Data we process
We process account and contact data, verified email addresses, technical credentials and security logs, communities you create or join, roles, subscriptions and payments, progress, published content and support requests. Biometric data used by passkeys remain on your device and are not received by AVSOF Academy.
Purposes and legal bases
Account, access, community, course, video, support and payment data are processed to perform the contract or pre-contractual steps you request. Invoices, accounting records and responses to authorities are processed to meet legal obligations. Logs, fraud prevention, security, continuity and dispute handling rely on the controller's legitimate interest in protecting users and the service, balanced against data subjects' rights. Promotional communications, non-essential cookies and promoter attribution rely on consent where required; withdrawing consent does not affect the lawfulness of earlier processing.
Declarations and contract requests
We record the version and date of acceptance of the terms and adult declaration, without asking for a date of birth. For withdrawal and renewal cancellation we process name, email, contract reference, statement, dates and acknowledgement outcome. Statements are encrypted and accessible only to authorized staff handling the contract and applicable obligations.
Required and optional data
Email, authentication data, acceptance of applicable documents and information essential for a purchase are required for the relevant function. Without them, we cannot create or protect an account, complete a purchase or provide access. Your public profile, biography, channels, portfolio and other fields marked optional can be omitted.
Recipients and roles
Only authorized recipients have access according to their role: AVSOF staff, community owners and moderators for their own members and content, and appointed providers for hosting and databases, transactional email, payments, video and distribution, monitoring and support. Providers process only the data needed for their assigned function. Authorities or advisers may receive data when required by law or necessary to protect a right. Data are not disclosed indiscriminately.
Transfers outside the European Economic Area
Processing locations depend on the providers actually enabled. When a service involves a transfer outside the European Economic Area, the controller uses a basis permitted by the GDPR, such as an adequacy decision or standard contractual clauses with applicable measures. Current information about providers, countries and safeguards can be requested using the controller's contact details above.
Promoter program
For promoters we process public names, declared channels, campaign participation, assigned codes, deduplicated clicks, conversions, commissions and payment status. We do not retain a plain-text IP address for click attribution. Opening a promoter link first offers a choice: we record the click and set attribution cookies only after consent. Refusal lets you continue without new tracking.
Commissioned video creators
The commissioned-video creator program is separate from the promoter program. We process public names, profiles, declared channels and portfolios, styles, languages, on-camera availability, applications, commissions, HTTPS delivery links, revisions and compensation status. Submitted links remain accessible to authorized managers for review and contractual retention; they must not contain credentials or material unrelated to the commission.
Retention
Public-page statistics
Only after consent do we collect view counts, clicks in percentage cells, time with the page visible, estimated active presence from interactions within the last 30 seconds, and estimated visibility endings. Traffic source is a category derived from the available referrer or campaign parameters; it does not prove identity, a sale or a definitive exit. We do not record form text, screens, email addresses, full URLs, IP addresses, visitor identifiers or private-area data. Aggregates stay in the Academy service for 7 days and are available only to the authorized owner. You can revoke consent in Cookie preferences; the browser choice lasts 180 days.
Italian Data Protection Authority guidelines on cookies and tracking
Accounts and content are retained while the account or relationship is active and, after closure, only for legal obligations, disputes and security under applicable terms. Sessions and verification or recovery links remain until expiry or revocation; email verification links expire after 24 hours. Posts and progress remain until deletion, closure or the end of the relevant service need. Payment and accounting data are retained for the period required by applicable law. Failed or incomplete video uploads are removed after 24 hours; social exports after 90 days unless retention is specified. Lessons are retained while offered and under the withdrawal policy.
Visitor hashes and promoter cookies expire within the campaign's stated window, from 1 to 90 days, and a nightly process removes expired clicks. Conversions, commissions, video commissions and compensation are retained for sales, refunds, disputes, licences and accounting obligations; data no longer needed are deleted or anonymized.
Automated decisions and profiling
We do not make decisions based solely on automated processing that produce legal or similarly significant effects. Technical limits and fraud signals may temporarily block a request or require verification; you can request human review using the contact details provided. We do not conduct commercial profiling without a legal basis and the required specific notice.
Your rights and complaints
You can request access, rectification, erasure, restriction, portability and objection where applicable, and withdraw consent. Send requests using the controller's contact details above; the Promoter and commissioned-video areas also provide profile export and closure. You retain the right to lodge a complaint with the Italian Data Protection Authority or seek a judicial remedy.
Content reports and review
To handle reports, we process the content link, stated facts, name and email where required, good-faith statement, dates, outcomes and review requests. Name and email may be omitted for the specific exception concerning reports of child sexual offences. Processing supports applicable obligations and protection of rights, not promotional purposes.
Contact information and allegations are encrypted in the application archive. Reporters use a private reference, authors use their own accounts, and operators use dedicated permissions. Authors receive facts and reasons without the reporter's identity. Transactional emails do not include opening pixels or links rewritten for tracking.
Data for cases closed for over 366 days is removed from the application archive when there are no active restrictions, unreconciled notifications or documented retention obligations. Minimal technical records of removal remain. Backups follow the service's retention cycle.