Privacy Policy

1. Data controller

The data controller for your personal data is IPGS ENERGY SRL, with registered office at Via Ugo Ojetti 7, 20151 Milan (Italy), certified email (PEC) ipgsenergy@pec.it

For any request regarding the processing of your data you can write to privacy@lernis.app or to the PEC address above.

2. What data we collect

We only collect data strictly needed to operate the Service and, for personalised advertising, only with your prior consent:

• Email — used to authenticate your account
• Name — optional, chosen by you during onboarding
• Session data — tasks, notes, statistics and diary saved in your account
• Preferences — theme, language, sounds, pomodoro durations, rituals
• Locally stored data — if you use the timer in guest mode (without an account), tasks and preferences stay in your browser's localStorage and are not sent to our servers
• Minimal technical data — app version, operating system and anonymous crash logs
• Advertising data — only with your prior consent: device identifiers, advertising cookies and ad interactions, processed by our partners (e.g. Google) to show you personalised ads and measure their effectiveness

3. What we do NOT do

We want to be explicit about what we never do:

• We do not sell, rent or trade your personal data. Ever
• We do not collect your precise geographic location
• We do not access your contacts, calendars or photos
• We do not read your conversations or messages outside the app
• We do not collect biometric data
• Without your consent, we do not activate advertising cookies or identifiers, nor any profiling for marketing purposes

4. How we use your data

We use the information we collect exclusively to:

• Allow access to your account and sync data across devices
• Save your preferences and customisations
• Diagnose and fix technical issues
• Improve the app based on aggregate, anonymous metrics
• Show you advertising to support the free Service — personalised only if you have given consent, otherwise contextual and not based on profiling
• Send you, only with your consent, relevant service communications

5. Legal basis for processing

We process personal data on the following legal bases, under EU Regulation 2016/679 (GDPR):

• Performance of contract — to provide the Service (art. 6.1.b GDPR)
• Consent — for personalised advertising and related profiling, for analytics cookies and for optional communications (art. 6.1.a GDPR)
• Legitimate interest — for service security, abuse prevention and contextual, non-personalised advertising (art. 6.1.f GDPR)
• Legal obligation — to comply with regulatory requirements (art. 6.1.c GDPR)

6. Advertising and profiling

Lernis is free and supported by advertising. An optional contribution is available to remove it.

By default, and without your consent, we show you only contextual, non-personalised advertising that is not based on profiling your behaviour.

If you give consent through the cookie banner, our advertising partners (e.g. Google) may use cookies and identifiers to show you personalised ads and measure their effectiveness. You can refuse or withdraw consent at any time from the "Cookie" link at the bottom of every page, without losing access to the Service.

7. Sharing with third parties

We do not sell, rent or trade your personal data. Ever.

We rely only on the following providers, which process data on our behalf or as independent controllers, all bound to comply with the GDPR:

• Apple Inc. and Google LLC — for authentication via "Sign in with Apple" and "Sign in with Google"
• Supabase — to securely store your account data on servers within the European Union
• Vercel Inc. — for hosting and delivery of the website and web application
• Google (Analytics and advertising network) — only with your prior consent, for aggregate statistics and personalised advertising
• Technical analytics providers — exclusively for aggregate, anonymous crash reports

8. Data retention

We retain your data only for as long as needed for the purposes for which it was collected.

Your account data is retained while your account is active. When you delete your account, all data is permanently deleted within 30 days, except for data we are legally required to retain (e.g. for accounting or security purposes).

9. Security

We adopt appropriate technical and organisational measures to protect your personal data from unauthorised access, alteration or loss:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Data access restricted to authorised personnel only
• Periodic backups and disaster-recovery procedures
• Regular security audits of code and infrastructure
• Prompt notification to the supervisory authority and to users in case of significant data breach

10. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — know whether we process your data and obtain a copy
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability — receive your data in structured, readable format
• Right to object to processing, including profiling for marketing purposes
• Right to withdraw consent at any time, without affecting the lawfulness of prior processing
• Right to lodge a complaint with a supervisory authority (in Italy: Garante per la Protezione dei Dati Personali — www.garanteprivacy.it)

11. Exercising your rights

To exercise the rights listed above you can:

• Use the profile-management features in the App
• Manage cookie consent from the "Cookie" link at the bottom of every page of the website
• Write to privacy@lernis.app, attaching a copy of an ID document so we can verify your identity

12. Cookies and similar technologies

This website and the Lernis web application use cookies and similar technologies (such as the browser's localStorage). The timer runs directly in the browser: the App is no longer exclusively native.

We always use the technical cookies needed for operation. Analytics and advertising cookies are activated only after your consent, which you can give, refuse or withdraw at any time from the banner reachable via the "Cookie preferences" link at the bottom of every page. The main technologies used are listed below; the full, up-to-date detail is in our dedicated Cookie Policy (lernis.app/cookies):

• lernis-consent (necessary) — stores your cookie choices so we don't ask again on every visit — localStorage, until you clear it
• Supabase session cookies (necessary) — keep you securely signed in to your account — session duration
• Guest-mode local data (necessary) — stores tasks and preferences on your device when you use the timer without an account — localStorage, until you clear it
• Google Analytics (analytics, with consent) — aggregate, anonymous measurement of site usage — up to 24 months
• Google and advertising partners (marketing, with consent) — personalised advertising and campaign measurement — per the partner's policies

13. International transfers

Your account data is stored on servers located within the European Union.

Some providers (e.g. Google) may process data outside the EU. In that case, transfers happen only to countries that guarantee adequate protection levels, or via Standard Contractual Clauses approved by the European Commission.

14. Children

Lernis is not intended for children under 14. In line with Italian law (art. 8 GDPR and art. 2-quinquies of Legislative Decree 196/2003), children under 14 cannot validly give consent or create an account without the consent of a parent or guardian.

We do not knowingly collect data from children under 14. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@lernis.app and we will delete it.

15. Changes to this policy

We may update this privacy policy from time to time, for example to reflect regulatory changes or changes in our processing practices.

Significant changes will be communicated by email or in-app at least 30 days in advance. Before introducing new categories of cookies or new purposes that require consent, we will ask you to provide it again. The last-updated date is shown at the top of the document.

16. Contact

For any question about privacy, to exercise your rights or to report issues, write to privacy@lernis.app or to the PEC address ipgsenergy@pec.it

We will reply within 30 days of receiving the request, as required by GDPR.