Privacy Policy

Last Updated: October 24, 2026 (Greenwich Mean Time)

1. Introduction

This Privacy Policy explains how Emanuele Dirignani ("Owner", "we", "us"), operating the Italicore application ("Italicore", "the Service"), collects, uses, stores, and protects personal information belonging to users ("you"). This Policy is intended to comply with the Privacy Act 2020 (New Zealand) and its Information Privacy Principles (IPPs), as the Owner is based in Auckland, New Zealand, and the Service's servers are hosted internationally.

This Policy should be read alongside our Terms and Conditions. If you do not agree with this Policy, please do not use the Service.

2. Information We Collect

We collect the following categories of personal information:

Category	Examples	Source
Account information	Username, email address, hashed password	Provided directly by you at registration
Learning progress data	Unit/lesson/topic progress, quiz scores, test results, lesson logs	Generated automatically as you use the Service
Journal entries	Titles, written entries, AI-generated corrections	Provided directly by you
Voice recordings	Short audio clips submitted for pronunciation practice	Provided directly by you (processed transiently for scoring)
AI interaction data	Messages exchanged with Lira, generated exercises, journal feedback	Generated as you use AI features
Payment and subscription data	Subscription tier, purchase history, invoice metadata	Provided by you and processed via Stripe (we do not store full card details)
Technical and security data	IP address, login timestamps, login success/failure	Collected automatically
Referral data	Referral tags, referring restaurant partner codes, and friend-invite connections (who invited whom, invite date, referral reward status)	Collected automatically via cookies or referral links
Feedback and support data	Bug reports, reviews, support correspondence	Provided directly by you
Anti-abuse data	reCAPTCHA v3 risk scores and related signals	Collected automatically via Google reCAPTCHA

3. How We Use Your Information

We use personal information for the following purposes, consistent with IPP 1 (only collecting information for a lawful, connected purpose) and IPP 10 (only using it for that purpose or a directly related one):

To create and manage your account and authenticate your login
To deliver the curriculum, track your progress, and personalize lesson difficulty
To power the Lira AI tutor, AI-generated exercises, pronunciation scoring, and journal feedback
To process subscription payments and manage billing through Stripe
To send transactional emails (verification codes, password resets, subscription confirmations, lesson explanations)
To send occasional project-related emails, where your email preferences permit, that help you get started or return to learning based on your registration and learning activity. These may include lesson reminders and, when you reach a learning milestone, an offer of a free Premium trial
To detect and prevent fraud, abuse, and automated attacks (via reCAPTCHA and login monitoring)
To respond to support requests, bug reports, and reviews
To track referrals from partner establishments for internal analytics
To track friend-to-friend invitations and deliver referral rewards (free Premium time or discount codes) to both the inviter and the invited user
To build, test, debug, and maintain the Service, including with the assistance of AI-based software development tools (see Section 4 below)
To comply with legal obligations

These occasional messages support your use of the Italian-learning project; they are not a regular commercial newsletter or third-party advertising. You can ask us to stop sending these non-essential project-related emails by contacting [email protected]. We may still send essential account and service messages.

We do not sell your personal information, and we do not use it for third-party advertising targeting beyond the ad content described in our Terms and Conditions.

4. AI Processing (Lira, Gemini, and Development Tools)

Certain features — the Lira chat tutor, AI-generated exercises and pronunciation drills, AI reading generation, and AI journal feedback — are powered by Google Gemini. When you use these features, the content you submit (messages, journal entries, exercise answers) is sent to Google's API for processing. By using these features, you acknowledge that this data may be used by Google in accordance with its own terms to provide and improve the underlying AI service.

Voice recordings submitted for pronunciation practice are processed using speech recognition and are not retained beyond the time needed to generate your score.

AI-assisted software development and maintenance. Separately from the user-facing AI features above, Italicore may use general-purpose AI coding and software-engineering assistants — such as Anthropic's Claude — to help write, review, debug, and maintain the application's code and infrastructure. In the course of this work, these tools may be given access to portions of the codebase and, where necessary to diagnose or fix an issue, to database records, logs, or exported data samples, which can include personal information (for example, journal entries, AI chat logs, or account records) if that information is directly relevant to the task at hand. This is analogous to the access already described in Section 9 for authorized personnel performing system administration, safety moderation, or customer support. Data shared with such AI development tools is handled in accordance with the relevant provider's own privacy policy and terms (for Anthropic, see anthropic.com/legal/privacy), and we take reasonable steps to limit what is shared to what is genuinely needed for the development or troubleshooting task.

