Privacy Policy

The data controller for traguardo.ch is Francesco Villano, contactable at francesco@fvillano.com.

We collect only the data necessary to provide you with the service. Specifically:

• Account. Email address, password (stored in encrypted form), any OAuth provider information (Google, Facebook) if you choose to sign in via SSO.
• Learning profile. Target level (A1 or A2), optional exam date, interface preferences (language, text size, voice speed).
• Progress and activity. Completed lessons, glossary entries reviewed, practice sessions (Parler / Comprendre / Lire / Écrire), recurring errors, evaluation scores.
• Audio recordings. For the Parler (speaking) module we briefly record your voice for transcription and evaluation. Recordings are deleted immediately after processing; we retain only the text transcript and score.
• Payment data. If you activate a subscription, Stripe handles payment. We retain only your Stripe customer identifier and your subscription status — card details never pass through our servers.
• Technical data. IP address (used only to derive a country code, not stored in plain text), device type, request timestamps.

• Performance of contract (art. 6.1.b GDPR): account management, delivery of lessons and simulations, calculation of the readiness score.
• Consent (art. 6.1.a GDPR): audio recording in the Parler module. You may withdraw consent at any time from settings; without consent the Parler module is unavailable.
• Legitimate interest (art. 6.1.f GDPR): infrastructure security, abuse prevention, debugging.
• Legal obligation (art. 6.1.c GDPR): retention of fiscal receipts for paying subscribers.

We do not use your data to train artificial intelligence models. Neither your voice recordings, nor transcripts, nor your written texts are sent to any training systems.

To provide the service we rely on third-party providers acting as processors under art. 28 GDPR. Each is bound by data processing agreements and standard contractual clauses where required:

• Supabase (database, authentication) — servers in the EU.
• OpenAI (virtual examiner, automated evaluation, Whisper voice transcription) — servers in the USA, subject to standard contractual clauses. OpenAI states it does not use API data to train models.
• ElevenLabs (voice synthesis for the examiner voice) — servers in the USA.
• Resend (transactional emails: registration confirmation, password reset) — servers in the EU/USA.
• Cloudflare R2 (CDN for course images and audio) — global servers; no personal user data is stored here.
• Vercel (application hosting) — global servers.
• Stripe (payment processing) — PCI-DSS certified; receives card details directly from your browser, not from our servers.
• Google Analytics 4 (aggregate usage statistics, active ONLY with your explicit consent via the cookie banner) — Google LLC, servers in the USA, transfers safeguarded by Standard Contractual Clauses.
• Google / Facebook (only if you choose to sign in via their SSO button) — receive the standard OAuth 2.0 authentication request.

We do not sell your data to third parties. We do not share it with advertisers.

Some of our providers (OpenAI, ElevenLabs, Vercel, Stripe, Google) have servers outside the European Economic Area. In all cases transfers are safeguarded by the EU Commission's Standard Contractual Clauses or equivalent adequacy decisions for Switzerland.

• Account and learning data: retained while your account is active. After account deletion, data is erased within 30 days (with a 7-day window during which you may cancel the deletion).
• Audio recordings: deleted immediately after transcription (within seconds).
• Payment receipts: retained for 10 years as required by fiscal regulations (CH/EU).
• Technical logs: retained for a maximum of 30 days for security and debugging purposes.

At any time you may exercise the following rights:

• Access: obtain a copy of your data in a readable format (JSON + PDF progress report).
• Rectification: correct inaccurate data from the settings panel.
• Erasure: delete your account and all associated data.
• Portability: receive your data in a structured format to transfer to another service.
• Objection: object to processing based on legitimate interest.
• Restriction: ask us to temporarily suspend processing.
• Complaint: lodge a complaint with a supervisory authority (Italian Garante, Swiss IFPDT, or another competent authority in your country).

To exercise these rights, write to francesco@fvillano.com. We will respond within 30 days.

We use strictly necessary cookies: the Supabase session cookie to keep you authenticated, and the tg_consent cookie that stores your cookie choice (12 months). With your explicit consent — requested via the cookie banner — we use Google Analytics 4 for aggregate usage statistics: Google's script is only loaded after you accept, and you can withdraw consent at any time via the “Cookies” link in the footer. We do not use advertising or profiling cookies.

We adopt reasonable technical and organisational measures to protect your data: encryption in transit (HTTPS) and at rest, limited and logged database access, passwords stored only as bcrypt hashes, separation between application data and payment data (Stripe).

The service is not intended for persons under 16 years of age. If you are a parent or guardian and believe a minor has provided us with personal data without consent, please contact us and we will delete the data.

We may update this policy. Significant changes will be communicated to you by email at least 30 days before they take effect.

For any questions about privacy or the exercise of your rights:

Email: francesco@fvillano.com