This policy describes what personal data the postnikov.ai website collects and what happens to it. Short and free of legal fog — but in line with Regulation (EU) 2016/679 (GDPR).
1. Who is responsible for your data
Data controller: Maxim Postnikov, sole trader (NIE Y6205622Y), Barcelona, Spain.
For any question about your data: [email protected] — I answer personally.
2. What data is collected
- Sign-up form: name, email, Telegram handle — what you enter yourself in the form on a program page (the mastermind, for example). Applications are stored in the same database as sign-ups for the “AI Anti-Magic” course: the controller is one and the same.
- Questions for the meetups: the text of your question and, if you wish, a name — what you enter yourself in the form on a meetup page (postnikov.ai/ask). Plus the page language, the time it was sent and the version of this policy you agreed to. No IP address is stored with the question. The question, and your name if you gave one, may be read out live and in the recording of the session, which is published on YouTube. Optionally, your Telegram username, so I can message you personally about your question: only I see it, in my own working interface; it is never read out live or in the recording and is not passed to third parties. Questions are stored in the events database of the PRO community — the controller is one and the same.
- Correspondence: if you write to me by email or on Telegram — whatever you send yourself.
- Technical data: server logs (IP address, request time, requested page, user agent).
Cloudflare Web Analytics measures aggregate visits and page performance without cookies or individual visitor tracking; this site has no advertising trackers.
Sign-in provides your Telegram account ID and name. The session cookie lasts up to 14 days, with a 7-day inactivity limit. Signing in neither subscribes you to meetings nor grants the bot permission to message you.
AI Ladder: your result, optional saved map and separate subscription
Your result appears without email and without sending answers to the server. You may separately request 90-day map storage and a link by email. That optional service requires your address for verification, delivery and map management during retention. A saved link reveals the profile only after you explicitly confirm from the email that you requested the map. Unverified requests reveal no profile and are deleted after 24 hours. Subscribing is not required to view or save a map.
Saving sends your email, language, request date, notice version and short profile: level or initial state, next step, unestablished foundations, uncertainty, practices tried, clarification question, checking answer and assessment source. This is automated profiling under published self-assessment rules, not qualification testing; it makes no employment, payment or service-access decisions. Verified maps are available to you and Max in a protected panel. Situation and follow-up answers, the prompt and pasted JSON stay in tab memory. Profiles are not used for advertising segmentation.
Saving, verifying, delivering and managing a map is a separate requested service under Article 6(1)(b) GDPR. The newsletter relies on optional consent under Article 6(1)(a): Max’s AI updates, new material and offers for his courses and PRO, until withdrawal independently of the map. Subscribers declare they are at least 14; identity documents or birth dates are not routinely collected. Abuse prevention relies on a legitimate interest under Article 6(1)(f), using short-lived counters and one-time checks. Request the balancing assessment from Max; objections receive individual consideration. Minimal deletion records and blocked evidence support erasure and accountability obligations under Article 6(1)(c), GDPR Articles 5(2), 7(1), 17 and LOPDGDD Article 32. Map requests and newsletter consent are recorded separately.
A verified map becomes inaccessible 90 days after the original request; cleanup runs every minute. Reading a link does not extend the period. An unverified map is deleted after 24 hours. The address remains while an active map or confirmed subscription exists. The subscription continues until withdrawal, regardless of map expiry or deletion; deleting maps and unsubscribing are separate actions. Request counters last up to 24 hours; delivery metadata up to 7 days from the email request; received webhook records and operator actions up to 7 days. The pseudonymous deletion journal holds map identifiers, and withdrawal records hold an address HMAC, without profiles or plaintext emails, for up to 32 days after the action. These are not anonymous data.
A request or consent receipt contains a pseudonymous address identifier, request and confirmation times, purpose, language and the exact notice version shown, without a profile or answers. Evidence for an active subscription remains until withdrawal. When the related processing ends, receipts are blocked for possible legal accountability: an ordinary map request or unconfirmed opt-in for 6 months; confirmed consent to recurring commercial email for 2 years after withdrawal. These periods follow the applicable LSSI Articles 38/45 matrix, not a blanket permission to retain all data for years. Blocked records cannot be viewed by the ordinary panel, marketing or application; access is limited to a documented competent-authority procedure. They are then destroyed. Specific proceedings may require a separately justified and recorded retention assessment.
Isolated backups may retain erased live records for up to 30 additional days after cleanup; our own dumps rotate after 7 days. Recovery reapplies deletions, withdrawals, blocking and expiry before access resumes; without current authority records it stays closed. Blocked receipts and subscriptions have different lifetimes from maps. Minimal journals can remain for 32 days after deletion. We cannot remove received emails or recipients’ device copies. Provider and provider-backup periods are stated separately.
