Privacy notice
Version 2026-10-18, effective 18 October 2026. Information under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR").
This page explains what data civicoach (civicoach.app) processes, why, for how long, and what your rights are. In short:
- The audio of your spoken answers never leaves your device. Transcription happens in your browser.
- Your essays and transcripts are deleted after 90 days, unless you choose to keep them.
- No profiling cookies, no advertising, and we don't sell data. That is why you see no cookie banner.
- We use an AI from a US provider to correct your texts. It gets the text and the task, never your name or email.
- You can delete everything yourself, at any time, from Delete my data.
1. Who is responsible
The data controller is Mario Corea, private individual (no VAT number yet), Via Laura Solera Mantegazza 5, 20121 Milano (MI).
For any privacy question or to exercise your rights, write to support@civicoach.app. A person answers, not a bot.
We have not appointed a data protection officer (DPO), because one is not required for a business of this size (Art. 37 GDPR).
2. What we process, why, and on what legal basis
| What we do | Which data | Legal basis |
|---|---|---|
| Practice and mock exams (reading, listening, grammar) | the answers you choose, scores, the language of the explanations | performance of the service you ask for (Art. 6(1)(b)) |
| Saving progress without an account | a random identifier in the session cookie and your answers, linked to that cookie | performance of the service (Art. 6(1)(b)) |
| Account and sign-in by email link, password or Google | email address, preferred languages, dates of creation and last visit, your statement that you are 18 or older, whether and when your email address was confirmed | performance of the service (Art. 6(1)(b)) |
| Password (only if you set one) | never the password itself: only a salted, deliberately slow cryptographic hash of it (PBKDF2-SHA256), from which the password cannot be read back; links to reset it or to change your email (stored as hashes); a count of recent wrong passwords per address, keyed on a cryptographic fingerprint of the address, to slow down guessing | performance of the service (Art. 6(1)(b)); legitimate interest in protecting accounts (Art. 6(1)(f)) for the count of wrong passwords |
| "Continue with Google" (only if you use it) | from Google we receive only your email address, Google's confirmation that it is verified, and a fixed Google account identifier that links your Google account to your civicoach account; not your name, photo, contacts or anything else in your Google account | performance of the service (Art. 6(1)(b)) |
| AI feedback on writing | the text you write, the task, the feedback and the estimated score | performance of the service (Art. 6(1)(b)) |
| AI feedback on speaking | the transcript made in your browser, duration and pauses (not the audio), the feedback | performance of the service (Art. 6(1)(b)) |
| Waitlist for the paid pass | email, exam, language, consent version and date | your consent (Art. 6(1)(a); Art. 130 Italian Privacy Code) |
| Security and usage limits (against abuse, runaway costs and unauthorised access) | usage and cost counters per account; rate limits computed without storing your IP address; a cryptographic fingerprint of your email address, so the free correction is given once per address | legitimate interest in protecting the service and its users (Art. 6(1)(f)) |
| Reviews (only if you write one) | your rating, the text you write, and, only if you tick the box, your first name and country shown next to it; whether you had at least 3 practice sessions (to label it "verified learner") | your consent (Art. 6(1)(a)); withdraw it any time by writing to us and the review is removed |
| In-app feedback (only if you answer) | your answer to an optional question in the app ("Useful?", "What's missing for you?", what is stopping you from getting the pass) or a message you send from "Send feedback": the thumbs up or down, the choice you tap, the words you write (at most 1,000 characters), which part it is about, the page language, your exam and the date. Linked to your account only if you are signed in, otherwise anonymous; never your email, name or IP address | legitimate interest in improving civicoach (Art. 6(1)(f)); every question can be skipped and is asked only once |
| Daily reminder (only if you turn it on) | the days and time you chose, your time zone, a push subscription (an address issued by your browser's push service: Apple, Google or Mozilla) or your email if you chose email, and whether you opened recent reminders | your consent (Art. 6(1)(a)); turn it off any time in Account or with the one-tap link in every reminder, and the subscription is deleted |
| Where you came from, and test versions | a short campaign code from the link you arrived from (for example ?src=tiktok), kept in your browser and with your account for up to 60 days; which version of a screen you were shown (A/B tests) and whether you then signed up or bought a pass; the moments we suggest the pass are chosen from your activity on the site (the price is the same for everyone, and each suggestion says why you see it) | legitimate interest in knowing which links and screens help learners (Art. 6(1)(f)); no third-party pixels or trackers, and no automated decision with legal or similarly significant effects (Art. 22) |
| Visit statistics | only aggregated counts per day, page, language and country; no identifier | legitimate interest in knowing which pages help (Art. 6(1)(f)); see the cookie policy |
| Answering your requests and defending our rights | the messages you send us, deletion requests | legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) |
| Paid pass and withdrawal | pass bought, dates, credits used, payment reference, withdrawal and refund | performance of the contract (Art. 6(1)(b)) and tax obligations (Art. 6(1)(c)) |
Without the data marked "performance of the service" we cannot provide that feature. The waitlist is optional: if you don't consent, everything else still works.
