Privacy Policy

Controller. FaiAmici · ciao@faiamici.it. For any question about your data, or to exercise your rights, write to this address.

How you sign in. With your email and a 6-digit code we send you (stored only hashed, for 10 minutes), or with a passkey if you choose to save one: then we keep only your device's public key, never your fingerprint or face. Sign-in runs on our own servers (open-source Better Auth software): no outside login provider.

What we process. The email you sign in with, the optional form answers (age bracket, area, favorite activities, profession, interests, how you heard about us, what you've tried), the 18+ confirmation, and — only if you explicitly give it — self-identification (special-category data, GDPR Art. 9), which we store encrypted. To measure traffic we record, pseudonymized with truncated IP, event, page, language, headline variant, origin (referrer/UTM), device class and country: no advertising cookies, no third-party vendors.

Legal bases. Performance of the service (Art. 6(1)(b)) for the list and emails; legitimate interest (Art. 6(1)(f)) for aggregate traffic measurement; explicit consent (Art. 9(2)(a)) for self-identification, if provided.

Where. Servers in Europe: Vercel (Frankfurt), Neon Postgres (Frankfurt), Mailjet (EU) for email, with open and click tracking switched off. No extra-EU transfer of your data. No advertising cession. Ever.

How long. Raw traffic events 60 days; sign-in codes 10 minutes; sessions 30 days; an account that never answers the questions is deleted after 30 days; consents 3 years as proof; your list seat until you ask for erasure (or 36 months of inactivity, with notice). After an erasure, your data also leaves the database's safety backups within 1 day.

Your rights. Erasure anytime, by yourself, from the member page: immediate and permanent. For a copy of your data (access and portability) or to correct it, write to ciao@faiamici.it: we reply within one month. Complaints to Italy's Garante per la Privacy or your local authority.

Cookies. One, technical, once you've signed in: your session. Nothing else — no banner needed because there is no tracking to accept.