Privacy Policy

1. Who is responsible for your data

The data controller is Elio Ministeri, sole trader, VAT number 04763730274, based in Venice, Italy, operating the service Adesso Italian at adessoitalian.com (the "Controller", "we").

You can reach the Controller for any privacy matter at hello@adessoitalian.com. No data protection officer has been appointed because the law does not require one for a business of this size and nature.

2. Which data we process

Account data: name, e-mail address, password (stored only as a cryptographic hash), preferred language, timezone and country. If you sign in with Google or Facebook, we receive from them only your name, e-mail address and profile picture; we never see your password there and we do not post anything on your behalf.

Profile data: your profile photo if you upload one; for tutors, also the public profile (headline, biography, languages, specialties, intro video link, price per lesson).

Learning data: your Italian level, goals and interests, lesson notes and homework written by your tutor, and the review you may leave about a tutor.

Certificates: when you complete 10, 25, 50 or 100 lessons (tutors: 50, 100 or 300 lessons taught), we issue a certificate with your name, the number of lessons, the date and, for students, the level of your latest level test, and e-mail it to you. Each certificate has a code: anyone who has the code can open its verification page, which shows only your name, the number of lessons, the date and that it is valid, never your e-mail or other data. You can make that page private from your account at any time.

Booking data: lessons booked, moved, cancelled or completed, attendance, credits purchased, used, refunded and expired.

Billing data: billing name and address, VAT or tax identifier when you request an invoice, payment history and receipts, and any dispute of a payment by your bank (a chargeback) with its outcome. Card numbers are entered directly on Stripe's secure pages and never reach our servers.

Messages and files: the text, stickers and attachments you exchange in the in-app chat with your tutor or with our founder.

Interest in tutors: only when you are signed in, the tutors you save as favourites and the tutor profiles you open for at least 20 seconds or whose video you play. The tutor gets a note with your name and can write to you on the platform. You can turn this off in Settings, Notifications; nothing is recorded for visitors who are not signed in.

Video lessons: audio and video streams are transmitted in real time and are not recorded by the platform.

Calendar data (tutors only): if a tutor connects Google Calendar, we read only the busy/free status of the calendar and write the lessons booked on the platform. We never read the content of other events.

Payment data (tutors only): tutors are paid through Stripe. When a tutor opens their Stripe account, Stripe collects their identity, date of birth, address, tax code and bank account. We receive from Stripe whether the account is active and which details are still missing, and, once a year, the details the DAC7 rules require us to report: name, address, date of birth, tax code, bank account and the amounts paid to the tutor through the platform.

Technical data: IP address, browser and device type, pages visited, timestamps and security logs, collected to run the service safely and to detect abuse.

Referral data: if you joined through a friend's or a partner's link, which code you used and when you opened it, to apply the friend's price and the reward and to check that you were new to Adesso Italian (we look only at our own records: an earlier account, newsletter, booklet or e-mail left with us, or a first visit from one of our adverts). To prevent self-referrals, we compare the identifier Stripe gives to the card used for your friend's first pack with the cards used by the person who invited you; we never see card numbers. The person who invited you sees, on their invitations page, your first name and how far you got (signed up, first lesson, monthly pack, their free lesson); you can hide your name in Settings, Notifications, and they then see "a friend".

Marketing measurement data: only if you accept marketing cookies, an identifier set by Meta (Facebook/Instagram), the code of the Meta advert you clicked and the events we share with Meta (signing up, finishing the level test, opening a payment page, paying and the amount), to measure whether an advertisement led to a booking (see section 8).

Studio recordings: only if you choose to send a speaking recording for correction, we store the audio file, your note, an automatic transcript and the correction. The correction is automatic: the recording is transcribed by ElevenLabs and the transcript, with the unit's task and your note, is sent to Anthropic, whose AI model writes the correction; no decision about you is taken on that basis. Our staff can read the correction and listen to the recording, only to check that automatic corrections work well. Your tutor does not see your recordings or corrections. Recordings are deleted after 180 days; the transcript and the correction stay in your account until you delete it.

Affiliates: if you join our affiliate programme, your name, e-mail address, country, where you plan to share your link, the version of the affiliate terms you accepted and when; the visits, sign-ups, first lessons and lesson packs that came through your code (never the names of those students); your earnings and payments; and, to pay you, the name on the bank account, your tax identifier, address and IBAN.