What we don't do. We don't ask for your name, ID document, nationality, date of birth or citizenship situation. We don't profile you for marketing, we don't sell or hand over data, we don't use your texts to train AI models, we don't recognise who is speaking from the voice, and we don't infer emotions or origin from your accent.
Careful with personal details in your texts
Exam tasks often ask you to write about yourself (family, work, health, religion). You don't need real details: invent names, addresses and facts, the score is the same. If you still write personal information, including "special category" data (health, religion, ethnic origin), we process it only to correct your text, we don't analyse it for anything else, and we delete it on the schedule below.
Scores and automated decisions
Your score is a practice estimate, not an official result. It is produced automatically, but it has no legal effect on you and does not affect you in a similarly significant way: it does not decide your exam, your citizenship or your access to any service. So Art. 22 GDPR does not apply. If some feedback looks wrong, write to us and we'll check it.
3. Adults only
The service is for people 18 or older. We ask you to confirm this before AI feedback and before creating an account. If we learn that an account belongs to a minor, we delete it. See Adults only.
4. Who receives the data
We don't sell or disclose data to anyone for their own purposes. We use a few providers that process data on our behalf (processors, Art. 28 GDPR), bound by contract:
| Provider | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | hosts the website, the server code and the database; protects against attacks, including the automatic "are you a person" check (Turnstile) when you ask for a sign-in link or send written feedback without an account | database in the European Union; worldwide delivery network |
| OpenRouter, Inc. | forwards the text to be corrected to the AI model | United States |
| Anthropic PBC (sub-processor of OpenRouter) | the AI model (Claude) that writes the feedback | United States |
| Brevo (Sendinblue SAS) | sends sign-in links and waitlist emails | Parigi, Francia (UE) |
What the AI receives. We send the model the task, your text or transcript, and the grading instructions. We don't send your name, email, account identifier or IP address. Before sending, we automatically remove email addresses, phone numbers, IBANs, Italian tax codes, card and ID-document numbers from the text; names and addresses you write do stay in, which is why we ask you to invent them. To check that a text isn't copied from one of your earlier ones, we compare it with your earlier texts on our own server only: those are not sent to the AI. We set OpenRouter not to store the texts (prompt logging off) and to forward them only to Anthropic, which does not use them to train models and deletes them within 30 days. It may keep them for up to 2 years only if its automated systems flag them for a breach of its usage rules.
Speech model. The first time you record a spoken answer, your browser downloads the speech-recognition model (Whisper, about 77 MB) from Hugging Face, Inc. (huggingface.co, United States). Hugging Face then receives your IP address and technical browser data, as any website does, but not the audio. Hugging Face acts as an independent controller under its own privacy policy. We are moving these files to our own domain.
Payments. The pass is sold through Stripe Managed Payments. The seller of record is Link, LLC (Stripe group), which processes payment data as an independent controller under its own privacy policy. We receive only the payment outcome, the amount and a reference, never card details.
