Privacy

1Who is the controller

The data controller is Agustin Acevedo, tax ID (NIF) Z2826707N, address Carrer de París 73, 08029 Barcelona, España. For any question about your data, write to agust.acevedo@gmail.com.

2Without an account, your progress stays in your browser

You can do the whole Italian without giving any data. Your progress (finished lines and the review schedule) is kept in your browser's local storage, not on the server, and so are your piece-sound, explaining-arrows and board preferences.

3What is kept if you create an account

When you sign in with your email, Planchetto keeps in its own database:

• Your email and the language you use the site in.
• Your progress: finished lines, review exercises with their dates and mistakes per line. On signing in it is merged with whatever was in your browser.
• Your open sessions and the sign-in links you request. Only a hashed fingerprint of each is kept, never the link or the session itself, along with when it expires.
• The account is created when you open the link, not when you ask for it. If you ask for a link and never open it, only your email is left next to the link's fingerprint, and it is deleted the next day.
• If you subscribe: your Stripe customer ID, the subscription status, the plan, the end date of the paid period and, if you have cancelled, when it ends.

4Why the email is needed

Giving your email is necessary to have an account and to subscribe: without it we cannot send you the sign-in link or the confirmation of the contract. If you would rather not give it, you can keep using the free parts without an account.

5Payments are processed by Stripe

The subscription is paid on Stripe's payment page. Planchetto never sees or stores your card: Stripe receives the payment details, the email, the country and the billing address you give it, takes the payment, issues the invoice and lets you manage the subscription from its portal.

For taking payments, Stripe acts as Planchetto's processor. To prevent fraud and meet its own legal obligations (for example, against money laundering), it also acts as an independent controller, under its own privacy policy.

6What for, and on what legal basis

Each use has its basis in article 6 GDPR:

• Giving you the account, keeping your progress, sending you the sign-in link and giving you access to what you pay for: performance of the contract (art. 6(1)(b)).
• Charging, issuing invoices and keeping them: legal tax and accounting obligation (art. 6(1)(c)).
• Emailing you the confirmation of the contract after payment: legal obligation under consumer law (art. 6(1)(c)).
• Telling you by email about a price change or a change to these terms before it affects you: performance of the contract (art. 6(1)(b)).
• Limiting sign-in links to five per hour for each email and twenty per hour from each IP address, so nobody can use the form to flood someone else's inbox: legitimate interest in the security of the service (art. 6(1)(f)). For this a hashed fingerprint of the IP each link is requested from is kept, and deleted after 24 hours.
• Measuring with Google Analytics which pages and lessons are used, to improve them: your consent (art. 6(1)(a)), which you can withdraw at any time from “Cookies” in the footer of every page.

7What is not done

There is no advertising and there are no tracking pixels on planchetto.com, and the only analytics is Google Analytics, only if you accept it. No newsletters or marketing emails are sent. Your data is not sold or passed to anyone outside the providers on this page.

No automated decisions are made about you and no profiles are built (article 22 GDPR).

8Who else handles your data

These providers act as processors, each only for its own part:

• Stripe (Stripe Payments Europe, Ltd., Ireland): payments, invoices and the subscription portal.
• Resend (Resend, Inc., United States): sends the emails with the sign-in link and the confirmation of the contract.
• Fly.io (Fly.io, Inc., United States): hosts the server and the database, in its Paris data centre.
• Google (Google Ireland Limited, Ireland): Google Analytics, only if you accept its cookies. It receives the pages you visit and what you do on them (for example, starting or finishing a lesson) with a random identifier for your browser, not your name or your email.

9Server logs

Like any web server, Planchetto's server on Fly.io may record technical details of each connection, such as the IP address, the time and the page requested, to keep the service running and to detect abuse and faults (legitimate interest, art. 6(1)(f)). Planchetto does not keep them in its database or use them to identify you, except for the hashed fingerprint of the IP of whoever asks for a sign-in link, which is deleted after 24 hours.

10Transfers outside the European Union

Resend and Fly.io are US companies, and Stripe and Google may process data in the United States through their parent companies. These transfers rely on the EU-US Data Privacy Framework where the provider has signed up to it, or otherwise on the standard contractual clauses approved by the European Commission.

11Cookies and browser storage

Planchetto uses what it needs to work, which does not require your consent (article 22.2 LSSI), and Google Analytics cookies only if you accept them in the cookie notice. Without accepting, nothing from Google is loaded. You can change your choice at any time from “Cookies” in the footer of every page; if you withdraw it, they are deleted.

• _ga and _ga_VV0L95YZF8 (only if you accept): Google Analytics cookies, to tell your browser and your visits apart. They last up to two years, or until you withdraw consent.
• Your cookie choice, in local storage, for one year: after that you are asked again.
• planchetto_session: your session cookie, which code in the browser cannot read. It lasts 180 days or until you sign out.
• planchetto_signed_in: only says that a session is open, so the page knows whether to sync your progress. It lasts as long as the session.
• Local storage: your progress and your sound, arrows and board preferences, which never leave the browser except to sync with your account.

When you pay, Stripe's page, on its own domain, uses its own cookies to prevent fraud. Those are governed by Stripe's privacy policy.

12How long it is kept

Your account and your progress, for as long as the account exists. If you ask for it to be deleted, they are deleted within a month, along with the sessions, the sign-in links and the subscription details kept by Planchetto.

Invoices and payment records are kept for as long as Spanish tax and commercial law requires, generally four to six years, even if you delete your account.

Sessions expire after 180 days and sign-in links 15 minutes after they are sent; the links and the fingerprint of the IP they were requested from are deleted after 24 hours.

Google Analytics keeps event data for 14 months.

13Your rights

You can ask for access to your data, its rectification, its erasure (deleting the account), its portability, the restriction of processing, and you can object to it. Write to agust.acevedo@gmail.com from your account's email so it can be checked that it is you; you will get an answer within a month.

If you believe your rights have not been respected, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the authority of your country in the EU.

14Minors

You must be at least 14 to create an account. Below that age, consent from a parent or guardian is needed, and they can write to agust.acevedo@gmail.com about anything.