Tutor applicants: the answers to the screening questions, name, e-mail, country, timezone, weekly availability, a short introduction, qualifications, how you heard about us and the link to your video. We do not keep a copy of the video itself. If you leave your e-mail to hear when applications open, we keep only that address and your consent.

3. Why we process it and on which legal basis

To issue certificates of the lessons completed and keep their verification pages: performance of our contract with you, Article 6(1)(b) GDPR.

To provide the service you asked for (creating your account, scheduling and running lessons, delivering messages and notifications, managing credits): performance of a contract, Article 6(1)(b) GDPR.

To collect payments, issue receipts and invoices and keep accounting records: performance of a contract and compliance with a legal obligation, Article 6(1)(b) and (c) GDPR.

To keep the service secure, prevent fraud and abuse, keep audit logs and enforce our terms: our legitimate interest in running a safe platform, Article 6(1)(f) GDPR.

To improve the service through aggregated, non-identifying statistics: legitimate interest, Article 6(1)(f) GDPR.

To send you news or offers by e-mail, and to measure advertising through Meta: your consent, Article 6(1)(a) GDPR, which you can withdraw at any time without affecting the lawfulness of processing carried out before withdrawal. Tips and offers by e-mail (for example invitations to book a lesson, discounts and our welcome e-mails) are sent only if you ticked the box when you signed up or said yes in your account; we keep a record of the words you agreed to, their version and the date and time. You can withdraw in Settings, Notifications, or with the link at the bottom of each of those e-mails. E-mails about your account, lessons, payments and your level test result are part of the service and are sent anyway.

To pay tutors through Stripe and to report to the Italian Revenue Agency (Agenzia delle Entrate) the amounts paid to them, as the DAC7 rules require (Legislative Decree 32/2023): performance of our contract with the tutor and compliance with a legal obligation, Article 6(1)(b) and (c) GDPR.

To defend our rights in case of a dispute: legitimate interest, Article 6(1)(f) GDPR.

Providing account, booking and billing data is necessary to use the service: without it we cannot create your account or deliver lessons. All other data is optional.

To run the affiliate programme, calculate your earnings and pay you: performance of our contract with you, Article 6(1)(b) GDPR. To keep records of what we paid you for tax purposes: compliance with a legal obligation, Article 6(1)(c) GDPR.

To evaluate a tutor application: steps taken at your request before entering into a contract, Article 6(1)(b) GDPR. To e-mail you when applications open, if you ask us to: your consent, Article 6(1)(a) GDPR, which you can withdraw at any time.

4. Who receives your data

Your tutor sees your name, photo, level, goals, lesson history, messages and the review you leave. A tutor whose profile you save or spend time on (see section 2) sees your name and that you did so, and can message you. Tutors are independent professionals who process your data on our behalf, as processors under Article 28 GDPR: only on our instructions, only on the platform and only to teach you, and bound by confidentiality also after they stop teaching with us.

We use the following service providers, which act as processors on our behalf under written data-processing agreements and process data only on our instructions:

Supabase Inc. (database, authentication, file storage), data hosted in the European Union (Frankfurt, Germany) · Stripe Payments Europe Ltd (payments, receipts, invoices, payments to tutors) · LiveKit Inc. (real-time video for lessons) · Resend Inc. (transactional e-mail) · Vercel Inc. (hosting and content delivery) · Google LLC (calendar synchronisation, only for tutors who connect it) · ElevenLabs (speech-to-text for the Studio recordings you send for correction) · Anthropic (the AI model that writes Studio corrections and, on pseudonymised data, helps us check affiliate payouts for fraud once a month; data sent through its API is not used to train its models) · Meta Platforms Ireland Ltd (advertising measurement, only with your consent).

Some of these providers are established in the United States or may process data outside the European Economic Area. Where that happens, transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask for a copy of these safeguards at hello@adessoitalian.com.

Each year we report to the Italian Revenue Agency the identity and tax details of tutors and the amounts paid to them through the platform, as the DAC7 rules require.

We may disclose data to authorities, courts or professional advisers when the law requires it or to defend our rights.

We never sell personal data and we never share it with third parties for their own marketing.

5. How long we keep it

Account, profile, learning and message data: for as long as your account is active. When you delete your account, or after three years of inactivity, personal data is deleted or irreversibly anonymised within 30 days, except where a longer retention is required below.

Certificates: for as long as your account is active, so that their verification pages keep working; they are deleted with your account.

Payment, invoicing and accounting records: 10 years from the end of the financial year, as required by Italian tax and accounting law.

Tutors' DAC7 records: for the period the DAC7 rules require, up to 10 years.