5. Third Parties We Share Data With

Third Party	Purpose
Stripe	Payment processing, subscription billing, invoicing
Google (Gemini API)	AI tutoring, AI-generated exercises, journal feedback, reading generation
Anthropic (Claude)	AI-assisted software development, debugging, and maintenance of the Service (not used to power any in-app student-facing feature)
Google reCAPTCHA	Bot and abuse prevention on public-facing forms
Google Cloud Platform (GCP)	Application hosting and database infrastructure
Google (Gmail SMTP)	Sending transactional and account-related emails, including the occasional project-related learning reminders and trial offer described in Section 3. Your email address and the content of these emails pass through Google's email systems. See Section 7 for what this means for deleted accounts.

We do not permit these providers to use your personal information for their own independent marketing purposes.

6. International Data Transfers

Your information is processed and stored on servers provided by Google Cloud Platform, which may be located outside New Zealand. Google, Stripe, Anthropic, and other providers listed above may also process data outside New Zealand. By using the Service, you consent to this transfer. We take reasonable steps to ensure that any recipient of your information outside New Zealand is required to protect it in a way that, overall, provides comparable safeguards to those in the Privacy Act 2020, consistent with IPP 12.

7. Data Retention

We retain personal information only for as long as necessary for the purposes described in this Policy, consistent with IPP 9:

Data Type	Retention Period
Account & profile data	For as long as your account is active, or until deletion is requested (copies may remain in backups for up to 30 days after deletion, see below)
Login logs (including IP addresses)	24 months, after which entries are automatically anonymized (identifying details such as IP address and account association are removed); the anonymized records are not deleted and may be retained for security and analytical purposes
AI interaction logs (Lira chats, AI exercise logs)	24 months, after which entries are automatically anonymized (identifying details such as your email/account association are removed); the anonymized records are not deleted and may be retained for quality assurance and service improvement purposes
Journal entries, lesson logs, test logs	Journal entries are kept until you delete the entry. If you delete your account, journal entries, lesson logs and test logs are kept but disconnected from your identity (see "Deleted account records" below). Deleted items may remain in backups for up to 30 days (see below)
Purchase and billing logs	Retained as required for tax, accounting, and dispute-resolution purposes. Stripe also keeps its own payment records, as required by law and under its own policies, independently of your Italicore account
Voice recordings (pronunciation practice)	Not retained beyond the time required to generate a score
Verification / password reset codes	Deleted automatically after expiration (typically within 10 minutes)
Friend-referral connections (invites)	Retained while the referral reward is pending or for historical record; if either account is deleted, that account's email is anonymized within the record rather than deleted, consistent with our account deletion process
Deleted account records	Personal identifiers are replaced with anonymized placeholders; associated historical records are retained in de-identified form. Backup copies made before deletion may still contain your original details for up to 30 days (see below)
Backups of our systems	We keep automatic backup copies of our database so that the Service can be restored if something goes wrong. When you delete your account or content, it is removed from our live systems, but copies of that data may remain in backups for up to 30 days, after which the backups are automatically replaced or deleted
Emails sent through Gmail (SMTP)	Copies of emails we send you, which include your email address, may remain in the sent records of the Google email account we use and in Google's systems. They may therefore be recoverable there even after your Italicore account is deleted. How long Google keeps them is governed by Google's own retention policies, which we do not control
Data shared with AI development tools (e.g. Claude)	Not persisted by Italicore beyond the specific debugging or development task; any retention by the tool provider itself is governed by that provider's own policy

In plain words: what happens when you delete something?

Your identity is removed from Italicore straight away. When you delete your account, we remove your login details and replace your name and email in our records with an anonymous placeholder, so what remains can no longer be linked to you. Some records, such as lesson history and journal entries, are kept in this anonymized form rather than erased. If you delete a single journal entry, that entry is deleted.
Safety copies may keep it for up to 30 days. Like most online services, we make regular "backups", which are safety copies of our database that let us restore the Service if there is a technical failure. A deleted item can still sit inside those safety copies for up to 30 days, until they are automatically replaced. During this time it is not visible to other users and is not used for anything else.
Emails you received from us may stay in Gmail. Every email we send you (for example a verification code or a confirmation) is delivered through Google's Gmail. A copy of that email, including your email address, can remain in our Google email account and in Google's systems even after you delete your Italicore account. This is outside our direct control, because Google decides how long such copies are kept.

