration date.
- Progress data: units you mark as completed, quiz scores, time spent.
- Billing data: processed by Stripe; we receive only a customer ID, plan, status and billing email. We do not store credit-card numbers.
- Communications: messages you send via our contact form or email.
- Technical data: browser and device type, referring site, pages visited and time on each page, and the country and city derived from your network connection at the edge (we do not store IP addresses). Collected only if you accept analytics in the cookie banner.
- Marketing data: newsletter subscription, opens/clicks on emails you receive (only if you accept marketing cookies).
3. Why we use your data (legal bases)
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide the Service (course, quizzes, dashboard, certificate) | Performance of contract |
| Process payments and manage subscriptions | Performance of contract |
| Send transactional emails (registration, receipts, password resets) | Legitimate interest / contract |
| Newsletter and marketing emails | Consent (you can withdraw any time) |
| Analytics to improve the Service | Consent |
| Comply with legal obligations (tax, fraud prevention) | Legal obligation |
4. Who we share your data with
We only share what is strictly necessary. Our current processors:
- Supabase: authentication and database storage (data hosted in the EU/US, depending on region).
- Stripe: payment processing (PCI-DSS Level 1 certified).
- Resend / Postmark: transactional email delivery.
- First-party analytics: our own anonymised visitor statistics, stored in our database on Supabase (only if you consent). We do not use Google Analytics or other third-party trackers.
- Netlify / Vercel: site hosting and content delivery.
We never sell your personal data. We may disclose data if required by law or to protect our rights.
5. International transfers
Some processors are based in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent safeguards, for cross-border transfers.
6. How long we keep your data
- Account & progress data: until you delete your account, plus 12 months for backup retention.
- Billing data: 5 years (Mexican tax law requirement).
- Newsletter list: until you unsubscribe.
- Contact form messages: 24 months.
- Analytics: anonymised, no IP addresses; retained for 13 months.
7. Your rights
You have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten"): available from your dashboard.
- Restrict or object to certain processing.
- Port your data in a machine-readable format: available from your dashboard.
- Withdraw consent at any time for the newsletter or analytics.
- Lodge a complaint with your local data protection authority (in Mexico: INAI, inai.org.mx).
To exercise any of these rights, email privacy@ibbusinessmastery.com. We respond within 30 days.
8. Children
The Service is intended for users aged 16 or older. We do not knowingly collect data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, contact us and we will delete it.
9. Security
We use industry-standard safeguards: TLS encryption in transit, encryption at rest, hashed passwords (never plaintext), restricted database access via Row Level Security, and regular backups. No system is 100% secure. We encourage you to use a strong unique password.
10. Cookies
We use cookies and similar technologies. See our Cookie Policy for the full list and your choices.
11. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified via email and a banner on the site. The "Last updated" date at the top reflects the current version.
12. Contact
Questions or requests: privacy@ibbusinessmastery.com.