Privacy Policy

Last updated: May 2026 · 26 October 2026 · v2026.10.26

1. Data Controller

The Data Controller is Jasmin Eden, a natural person residing in Italy.
Privacy contact: jasmineden23@gmail.com
To exercise your GDPR rights (Art. 15–22) write to this email in Italian or English. We reply within 30 days.

2. What we collect and why

Account: email, password (encrypted, never plaintext) or Google/Apple identity. Legal basis: contract performance.
Public profile: nickname, city in Veneto, country of origin, languages, optional photo, "light" color, open-question answers. Legal basis: consent.
Year of birth: used only to confirm you are 18+. Never shown publicly.
User content: global and private chat messages, voice notes, reactions, help posts, advice threads, spontaneous meetups, events, proposed event ideas and "I'm interested" votes.
Technical: IP address (hashed only, anti-abuse), minimal security logs, device type. Legal basis: legitimate interest.
Lesson payments: handled entirely by Stripe; we never store card data. Legal basis: contract performance.

2a. Interest list (no longer offered)

The site used to offer an interest list without an account; it is no longer available and we do not collect new sign-ups. For people who already signed up we keep: first name, email, preferred Veneto city, format of interest, preferred language, an optional note and the date of consent.

Purpose: contacting you only about NewChapter experiences (e.g. the date and city of the first gathering).
Legal basis: consent (Art. 6.1.a GDPR), which you can withdraw at any time by writing to the privacy contact above.
Access: NewChapter administrators only. Data is never public, sold or shared with third parties for marketing.
Retention: until you withdraw consent, or at most 24 months after signing up. Sign-ups older than 24 months are flagged in the admin area and deleted manually by the administrator, who checks at least monthly.

3. Public vs private

Public: nickname, city, country, languages, photo, color, story, public chat messages, events, advice, event ideas (with the proposer's nickname) and the total vote count for each idea.
Private: email, year of birth, direct messages, payment data, technical logs, and who voted for an idea (visible only to you; publicly we show only the total).

4. Retention

Active account: as long as you use the service.
Deleted account: personal data removed within 30 days of the request (see Sec. 7). Public content may remain in anonymised form.
Security logs: max 12 months.
Billing data (lessons): 10 years (Italian tax law).

5. Sub-processors

We rely on these GDPR-compliant providers:

Supabase (database, auth, storage) — EU/USA under SCCs.
Cloudflare (CDN, edge hosting) — EU/USA under SCCs.
Stripe (payments) — Ireland + USA under SCCs.
Google / Apple (optional login).
Resend / SendGrid (transactional email, if enabled) — EU/USA.

None of these providers sells your data. Transfers outside the EU only happen under an adequacy decision or Standard Contractual Clauses.

6. Cookies

See our Cookie Policy for the breakdown. In short: essential cookies only by default; analytics and marketing only with your explicit consent.

7. Your GDPR rights

You can at any time:

Access your data (Art. 15).
Correct it (Art. 16) from your Profile page.
Export it as JSON (Art. 20) from Settings → "Download my data".
Delete your account (Art. 17) from Settings → "Delete account" (30 days to cancel) or, even without signing in, via the Delete account page.
Restrict or object to processing (Art. 18–21) by writing to us.
Withdraw consent at any time.
Lodge a complaint with the Italian Data Protection Authority if you believe the processing infringes the GDPR.

8. Minors

NewChapter is restricted to people aged 18 or older. We verify age at signup. If you discover a minor has an account, please report it and we will remove it within 72 hours.

9. Security

Bcrypt-hashed passwords, mandatory HTTPS/TLS, leaked-password protection (HIBP), Row-Level Security on the database, audit log for admin actions.

10. Changes

We may update this policy. For material changes we will ask again for your consent at the next login. The current version is shown at the top.

11. Contact

Any privacy question: jasmineden23@gmail.com