Privacy policy

1. Data controller Iconia Photo & Travel, with registered office at Via Esempio 1, Milano. Contact: info@geniale.me. 2. What data we process - Account: email, password (stored only as a non-reversible hash), sign-up date, age-check result (yes/no and date), never your documents. - Security: access logs with IP address and browser. The IP is kept in clear text for at most 30 days, then anonymised; logs are deleted after 90 days. - Purchases and subscriptions: amount, date, tier or content purchased, transaction reference provided by the payment processor. No card data: payments take place on the processor's pages. - Chat: the messages you exchange with the site owner. - Visits: cookieless measurement. To count visitors a daily, non-reversible code is derived from IP address and browser; the IP is not stored and the code changes every day. Visit data is kept for 12 months. - Email: service notifications (address verification, receipts, new content, security alerts). 3. Why and on what legal basis - To provide the service: sign-up, subscriptions, purchases, chat (performance of a contract, Art. 6(1)(b) GDPR). - To comply with the law: age verification of users, accounting and tax obligations (Art. 6(1)(c)). - For site security, prevention of abuse and fraud, and aggregate visit statistics (legitimate interest, Art. 6(1)(f)). 4. Cookies The site uses technical cookies only: the session cookie that keeps you signed in and the one that remembers your language. No profiling cookies, no advertising tracking, no third-party scripts. That is why no consent is requested. 5. Who receives the data Data is neither sold nor transferred. It is processed on the owner's behalf, as data processors, only by the technical providers required for the service: server hosting, media storage, email delivery, payment processor, age-verification provider. All are established or host data in the European Union. Data may be disclosed to authorities where required by law. 6. Retention Account and chat: as long as the account exists, then deleted within 30 days of the request. Access logs: 90 days. Purchase data: 10 years, as required by tax law. Visits: 12 months. 7. Your rights You may request access, rectification, erasure, restriction, portability of your data and object to processing based on legitimate interest by writing to info@geniale.me. We reply within 30 days. You may also lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it). 8. Security Always-encrypted connection (HTTPS), passwords stored only as hashes, two-step verification for the owner's access, media access authorised by the server through signed, expiring links. 9. Minors The site is restricted to adults. We do not knowingly collect data from minors: if we become aware of it, the account is closed and the data deleted. 10. Changes This notice may be updated; the version published here, with the date at the top, prevails.