Home›Privacy policy
Privacy policy
This policy explains what personal data learnitalianbooks.com ("the Site") collects, why, and what rights you have. We keep it short and literal: we collect very little, and we never sell data.
Who is responsible
The Site is operated by Impact Investments S.R.L., VAT ID IT01331310324, Via Guido Zanetti 1, 34133 Trieste (TS), Italy (the "data controller" under the EU General Data Protection Regulation, GDPR). In Vietnam the Site is operated by the household business MORA AI BUSINESS, Thần Lĩnh 3, Nghệ An, Việt Nam, which processes data of users in Vietnam in accordance with Decree 13/2023/NĐ-CP on personal data protection.
Contact for anything related to privacy: founder@morapost.com.
What we collect and why
| Data | When | Why | Kept for |
|---|---|---|---|
| Email address | You sign in, buy the book or subscribe to emails | To create your account, send the 6-digit sign-in code, confirm purchases and send the emails you asked for | While your account or subscription exists; unsubscribed addresses are deleted within 30 days |
| Sign-in codes (hashed), session tokens (hashed), device type and approximate city | You sign in | To keep you signed in on up to 2 devices and to show you which devices are signed in | Codes: valid for 10 minutes, the hashed record is deleted within about 2 hours · sessions: until you sign out, or 400 days after the device was last used |
| Learning progress: answers, scores, mistake notebook, notes, current page, study history | You use the book while signed in | So your progress is saved to your account and synced between your devices | While your account exists |
| Order details: book, amount, currency, payment method, provider reference, date | You buy the book | To unlock the book, send the receipt email, handle refunds and keep the accounting records the law requires | 10 years (tax law); unpaid or cancelled orders are deleted after 30 days |
| Technical logs: IP address, user agent, requested URL, timestamps | Any request to the Site | Security, abuse prevention and rate limiting, debugging | Up to 30 days |
| Content usage counts (how many paid pages/files a signed-in account opens per day) | You read paid content | To detect account sharing and bulk downloading | 90 days |
We do not collect card numbers or bank details. Payments are handled entirely by the payment providers below.
If you read the free sample without signing in, your progress is stored only in your browser (local storage) and never sent to us.
Payment providers
- Stripe (Stripe Payments Europe, Ltd. and Stripe, Inc.) processes card and wallet payments. Stripe receives your email, the amount and the payment details you enter on Stripe's page. See Stripe's privacy policy.
- PayOS (operated by Công ty Cổ phần Giải pháp Thanh toán Việt / payOS, Vietnam) processes bank-transfer QR payments for customers in Vietnam. PayOS receives the order number, amount and your email. See PayOS's privacy policy on payos.vn.
We receive from them only a confirmation that the order was paid, the amount and a reference number.
Other service providers
- Cloudflare, Inc. hosts the Site (Workers, D1 database, R2 storage) and provides security and, if enabled, privacy-friendly web analytics (no cookies, no cross-site tracking).
- Resend, Inc. sends our emails (sign-in codes, receipts, newsletters).
- Google Analytics 4 may be used to measure traffic. If it is, it is loaded only after you accept it in the cookie notice, and IP addresses are truncated.
These providers process data on our behalf under data-processing agreements and may be located outside the EU or Vietnam (in particular in the United States). Transfers rely on the EU Standard Contractual Clauses or equivalent safeguards.
Cookies and local storage
- A single, strictly necessary session cookie (
__Host-sid) keeps you signed in. It is HttpOnly and expires when you sign out or 400 days after it was last used. - Browser local storage keeps your settings and, for guests, your sample progress.
- No advertising cookies. Analytics cookies, if any, only with your consent.
Legal bases (GDPR)
- Performing our contract with you (account, purchase, progress sync, support): Art. 6(1)(b).
- Legal obligations (accounting and tax records): Art. 6(1)(c).
- Our legitimate interests (security, abuse prevention, measuring traffic in a privacy-friendly way): Art. 6(1)(f).
- Your consent (newsletter, optional analytics): Art. 6(1)(a). You can withdraw it at any time.
Emails
Sign-in codes and purchase confirmations are transactional and are sent to anyone who signs in or buys. The newsletter is sent only after you confirm your address (double opt-in), and every email has an unsubscribe link.
Your rights
You can ask us to access, correct, export or delete your data, to restrict or object to processing, and to withdraw consent. Write to founder@morapost.com from the email address of your account; we answer within 30 days. If you delete your account, we delete your progress and sessions immediately and keep only the order records the law requires.
If you are in the EU you can also complain to your data protection authority (in Italy: Garante per la protezione dei dati personali). In Vietnam you can contact the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security.
Children
The Site is not directed at children under 16. We do not knowingly collect data from them; if you believe a child has created an account, write to us and we will delete it.
Security
Data is transmitted over HTTPS only. Sign-in codes and session tokens are stored hashed. Paid content is served only to signed-in buyers. Access to the database is limited to the operators of the Site.
Changes
We may update this policy when the Site changes. The date at the top of this page shows the latest version. Material changes are announced on the Site or by email.