i . a m F é n i xPrivacy Policy
This policy explains what data Fénix processes, why, with whom it is shared, and how to exercise the rights in the General Data Protection Regulation, Colombian habeas data law, and the California CCPA.
Data controller
- Name
- Andres Fernando Morales Sanabria
- Trade name
- Fénix (i.am Fénix)
- Site
- iamfenix.com
- Contact
- andy@iamfenix.com
Controller
The controller is Andres Fernando Morales Sanabria, operating Fénix at iamfenix.com. Privacy requests go to andy@iamfenix.com with the subject “Privacy”.
This policy covers the site, the Diarios del Fénix course, the directory software, subscriptions inside the apps, and messages related to those purchases.
Data we process
We process what is needed to sell and operate the digital products.
- Identity and contact: name, email, phone, and the billing address the checkout asks for.
- Account and access: preferred language, course-access identifier, and subscription status.
- Commercial information: product purchased, amount, currency, date, and the order reference. We do not store the full card number or the security code.
- Content you publish in your directory space or inside an app.
- Technical data: IP address, browser type, pages visited, and security logs.
- Messages you send us.
We do not ask for identity documents, medical records, or precise geolocation. If you send that kind of data on your own, we use it only to reply and then delete or reduce it. Location we may infer is approximate, from the IP address or the billing country.
Purposes and bases
Each processing has a purpose and a basis. Where the GDPR applies, the basis is one of these:
- Contract, or steps before a contract: creating access, delivering the course, operating the subscription, charging through the processor, and answering about an order.
- Legitimate interest: securing the service, preventing fraud and abuse, understanding aggregate use of the site, and defending a claim. You may object where the law allows it.
- Consent: a sequence or newsletter you request separately. You may withdraw it at any time, without affecting access already paid for.
- Legal obligation: keeping accounting records and answering a request from an authority.
The access email, the receipt, and security notices are part of the product. A newsletter you did not request is not sent.
Payments and the Merchant of Record
Fénix does not charge the card on its own servers. An external party shown at checkout processes the payment. Depending on the active channel, that party may be:
When the processor acts as Merchant of Record, it is the seller of record for the transaction. It may calculate and collect indirect taxes, handle the charge and the refund, and process payment data under its own policy.
In that case the processor is an independent controller of the charge and of the card data. Fénix receives an order reference, the payment status, and the contact details needed to deliver the product. The name on the receipt identifies which processor handled that purchase. Its policy, linked above, explains how it handles that data.
Recipients
We share data with providers that help us operate, and only for that purpose:
- The payment processor for the order, from the list above.
- Hosting and the database of access and purchases (Vercel and Supabase).
- Delivery of the access email and operational notices, through the configured email provider.
- Systeme.io, when you request a sequence or a form contact.
- Aggregate use measurement: Google Analytics and Vercel Analytics.
- YouTube, when a page embeds a video in privacy-enhanced mode.
We do not sell personal data. A provider may not use it for its own marketing from our instruction. We may also disclose a datum if a law, a court, or a payment network requires it for fraud or a charge dispute.
International transfers
The operator may be in a country other than yours, and several providers process data in the United States or elsewhere. Where the GDPR, the UK GDPR, or Swiss law requires a safeguard, we use the one that provider has published and in force: an adequacy decision, the EU-US Data Privacy Framework where it covers that provider, or standard contractual clauses.
You may ask for a summary of those safeguards at the contact email.
Retention
- Purchase and access data: while access is in force and, after that, for as long as accounting and the defense of claims require. That period is usually five years.
- Course session: up to one year, or sooner if you ask us to close it.
- Language: up to one year, or until you change it.
- Support messages: up to twenty-four months after the case closes.
- Security logs: up to twelve months, unless an incident requires us to keep them longer.
- Directory content: while the subscription is active and during the technical wind-down afterward.
- A contact you requested for a sequence: until you withdraw consent or object.
GDPR rights
If the GDPR applies to you, you may request access, rectification, erasure, restriction, portability, and objection. Where processing is based on consent, you may withdraw it. You may also ask not to be subject to a decision based solely on automated processing that produces legal effects. Fénix does not make that kind of decision about people.
Write to andy@iamfenix.com. We reply within one month. If the request is complex, the period may extend by two further months, and we will tell you within the first. We may ask you to confirm that the email is the purchase email, so we do not hand data to someone else.
You may lodge a complaint with the data-protection authority of your country of residence, your place of work, or the place of the alleged infringement. That right does not require you to write to us first, though writing often resolves the case.
Colombia
Where Law 1581 of 2012 applies, you may know, update, rectify, and erase your data, and revoke authorization when there is no legal or contractual duty to keep it. A complaint may be taken to the Superintendence of Industry and Commerce.
CCPA and CPRA
This section is for California residents. In the preceding twelve months we may have collected these categories: identifiers (name, email, phone, IP address), commercial information (product, amount, subscription status), internet activity (pages and site use), and approximate geolocation. The sources are you, your device, and the payment processor. The purposes are delivering the product, charging, securing the service, and measuring aggregate use.
We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising as a business activity. Google Analytics may receive usage events. A California resident may write to us to opt out of sale or sharing, and we will honor that request. We do not discriminate for exercising a right.
You may request to know, correct, and delete. You may use an authorized agent if the agent shows authority to act for you. We verify the request with the purchase email. We respond within forty-five days and, if needed, we give notice of one further forty-five-day extension. We do not use sensitive personal information to infer characteristics. The processor handles card data.
Children
The products are directed to adults. We do not knowingly collect data from anyone under 16. If we learn that a child gave us data, we delete it and close access. If you are a parent or guardian, write to us.
Security
We use encryption in transit, access controls, and an httpOnly session cookie for the course. Card data stays with the processor. No system is invulnerable. If a breach occurs that the law requires us to announce, we will announce it to the people affected and to the authority that applies.
Changes and contact
If this policy changes, we publish the new date at the top of the page. A change that materially reduces a right is announced on the site before it takes effect and, when we have an active customer's email, by email as well.
To exercise a right or ask a question: andy@iamfenix.com. The Terms of Service and the Refund Policy complete the purchase information.