The controller is Maxim Postnikov, [email protected]. Hetzner hosts the service in the EU; the Supabase primary database is in Frankfurt, eu-central-1. Supabase Pte. Ltd. (Singapore) and Supabase, Inc. (US) participate in operational processing and support; these transfers use SCC Module Two with an assessment of safeguards. Support and subprocessors may operate in other countries listed by the provider. Resend / Plus Five Five, Inc. stores emails and logs in the US; EU sending does not change this. US transfers to Resend and Cloudflare rely on the applicable EU–US Data Privacy Framework; contractual SCCs are the fallback where adequacy does not apply and require the corresponding assessment. Cloudflare provides CDN/security and processes network data and HTTPS requests, including forms, through its global network; the company is in the US. Request applicable safeguards, current countries and subprocessor information at [email protected]. Resend’s standard email/log retention is 30 days and backups 7 days; account-closure residual data and individual contractual arrangements can differ. Open/click tracking is disabled. Emails contain no level or profile. Test/map pages use no analytics, WebMCP or external fonts; profiles and email addresses are not sent to Sentry.
The separate management link deletes maps and downloads all verified active maps for the address. The unsubscribe link works independently of map expiry and reveals no profile. For full access, correction, erasure of remaining data, restriction, portability or objection, contact [email protected]; the full procedure covers receipts and processor-held data. If you report someone else’s profile, we end the mistaken association without disclosing a map or export; an unverified request can be cancelled from the email. For ordinary link recovery we proportionately verify identity and connection to the data. Losing mailbox access does not automatically lead to refusal: other evidence is considered; a passport is not a routine requirement. We respond within one month; a justified extension of up to two additional months is explained during the first month. If identification is impossible, we explain refusal and complaint options. You may complain to AEPD. Withdrawal does not affect prior lawful processing.
3. Why and on what legal basis
| What we do | Legal basis |
|---|---|
| AI Ladder: optional map storage, verification and delivery | Separate requested service — Article 6(1)(b) |
| AI Ladder: AI/material/course/PRO emails until withdrawal | Separate confirmed consent — Article 6(1)(a) |
| AI Ladder: prevent abuse; honour erasure and block minimal evidence | Abuse prevention — Article 6(1)(f); erasure/evidence — Article 6(1)(c), detailed in the AI Ladder section |
| Process your application and contact you to arrange the interview and explain the terms | Steps taken at your request prior to entering into a contract — Art. 6(1)(b) GDPR |
| Write about a new intake to those who left an application or joined the waiting list themselves | Legitimate interest — Art. 6(1)(f); every email includes a way to opt out |
| Take your question for a meetup, read it before the session and possibly read it out live and in the recording | Consent — Art. 6(1)(a) GDPR; you can withdraw it by email, and the question is then deleted |
| Contact you about your meetup question if you left a Telegram username | Consent — Art. 6(1)(a) GDPR; you can withdraw it by email, and the username is then deleted |
| Marketing emails beyond that | Only with separate consent — Art. 6(1)(a) |
| Keep the site running and protect it from abuse (server logs) | Legitimate interest — Art. 6(1)(f) |
| Keep invoices and payment records if it came to paying for participation | Legal obligations (tax, accounting) — Art. 6(1)(c) |
4. Who the data is shared with
Only with the services the site and the handling of applications cannot work without (processors under Art. 28 GDPR):
- Cloudflare — CDN/security; network data and AI Ladder form requests
- Hetzner — website hosting (servers in the EU)
- Supabase — the database where applications and meetup questions are stored
- Resend — sending emails about your application
- Sentry — monitoring technical errors while an application is processed
- Google Workspace — email
- Telegram — correspondence about your application or your meetup question
There is no sale of data and no sharing with “partners”. Where a service processes data outside the EEA, the transfer relies on the EU Standard Contractual Clauses (SCC) or on an adequacy decision.
AI Ladder countries, transfer mechanisms and how to request safeguards are specified in its section above; profiles and addresses are not sent to Sentry.
5. How long we keep it
AI Ladder map, subscription, receipt, journal and backup lifetimes differ — see the full retention explanation above.
- Applications and the correspondence about them — up to 3 years after the last contact (future intakes, invitations), or until you ask for deletion.
- Meetup questions and the Telegram username left with them — with no time limit: we delete them at your request. If a question has already been read out in a published recording, deleting it from the database does not change the recording.
- Payment and accounting records — up to 6 years (required by Spanish law).
- Server logs — rotated automatically; kept no longer than needed to diagnose and protect the site.
6. Your rights
At any time you can: request a copy of your data, have it corrected, have it erased (except what we are legally obliged to keep), restrict the processing, receive your data in a machine-readable format, object to processing based on legitimate interest, withdraw your consent.
An email to [email protected] is enough for that. If you believe your rights have been breached, you have the right to lodge a complaint with the Spanish data protection authority — AEPD (www.aepd.es) — or with the supervisory authority in your country.
7. Changes to this policy
When the policy changes, its version is updated (the date at the top of the page). The consent you give when submitting an application is tied to the version in force at that moment.