Privacy policy

The data controller is NOVAMARKET DI CANNAVO' MICHAEL, Via Roma 213, 95030 Mascalucia (CT), Italia, P. IVA 06173360873. For any privacy question or to exercise your rights write to privacy@withvesta.it. This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR").

• Account data: email, password (stored only in hashed form), display name, language, sign-up and last sign-in dates. • Plan and credits: chosen plan, credits used, subscription status. • Your material: texts, documents, flashcards, quizzes, maps and the content you upload (PDFs, images, YouTube links). • Technical data: IP address and server security logs, kept briefly. • Waitlist: if you join before launch, only your email. We do not ask for special categories of data (health, religion, etc.): please do not put them in your material.

• Providing the Service (account, saving material, AI generation, credits): performance of a contract (Art. 6(1)(b) GDPR). • Payments and tax obligations, once paid plans are active: legal obligation (Art. 6(1)(c)). • Security, abuse prevention and usage limits: legitimate interest (Art. 6(1)(f)). • Waitlist and launch notice: consent (Art. 6(1)(a)), which you can withdraw at any time. We do no advertising profiling, we do not sell data, and we do not use your material to train AI models. We make no automated decisions with legal effects on you.

When you use an AI Feature, the necessary text (your request and the material to process) is sent to OpenRouter, which forwards it to the AI provider (Google) to generate the answer. The text is used only to produce the result. PDFs and images are read on our server in France and are not kept after text extraction. For YouTube videos we send YouTube only the video ID to fetch the transcript.

We only use providers needed for the Service, appointed as processors (Art. 28 GDPR): • OVH SAS (France, EU): servers and database where accounts and material are stored. • OpenRouter Inc. (USA): routing of AI requests. • Google (USA / EU): processing of AI requests. • YouTube / Google: only the video ID, for the transcript. We will later use an email provider for account confirmations and, when payments go live, a payment processor: we will update this notice before doing so. Data may be disclosed to authorities only when required by law.

Accounts and material are stored in the EU (France). Text sent to AI Features may be processed in the United States, under the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses (Art. 46 GDPR). We send the AI provider only the request text, never your email or account data.

• Account and material: as long as you have the account. When you delete it they are erased immediately; backup copies are overwritten within 30 days. • Billing data: 10 years, as required by tax law. • Server security logs: up to 30 days. • Waitlist: until launch and the invitation is sent, or until you ask to be removed.

You have the right to access, rectify and erase your data, restrict processing, receive it in a portable format, and object to processing based on legitimate interest (Arts. 15–22 GDPR). You can withdraw consent at any time. Directly in the app, under Plan → Your data: • "Download my data": a JSON file with your account, profile, plan and all your material. • "Delete account": permanently deletes the account and all material. For other rights write to privacy@withvesta.it: we reply within 30 days. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the authority of your EU country.

We only use technical tools strictly necessary for the Service, which do not require consent: • vesta_locale (cookie): remembers your language. • Supabase session cookies (sb-…): keep you signed in. • Browser storage (localStorage / IndexedDB): reading preferences, flashcard review state, current plan and in-progress generation drafts. This data stays on your device. We use no profiling, analytics or advertising cookies. That is why we do not show a cookie banner.

Connections are encrypted (HTTPS), passwords are stored only hashed, and each user can access only their own data thanks to database-level security rules. If a data breach may put you at risk, we notify the supervisory authority within 72 hours and, where required, you as well.

In Italy you can sign up on your own from age 14. Under 14, a parent's or guardian's consent is required. If you are a parent and believe your child signed up without consent, write to us and we will delete the account.

If we change this notice we update the date at the top; for material changes we notify you by email or in the app.