Privacy Policy

1. Who is responsible for your data

The data controller is Pietro Meloni, PhD, sole trader, VAT No. IT18196951000, Italy. Email: pietro@pietromeloni.com.

There is no Data Protection Officer: the business is a single tutor and does not meet the conditions of Article 37 GDPR that would make one mandatory. Write to the address above for anything concerning your data.

2. What data is collected, and why

Nothing on this site requires you to create an account. Data is collected only when you choose to send it, plus the technical and analytics data described further down.

Contact form. Name, email address and the text of your message. Used to read your enquiry and answer it. The message is delivered to my inbox by email; it is not added to any marketing list.

Booking an assessment session. Name, email address, whether you are a parent or a student, the slot you pick and your time zone. The approximate country, region and city derived from your IP address by the hosting provider are attached to the internal notification, so I know which time zone and market the request comes from. The booking creates an entry in my calendar and sends you a confirmation email with a calendar file attached.

Free study tools and downloads. Exam simulator, practice by topic, mock exams, grade calculator, formula sheets, voice practice and the other tools work without registration. Some of them ask for an email address in order to send you a PDF or a set of results: those materials come with a subscription to the newsletter, which the form states before you send it and which you accept by ticking its box. The material is sent straight away; the subscription starts only after you confirm it from the email that follows, and you can leave with one click at any time. Your answers, and in the voice practice the audio of what you say, are sent to the AI providers listed in section 4 for the sole purpose of producing the feedback you see on screen; they are not stored on this site after the response is returned.

Newsletter (The Daily 7). Email address, whether you are a student or a parent, the courses and exam session you choose, your time zone, the approximate country derived from your IP address, the page or download you subscribed from, and the exact consent sentence you accepted with its date and a shortened IP address. You are subscribed only after clicking the button in the confirmation email (double opt-in). The emails record whether they are opened, to stop writing to people who no longer read them. Every email has a one-click unsubscribe link, and replying "unsubscribe" works too.

Student and parent area. Families receiving tutoring get a private link to their lesson reports. That area contains the student first name, the lessons taken, the topics covered and my written comments. It is reachable only through the link, which is not indexed by search engines.

Analytics, session analysis and advertising. Pages visited, approximate location, device and browser, how you arrived on the site, which buttons and forms you interact with, and anonymised session recordings and heatmaps. Details and durations are in the Cookie Policy.

Server logs. The hosting provider records IP address, date, requested page and user agent for every request, for security and troubleshooting.

3. Legal basis

• Answering an enquiry, arranging an assessment session or running the tutoring relationship: performance of a contract or of pre-contractual measures taken at your request (Article 6(1)(b) GDPR).
• Delivering a PDF, exam results or study material you asked for: same basis, the request itself is the service.
• Newsletter: your consent, given by ticking the box and confirming by email (Article 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link.
• Keeping invoices and accounting records: legal obligation (Article 6(1)(c) GDPR).
• Server logs and basic site security: legitimate interest in keeping the site available and free of abuse (Article 6(1)(f) GDPR).
• Analytics, session analysis and advertising cookies: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time as explained in the Cookie Policy.

4. Who your data reaches

No personal data is sold or traded. It is shared only with the service providers that make the site work, each acting as a data processor or, where marked, as an independent controller:

• Vercel Inc. hosting of the site and server logs. Privacy policy.
• Resend (Plus Five Five, Inc.) delivery of the emails generated by the forms, the booking confirmations and the newsletter, and the record of whether those emails are delivered and opened. Privacy policy.
• Google Ireland Ltd / Google LLC Google Analytics 4, Google Ads and Google Calendar for the booking. Privacy policy.
• Microsoft Ireland Operations Ltd Microsoft Clarity, for aggregated heatmaps and session recordings. Privacy statement.
• OpenAI, Google and Anthropic transcription and automatic marking inside the free study tools. What you send to a tool is passed to one of these providers through their business APIs, which do not use it to train their models. Privacy policies: OpenAI, Google, Anthropic.
• A private server operated by me in the European Union (Hetzner Online GmbH, Germany) stores bookings, lesson reports and the newsletter subscriber list.
• My accountant, for invoices, and the tax authorities, where the law requires it.

5. Transfers outside the European Union

Some of the providers above are established in the United States. Those transfers rely on the European Commission adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and on the Standard Contractual Clauses adopted by the European Commission in every other case. You can ask me for a copy of the safeguards in place.

6. How long data is kept

• Enquiries that do not lead to tutoring: up to 24 months from the last exchange, then deleted.
• Families receiving tutoring: for the whole of the relationship and for 24 months afterwards, so that a returning student’s history is not lost.
• Lesson reports in the student area: as above; the link stops working when the area is closed.
• Invoices and accounting records: 10 years, as required by Italian law (Article 2220 of the Civil Code).
• Analytics data: up to 14 months in Google Analytics. Microsoft Clarity keeps session recordings for up to 30 days and aggregated data for up to 13 months.
• Server logs: up to 30 days at the hosting provider.
• Answers and audio submitted to the free study tools: not retained after the feedback is returned.
• Newsletter: while you are subscribed. After you unsubscribe, the address is kept only in a suppression list, with the date and the consent record, for up to 24 months, so that no email reaches you by mistake; then deleted. Unconfirmed subscriptions are deleted after 30 days.

7. Your rights

Under Articles 15 to 22 GDPR you can ask me to give you access to your data, correct it, delete it, restrict how it is used, hand it over in a portable format, or object to processing based on legitimate interest. Where processing is based on consent, you can withdraw that consent at any time without affecting what was done before.

Write to pietro@pietromeloni.com. I answer within one month, as the Regulation requires. If you are not satisfied, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, or to the authority of the country where you live.

8. Students under 18

Tutoring involves school-age students, and many of them are minors. Enquiries, bookings and the tutoring agreement are made with a parent or guardian, who provides the student data needed to run the lessons. The free tools on this site do not require an account and are designed to work without identifying the person using them; students under 14 should use them with a parent’s agreement, as Italian law sets that age for consent to information society services. The newsletter for students is reserved to students aged 16 or older, who declare it when subscribing; younger students can be subscribed by a parent.

9. Security

The site is served over HTTPS only. Access to bookings, lesson reports and the mailbox is protected by strong, unique credentials with two-factor authentication where the provider supports it. The student area is reachable only through an unguessable link that search engines are told not to index. No system is perfect, and I do not claim otherwise: if a breach ever affects your data I will notify you and the supervisory authority as Articles 33 and 34 GDPR require.

10. Changes to this policy

When the site starts or stops using a service that touches personal data, this page is updated and the date at the top changes with it. Substantial changes affecting people already in contact with me are also communicated by email.