Privacy Policy

Welcome to Mnemone. This Privacy Policy explains how we collect, use, protect, and process your personal data in full compliance with the General Data Protection Regulation (GDPR - Regulation EU 2016/679) and Legislative Decree No. 196/2003 (Italian Privacy Code), as amended by Legislative Decree No. 101/2018.

Data Controller (Art. 4(7) & Art. 24 GDPR): Alessandro Gibello Official Email: [email protected]

1. Information We Collect

We may collect information about you in various ways. The categories of data include:

• Personal Account Data: Information voluntarily provided during registration or support inquiries (username, email address, and accredited university domain where applicable).
• Learning & Study Data: Questions created, quiz answers submitted, review schedules, FSRS memory stability parameters, and exam readiness estimates. This data is strictly private and visible only to you.
• Usage Data & Technical Logs: Technical information recorded automatically by servers to ensure reliable request routing (IP address, browser type, operating system, and timestamp).
• Security Fingerprinting: We utilize a technical mechanism called "device fingerprinting" to uniquely identify browsers through configuration parameters (screen resolution, time zone, language preferences). This information is aggregated and converted into an alphanumeric identifier (hash) used strictly for security purposes—namely mitigating bot attacks, brute-force intrusions, and preserving platform integrity.

2. Data Storage Location (European Union Hosting - Chapter V GDPR)

• All servers, databases, and cloud storage systems utilized by Mnemone are geographically located within the European Union (European Economic Area - EEA), in full accordance with Chapter V of the GDPR (Articles 44–50).
• We do not carry out unauthorized international transfers of personal data to third countries lacking an adequate level of protection recognized by an adequacy decision of the European Commission.

3. How We Use Your Information

We process collected data solely to deliver an efficient, personalized, and secure educational experience:

• To create, authenticate, and administer your personal account.
• To compute and synchronize real-time FSRS spaced-repetition schedules.
• To generate tailored quizzes and flashcards from your study materials.
• To provide user support and respond to educational inquiries.
• To prevent computer fraud, unauthorized access, and mitigate DDoS attacks.

4. Tracking Technologies and Cookies

• We do not use advertising profiling cookies, third-party trackers, or commercial surveillance tools (such as Google Analytics or social network pixels).
• We only employ first-party technical cookies strictly necessary to maintain authenticated login sessions and enforce anti-CSRF security tokens, pursuant to Article 122 of Legislative Decree No. 196/2003 and Article 5(3) of Directive 2002/58/EC. Please consult our Cookie Policy.

5. Data Retention Periods

• Account Data & Study Content: Retained for the active duration of your account. Upon account deletion requested by the user, personal credentials, private quiz decks, and FSRS parameters are permanently and irreversibly purged from production databases within 48 hours.
• Technical Security Logs: Server logs containing IP addresses and security hashes are stored for a maximum period of 90 days (rolling window) for network and information security purposes, after which they are automatically overwritten or deleted.

6. Security and Protective Safeguards (Art. 32 GDPR)

Pursuant to Article 32 of the GDPR, we apply rigorous technical and organizational measures to ensure a level of security appropriate to the risk:

• End-to-end encrypted web connections via HTTPS with TLS 1.3 standards.
• One-way cryptographic hashing for secure password storage.
• Web application firewalls, dynamic rate limiting against brute-force attacks, and logical database isolation.

7. Your Statutory Rights (Arts. 15–22 GDPR) and Lodging a Complaint (Art. 77 GDPR)

Under Articles 15–22 of Regulation (EU) 2016/679 (GDPR), you have the right to: 1. Access (Art. 15 GDPR): Obtain confirmation as to whether personal data concerning you is being processed, and access a copy thereof. 2. Rectification (Art. 16 GDPR): Obtain the rectification of inaccurate personal data or completion of incomplete data without undue delay. 3. Erasure / Right to be Forgotten (Art. 17 GDPR): Request the permanent deletion of your account and all associated data. 4. Restriction of Processing (Art. 18 GDPR): Request the temporary restriction of processing under statutory circumstances provided by law. 5. Data Portability (Art. 20 GDPR): Download and export all your study questions, answers, and learning history in an open, structured, and machine-readable format. 6. Objection (Art. 21 GDPR): Object at any time, on grounds relating to your particular situation, to processing based on legitimate interests.

You can exercise the vast majority of these rights directly and autonomously through your account profile settings.

Lodging a Complaint with a Supervisory Authority (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, pursuant to Article 77 of the GDPR you have the right to lodge a complaint with a competent supervisory authority, particularly: Garante per la Protezione dei Dati Personali (Italy) Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it (or the competent Data Protection Authority in your respective EU Member State).

Official Controller Contacts

For formal requests regarding your privacy rights or regulatory inquiries:

Data Controller: Alessandro Gibello Official Contact: [email protected] User Support: [email protected]