8. Your Privacy Rights

Under the Privacy Act 2020, you have the right to:

Access the personal information we hold about you (IPP 6)
Correct information that is inaccurate, out of date, or incomplete (IPP 7)
Request deletion of your account and associated personal data via the Danger Zone section of your Account page, or by contacting us. Please note that some historical records are kept in anonymized form, that copies may remain in backups for up to 30 days, and that copies of emails may remain in Gmail, as explained in Section 7
Ask questions about how your information is used

To exercise these rights, please contact us at [email protected]. We will respond within the timeframes required by the Privacy Act 2020 (generally within 20 working days).

Note on anonymization: Once login logs and AI interaction logs reach the 24-month retention period described above, we do not erase the underlying records outright. Instead, we strip them of information that could reasonably identify you (such as IP address or account email), converting them into anonymized data. Anonymized data is no longer "personal information" under the Privacy Act 2020 and may be retained indefinitely for security monitoring, service improvement, and analytical purposes.

Note on backups and deleted data: Deleting your account or content removes it from the live Service (or, for some historical records, disconnects it from your identity), but it does not instantly erase every copy. Backup copies made before the deletion may continue to exist, and could be recovered if we had to restore the Service, for up to 30 days. After that period, the backups containing your data are automatically replaced or deleted. Separately, emails sent to you through Gmail (SMTP) may remain, together with your email address, in the sent records of our Google email account and in Google's systems, subject to Google's own retention policies.

Note on how access is provided: When you access your data through your account's "My Data Export" page, some information is presented as a summary or excerpt rather than in its raw internal form — for example, curriculum lesson names are shown instead of internal numeric identifiers, and AI tutor (Lira) conversations are grouped by day with short previews rather than full verbatim transcripts. This is done under section 52 of the Privacy Act 2020 (which allows an agency to withhold information that would disclose a trade secret or unreasonably prejudice its commercial position — in this case, the internal structure of our curriculum and the specific prompting behind our AI tutor) and section 56(1)(b) (which expressly permits providing personal information "by giving, in any manner, an excerpt or a summary of the document's contents"). The substance of your personal data — your answers, scores, progress, and the fact that these conversations took place — remains fully accessible. If you need the complete, unabridged transcript of a specific AI conversation, you may request it directly at the email address above.

Separately, where your data export includes a friend-referral connection, the other person's email address is partially masked (e.g. j***@example.com). This is done under section 53(b) of the Privacy Act 2020, which protects against the unwarranted disclosure of another individual's affairs when responding to your own access request.

9. Data Security

We take reasonable steps to protect personal information against loss, unauthorized access, use, modification, or disclosure, consistent with IPP 5. Passwords are stored using industry-standard hashing. Payment details are handled directly by Stripe and are never stored on our servers. However, no system can guarantee absolute security, and you use the Service at your own risk in this respect.

Please note that journal entries are stored in our database and are not end-to-end encrypted. They may be accessed by authorized personnel — or, where necessary to diagnose a technical issue, by AI-assisted development tools as described in Section 4 — for system administration, safety moderation, customer support, or platform improvement. Please avoid including sensitive personal, medical, or financial information in journal entries.

10. Data Breach Notification

In the event of a privacy breach that has caused, or is likely to cause, serious harm, we will notify the New Zealand Office of the Privacy Commissioner (OPC) and affected individuals as soon as practicable, in accordance with our internal breach response procedure and the requirements of the Privacy Act 2020.

11. Cookies and Tracking

We use cookies for the following purposes:

Session cookies: to keep you logged in and maintain your lesson progress during a session
Referral cookies: to record referring restaurant partners for a limited period (4 days)
PWA dismissal cookies: to remember if you dismissed the "Install App" banner
reCAPTCHA cookies: set by Google to assess bot risk on protected forms

We do not use cookies for third-party behavioral advertising.

12. Children's Privacy

Italicore is intended for general audiences learning Italian. If you are under the age of 16, please only use the Service with the involvement and consent of a parent or guardian. If we become aware that we have collected personal information from a child without appropriate consent, we will take steps to delete that information.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will update the "Last Updated" date above when changes are made. Continued use of the Service after changes are posted constitutes acceptance of the revised Policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact:

Owner: Emanuele Dirignani
Email: [email protected]
Jurisdiction: Auckland, New Zealand

If you are not satisfied with our response, you may lodge a complaint with the New Zealand Office of the Privacy Commissioner at www.privacy.org.nz.