1. Controller
[TO CONFIRM: legal entity, registered address, privacy email and, if applicable, DPO contact] is the controller for the processing described here.
2. Data we process
- Account: email, optional name, authentication identifiers, confirmation status and security logs. Passwords are handled by Supabase and are not stored by us in readable form.
- Legal records: versions and timestamps of Terms/Privacy acceptance.
- Marketing preference: request, confirmation token hash, double-opt-in status and timestamps; no marketing is sent before confirmation.
- Purchases: product entitlement, checkout email, Stripe session/payment references, status, refund/dispute status. Stripe processes card data separately.
- Study activity: answers, results, topics, timing and completed sessions.
- Technical/security: IP address, browser/device and server logs from hosting/authentication providers.
- Analytics, only after consent: Google Analytics 4 may receive page and device interaction data through cookies or similar identifiers. We configure analytics without advertising features and do not load Google Analytics before analytics consent.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and secure the account, deliver purchased content, save progress | Contract; legitimate interests for security |
| Process payments, refunds and accounting records | Contract and legal obligation |
| Send service/confirmation/security messages | Contract and legitimate interests; not marketing |
| Send optional study updates and offers | Consent, confirmed by separate double opt-in; withdrawable at any time |
| Optional Google Analytics measurement | Consent; denied by default |
| Prevent fraud, abuse and protect systems | Legitimate interests and legal obligations where applicable |
4. Account confirmation and marketing double opt-in
Account email confirmation proves control of the registration address and is required before first sign-in. The optional marketing checkbox does not subscribe you immediately. A separate bilingual email asks you to confirm. Ignoring it leaves the account fully usable and no marketing consent is recorded as confirmed.
5. AI study suggestions
When enabled, aggregated performance statistics are sent to Anthropic through a protected server function. The function requires an authenticated paid account. We do not intentionally send your name or email in the study-plan payload. [TO CONFIRM with counsel and DPA: retention, training position, sub-processors, EEA transfer mechanism and final privacy wording.]
6. Recipients and processors
- Supabase: authentication and EU-hosted database [confirm region/contract].
- Netlify: hosting, delivery and serverless functions.
- Stripe: payment processing/tax and its own legal obligations.
- Resend [or final SMTP provider]: transactional and double-opt-in email.
- CookieYes: consent-management platform and consent logs, once configured.
- Google Analytics 4: optional analytics after consent.
- Anthropic: optional AI phrasing as described above.
7. International transfers
Some providers may process data outside the EEA. [TO CONFIRM: relevant adequacy decisions, Standard Contractual Clauses, supplementary measures and provider DPAs.]
8. Retention
Account and progress data are kept while the account is active and for [TO CONFIRM] thereafter. Accounting/payment records are kept for the statutory period. Security logs: [TO CONFIRM]. Pending marketing confirmation tokens should expire or be replaced; confirmed consent evidence is kept while needed to demonstrate consent and legal compliance.
9. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to certain processing. You may withdraw marketing or analytics consent at any time without affecting earlier lawful processing. Use Email Preferences or Cookie Settings, or contact [TO CONFIRM privacy email]. You may complain to the competent supervisory authority [TO CONFIRM: Garante or relevant authority].
10. Cookies and analytics
Strictly necessary authentication/security technologies operate without optional consent where legally permitted. CookieYes displays the preference banner and records choices. Google Analytics is disabled until you choose analytics cookies. Reject must be as easy as accept, and you can reopen settings through the “Cookie settings” footer link. See the Cookie Policy for the inventory and retention periods.
11. Security
We use database row-level security, encrypted transport, signed payment webhooks, verified email, least-privilege browser credentials, protected server secrets, refund/dispute revocation, and MFA for administrator accounts. No system is risk-free. We will handle incidents and notifications as required by law.
12. Children and changes
The service is for university-entry preparation and is not directed to children below [TO CONFIRM applicable age]. Material changes will be communicated when required.