This notice describes how Valter Macorig ("the Data Controller") collects, uses and protects your personal data as part of the Kolay service, in accordance with EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code).

1. Data Controller

Valter Macorig
VAT: IT04987610286
Email: hello@learnkolay.com

2. Data collected and purposes

Data	Purpose	Legal basis
Email address	Account creation and access	Art. 6.1.b GDPR, performance of a contract
Password (stored as a hash, never in plain text)	Secure authentication	Art. 6.1.b GDPR, performance of a contract
Study progress (flashcards, completed lessons, scores)	Saving and syncing learning data across devices	Art. 6.1.b GDPR, performance of a contract
Text submitted to the AI Tutor feature	The message written by the user, together with minimal context (level and lessons already completed, to calibrate the response), is sent to the AI provider Groq to generate the tutor's response in real time. Nothing else is sent (no email, no history of other conversations). Groq does not use this data to train its models, and does not retain it beyond processing except for temporary logs (max 30 days) for platform security and reliability.	Art. 6.1.b GDPR, performance of a contract
AI message counter (number of messages sent and date of the last one)	Enforcing the AI tutor usage limits set by the plan (Free/Pro) and preventing abuse of the service	Art. 6.1.b GDPR, performance of a contract
Technical data (IP address, user agent, access logs)	Security, abuse prevention and technical operation of the service	Art. 6.1.f GDPR, legitimate interest
Aggregated, anonymous traffic data (pages visited, country, device and browser type, referring site)	Site usage statistics via Vercel Web Analytics, which does not use cookies or identifiers that could trace data back to an individual visitor	Art. 6.1.f GDPR, legitimate interest
Email and message entered in the landing page forms (language suggestion, FAQ page question)	Responding to the request and, for the language form, notifying the user when the suggested language becomes available	Art. 6.1.a GDPR, consent, given by voluntarily submitting the form

The Data Controller does not carry out profiling and does not transfer data to third parties for its own purposes. No data is used for marketing purposes.

3. Recipients and transfers outside the EU

To provide the service, the Data Controller uses the following sub-processors, who process data on its behalf:

Supabase Inc. (USA), authentication and progress database. EU→USA transfer via Standard Contractual Clauses (Art. 46 GDPR).
Vercel Inc. (USA), hosting of the application and landing page, technical logs, and Vercel Web Analytics (aggregated traffic statistics, without cookies). Standard Contractual Clauses (Art. 46 GDPR).
Groq Inc. (USA), AI processing of messages sent to the AI Tutor feature, to generate the tutor's response in real time. Under contract (Groq Services Agreement), Groq does not use this data to train its models and does not retain it beyond processing, except for temporary logs of up to 30 days for platform security and reliability. Standard Contractual Clauses (Art. 46 GDPR).
Formspree Inc. (USA), receiving emails sent through the landing page forms (language suggestion, FAQ questions). Standard Contractual Clauses (Art. 46 GDPR).
OVH SAS (France, EU), management of the hello@learnkolay.com mailbox used for user support. Data processed entirely within the European Union, no transfer outside the EU.

Data is not transferred to third parties for their own purposes.

4. Retention period

Account data and study progress: kept for as long as the account is active. After deletion: erased within 30 days.
Technical data and logs: maximum 30 days.
AI message counter: kept for as long as the account is active, to enforce the plan's weekly/daily limits.
Emails and messages sent through the landing page forms: kept on Formspree according to their retention policy, deletable on request by writing to hello@learnkolay.com.
Aggregated traffic data (Vercel Web Analytics): since it cannot be traced back to an individual user, it does not fall within the notion of personal data retained individually; the available history window depends on the Vercel plan in use.

5. Rights of the data subject

As a data subject, you have the right to:

Access (Art. 15 GDPR): obtain confirmation of the processing and a copy of your personal data.
Rectification (Art. 16 GDPR): correct inaccurate or incomplete data.
Erasure (Art. 17 GDPR): request the deletion of your data ("right to be forgotten").
Restriction of processing (Art. 18 GDPR): restrict processing in certain cases provided by law.
Data portability (Art. 20 GDPR): receive your data in a structured, machine-readable format.
Objection (Art. 21 GDPR): object to processing based on legitimate interest.

To exercise your rights, write to hello@learnkolay.com. We will respond within 30 days of receiving the request (Art. 12 GDPR).

6. Complaint to the supervisory authority

You have the right to lodge a complaint with the competent supervisory authority:

Italian Data Protection Authority (Garante per la protezione dei dati personali)
Website: www.garanteprivacy.it
Email: garante@gpdp.it
Piazza Venezia 11, 00187 Rome, Italy

7. Cookies

Kolay uses exclusively strictly necessary technical cookies for the service to function (authenticated session management). No profiling cookies, tracking cookies or third-party advertising cookies are used.

Landing page traffic statistics are collected via Vercel Web Analytics, a service that by nature does not use cookies or any identifier that would allow a visitor to be recognized across visits.

Since there are no non-technical cookies or tracking tools, a cookie banner is not required under applicable regulations (ePrivacy Directive, Italian Garante's cookie guidelines).

8. Minimum age

The service is reserved for users at least 14 years old, in accordance with Art. 2-quinquies of Legislative Decree 196/2003. By registering, the user declares that they meet this requirement. If the Data Controller becomes aware that data of children under 14 has been collected without parental or guardian consent, it will proceed with its immediate deletion.

9. Changes to this notice

The Data Controller reserves the right to update this notice at any time. In case of substantial changes, registered users will be notified by email. The date of the last update is shown at the top of the page. Continued use of the service after the notification constitutes acceptance of the updated notice.

Privacy Policy