Google sign-in. If you choose "Continue with Google", you sign in on Google's own page, under the terms and privacy policy of Google (Google Ireland Limited for users in the EU), which acts as an independent controller of your Google account. Google learns that you signed in to civicoach; we ask Google only for your email address (scopes "openid email").
We disclose data to authorities only when the law requires it.
5. Transfers outside the European Union
OpenRouter and Anthropic are based in the United States, and Cloudflare is a US company. These transfers rely on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR) and, for certified providers, on the EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023, Art. 45 GDPR). On top of that, we send the AI only the text it needs, with nothing that identifies you. You can ask us for a copy of the safeguards at support@civicoach.app.
6. How long we keep data
| Data | How long |
|---|---|
| Audio of spoken answers | never on the server: it stays in your browser and is gone when you close the page |
| Essays, transcripts and feedback text | 90 days after grading; then the text is deleted and only the date and scores remain. If you press "Keep", they stay until you undo it or delete your account |
| Practice answers and scores | as long as you have the account |
| Data without an account (cookie only) | deleted when the session expires, 30 days after the cookie was created. Create an account to keep it longer |
| Account | until you delete it; deleted automatically after 24 months without visits |
| Sign-in and deletion links sent by email | 24 hours after they expire |
| Password hash and Google link | as long as the account; deleted with it. Password-reset and email-change links: 24 hours after they expire. Count of wrong passwords: 1 day after the last attempt |
| Waitlist | until the one "the pass is available" email, then deleted 30 days later; deleted if you don't confirm within 14 days of the confirmation email; deleted if we couldn't send you the confirmation within 180 days |
| Proof of your waitlist consent (a cryptographic fingerprint of your email, the version and date, no IP address) | 24 months after the last event, to prove you consented |
| Messages you send us and requests about your rights | 24 months, so we can show that we answered |
| AI grading cost log | 13 months, no longer linked to your account once you delete it |
| Record that an email address has used its free correction (a cryptographic fingerprint of the address, not the address, not linked to your account) | 12 months, also after you delete the account, so the free correction cannot be taken again by signing up again |
| Passes bought, payments and withdrawals | 10 years, as Italian tax law requires (Art. 2220 Civil Code); no longer linked to your email after you delete the account |
| Campaign code and test version | 60 days, or until you delete your account |
| In-app feedback | 12 months, or until you delete your account if you were signed in when you sent it |
| Aggregated statistics | 26 months (not personal data) |
Automatic deletion runs every night.
7. Your rights
At any time, free of charge, you can ask us for:
- access: what data we hold and a copy of it (Art. 15). You can also download it yourself as JSON from Delete my data;
- rectification of inaccurate data (Art. 16);
- erasure (Art. 17): do it yourself from Delete my data, even without an account (we email a link to the address you give);
- restriction of processing (Art. 18);
- portability of the data you gave us (Art. 20);
- objection to processing based on legitimate interest (Art. 21);
- withdrawal of your waitlist consent, at any time, with the link in every email or from the deletion page. Withdrawal doesn't make earlier processing unlawful.
Write to support@civicoach.app. We answer within one month (Art. 12). To protect your account, we may ask you to confirm the request from your registered email address.
Complaints. If you think we handle your data wrongly, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, Italy, www.garanteprivacy.it, or to the authority of the EU country where you live or work. We'd appreciate it if you wrote to us first: it is often sorted out in a day.
8. Security
Connections are always encrypted (HTTPS). Session tokens and sign-in links are stored only as hashes, never in clear; passwords only as a salted PBKDF2 hash (210,000 iterations), never in clear and never in logs. No IP addresses in our logs. Only the controller can access the data. Spending and rate limits for every account. Database in the European Union.
9. Changes
If we change this notice in a significant way, we say so on the site and, if you are on the waitlist or have an account, we notify you before the change applies. Earlier versions are available on request.
This notice is written in Italian, which is the authoritative version, and in English.
Version 2026-10-18 ·
civicoach practice booklet · not an official document