Security and audit logs: 12 months, unless needed for an ongoing investigation or dispute.

Chat attachments: deleted with the message or with the account. Read notifications and processed technical events are purged automatically after 180 and 90 days respectively.

Marketing consent records (including your cookie choice): for as long as the consent is valid and for 2 years after withdrawal, to prove that it existed. The copy of an event we send to Meta is deleted as soon as Meta has received it, at the latest after 7 days; we keep only the event name and whether it was sent.

Affiliates: payment and tax records of what we paid you are kept for 10 years from the end of the year of payment; the rest of your affiliate data until you leave the programme and for 12 months after the last payment.

Tutor applications: an application left unfinished is deleted after 60 days; an application that is not selected is deleted 12 months after it was started. An e-mail left to hear about the next round is deleted 30 days after we write to you, and in any case after 24 months.

6. Your rights

Under Articles 15 to 22 GDPR you have the right to access your data and obtain a copy; to have inaccurate data corrected; to have data erased; to restrict processing; to receive the data you provided in a portable format; to object to processing based on legitimate interest; and to withdraw consent at any time.

You can exercise most rights directly from Settings: download my data (portability) and delete my account (erasure). For everything else write to hello@adessoitalian.com; we answer within one month, extendable by two further months for complex requests, and we may ask you to confirm your identity first.

We do not take decisions producing legal or similarly significant effects on you by automated means alone.

If you believe your data is processed unlawfully you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the EU country where you live or work.

7. How we protect your data

All traffic is encrypted in transit (HTTPS, HSTS). Data is stored in EU data centres with encryption at rest. Passwords are hashed with an industry-standard algorithm and are never visible to us. Google Calendar credentials are encrypted before storage.

Access to personal data is restricted by role and enforced at database level: a student can see only their own data, a tutor only the students assigned to them, and every administrative action is written to an audit log.

Payment card data is processed by Stripe, a PCI-DSS Level 1 certified provider; we only receive the last four digits and the outcome of the payment.

Where a personal data breach is likely to result in a risk to your rights, we notify the Garante within 72 hours and inform you without undue delay, as Articles 33 and 34 GDPR require.

8. Cookies and similar technologies

Visit statistics: we count page views with Vercel Web Analytics, which uses no cookies, stores no identifier on your device and only gives us aggregated numbers (pages, countries, devices). It does not require consent.

Strictly necessary cookies: a session cookie that keeps you signed in, and small preference cookies for language, theme, timezone and the trial slot you selected, plus, when you arrive from one of our adverts that shows a first-lesson offer or claim it in the offer window on our home page, a cookie that remembers when, so the offer lasts 72 hours from then. If you close that window, your browser remembers it for 7 days so it does not open again. They do not require consent and cannot be switched off without breaking the service.

Marketing measurement (Meta Pixel and Meta Conversions API): only if you click "Accept" on the cookie banner. Meta's cookies then let Meta tell us whether a visit that came from one of our advertisements ended with a booking, so that we can spend our advertising budget sensibly. Our server also tells Meta directly when you sign up, finish the level test, open a payment page or pay (with the amount), so that this works even when you open our e-mail link in another browser or app. With each of these events we send your e-mail address and account number only as a one-way encrypted code (SHA-256), the IP address and browser of the visit, and the codes of Meta's cookies. When you arrive from one of our advertisements, we keep its campaign tags for 30 days in a first-party cookie, to know which advert brought new accounts and how many of its visitors reach each step of booking a first lesson (only counts, nothing that identifies you); for a Meta advertisement we also keep the code of that click (fbclid) for 90 days, which goes to Meta only if you accept. If you have an account, your choice is saved with it and applies on every device you sign in on. Meta acts as an independent controller for the data it collects; see Meta's privacy policy for details. You can change your choice at any time from the "Cookie settings" link in the footer or in Settings, Notifications.

We do not use third-party analytics cookies, advertising networks other than Meta, or cross-site tracking. Embedded YouTube or Vimeo videos on tutor profiles load only after you click play and use the providers' privacy-enhanced mode.

9. Children

The service is intended for adults. If you are under 18 you may use it only with the consent of a parent or guardian, who accepts these terms on your behalf. We do not knowingly collect data from children under 14; if we learn that we have, we delete it.

10. Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows the current version. For material changes we notify registered users by e-mail or with a notice in the app before the change takes effect.

11. Contact

For any question about this policy or your data, write to hello@adessoitalian.com. We reply within one working day.