Privacy notice · draft to complete
1. Controller and contacts
The controller is [LEGAL NAME], with registered office at [FULL ADDRESS], VAT no. [NUMBER]. Privacy contact: [EMAIL]. Identity, address, contact details and any joint controllers must be completed before launch.
2. Data processed
Depending on the features used: email, name, profile and billing data; login and session data; progress and learning answers; bookings, support, payments and invoices. Payment providers process the data needed for transactions. Voice exercises record audio only temporarily in the browser: Italoo does not upload it and the file is deleted when you leave the activity. Browser dictation may be processed by the browser or operating system service: providers, transfers and timing must be verified on supported browsers.
3. Purposes and legal bases
Account, learning path, exercises, bookings and support: performance of the contract or pre-contractual measures. Payments and accounting: legal obligations. Security and abuse prevention: legitimate interest, to be documented. Marketing, if introduced, requires a valid basis and consent where necessary. The initial test suggests an indicative learning level and produces no legal or similarly significant effects.
4. Required and optional data
Data marked as required is needed to create an account, complete a purchase or manage a booking. Without it some features are unavailable. Microphone and dictation are optional and require device permission.
5. Recipients and processors
Depending on configuration, the following may process data: Supabase (authentication, database, storage), Stripe (payments) and Resend (transactional email), as well as authorised staff for support and lessons. Before publication verify active providers, agreements, sub-processors and regions. We do not sell personal data.
6. International transfers
Location depends on provider contracts and settings. State any transfers outside the EEA and the safeguards applied (adequacy decision, standard contractual clauses or other measures): [VERIFY AND COMPLETE].
7. Retention
Accounts and progress are kept for as long as needed for the service; accounting records for the legal periods; security logs for a proportionate period. After the account is closed we delete or anonymise what is no longer needed, without prejudice to legal obligations or the defence of rights. Define periods by category, backups and deletion: [COMPLETE].
8. Cookies, storage and voice
The reviewed code uses technical cookies for session and language and local storage for audio preferences and notice status. No analytics, advertising or profiling tools appear to be active in the application. Speech recognition and synthesis depend on the browser and device; some services may process data with their own provider. Inventory: Cookie notice. If non-essential trackers are introduced, block them until consent is given and update the interface before activation.
9. Rights and complaints
Where applicable you may request access, rectification, erasure, restriction, portability, object, and withdraw consent for the future. Write to [PRIVACY EMAIL]. You may lodge a complaint with the data protection authority (in Italy, the Garante per la protezione dei dati personali). Set up a channel and a response procedure before launch.
10. Security
We adopt appropriate technical and organisational measures. Before processing real data, verify access, credentials, backups, providers, incident handling and notification procedures.
11. Minors
Before admitting underage users, define the minimum age, applicable national rules, an accessible notice and any parent or guardian consent: [TO BE DEFINED].
12. Updates
Update this notice when purposes, providers, features or data change. Final version and date: [TO COMPLETE].