Introduction

Your privacy is important to us. This Privacy Policy describes how PopcornCrew collects, uses and protects your personal information when you use our platform, through the website or apps.

Data Controller

The data controller is Davide Bortoloni, with registered office at via Belfiore, 20, 10042, Nichelino (TO), P.IVA 13496410963.

Website: davidebortoloni.com

Data We Collect

Data Provided Directly

First and last name
Email address
Username
Password (encrypted)
Profile photo and cover image, if you choose to upload them
Country, language and streaming services you declare that you use
Notification preferences
Lists of films and series, titles and episodes marked as watched, ratings, reviews, comments and photos attached to comments
The searches you make on the platform and the title you open from the results
Reason for account deletion, if you choose to provide it (optional)

Data Collected Automatically

IP address: used for technical and security purposes (abuse detection, session management). For statistical purposes, the IP is never stored in clear text: it is converted into a non-reversible code (hash) using a secret server key.
Country of origin: derived from the IP address at the time of the visit (only the two-letter country code, no precise geolocation).
Device and browser information: user agent, device type (mobile, tablet, desktop), referrer of the previous page.
Browsing data: URLs of pages visited, internal route name, session identifier (hashed), date and time of the visit, server response time.
Registration source: when you register, we record where you came from on your first visit (the referring website, any campaign parameters in the link you opened, for example those of one of our ads, the first page viewed and whether you entered from the app) and, if you choose to answer, how you heard about us.
Push notifications: if you use the app and enable notifications, a device identifier required to deliver them.
Essential technical cookies (see dedicated section).

How We Use Your Data

Provide and improve our services
Personalize your experience, including recommendations on what to watch
Send notifications and important communications
Moderate content posted by users and translate it into the language of those who read it
Analyze use of the platform in aggregated and pseudonymous form
Prevent fraud and ensure security
Comply with legal obligations
Understand why people leave the platform, in order to improve the service
Measure the effectiveness of our advertisements, only with your consent

Legal Basis for Processing

The processing of your personal data is based on the following legal bases provided for by the General Data Protection Regulation (GDPR):

Performance of the Contract

Processing of data for account management and the provision and improvement of our services is necessary for the performance of the service contract that you accepted by using the platform.

Consent

Processing for sending promotional and marketing communications, for push notifications and for measuring our advertisements is based on your consent, which may be withdrawn at any time from your account settings, via the «Manage cookies» link or from your device settings.

Legitimate Interest

Processing to personalize your experience, analyze use of the platform in aggregated and pseudonymous form (through our internal analytics tools), moderate posted content, prevent fraud and ensure security, and understand why people decide to leave the platform is based on our legitimate interest in improving the services and protecting the platform and its users. Analysis of use takes place exclusively using our own tools, without profiling cookies and without involving third-party companies.

Legal Obligation

Processing to comply with legal, tax or administrative obligations is necessary to comply with obligations imposed by law.

Sharing of Data

We do not sell your personal data. Your data is processed or may be shared only in the following circumstances:

Technical Service Providers

Your data is processed by technical service providers necessary for the operation of the platform, who act as processors on our behalf and process the data only to provide us with their service.

The providers we use include:

netcup GmbH (Germany): server hosting the platform, database and title search engine. The server is located in the European Union (Vienna, Austria).
Cloudflare: network that protects the website from attacks and speeds up its loading. All traffic to the platform, including your IP address, passes through its network. We also store database backup copies on Cloudflare R2, in an archive located in the European Union.
Hostinger: service for domain and email management. Data is processed within the EU.
OpenAI: analyzes the texts you post (reviews, comments, usernames) for automatic moderation and to flag spoilers, and translates them into the language of those who read them; for this purpose it receives only the text, not your account data. Only if you accept advertising measurement cookies does it also receive the data described in the cookies section, to tell us whether you registered after seeing or clicking one of our ads on ChatGPT.
Google Firebase Cloud Messaging: delivers push notifications in the app, if you have enabled them.

Third-Party Services You Use Through the Platform

Sign in with Google or Apple: if you choose to sign in with your Google or Apple account, we receive your name and email address from them.
GIPHY: when you search for or view a GIF in comments, your device loads it directly from GIPHY's servers, which receive your IP address.
Telegram: if you link your account to our bot or group, Telegram provides us with your Telegram identifier.

APIs and External Content Services

We use the The Movie Database (TMDB) API to provide information about films and multimedia content. Use of the TMDB API is in accordance with its terms of service and does not involve sharing users' personal data with TMDB. Film data is retrieved only when necessary to provide the service.

To derive the country of origin from the IP address, we use a local database provided by MaxMind (GeoLite2): the lookup takes place entirely on our servers; the IP address is never transmitted to MaxMind.

Transfers Outside the European Union

Some of the providers listed above (Cloudflare, OpenAI, Google, GIPHY) are based in the United States or may process data outside the European Union. In these cases, the transfer takes place on the basis of the safeguards provided for by the GDPR: the EU-US Data Privacy Framework adequacy decision for companies that participate in it and, in other cases, the standard contractual clauses approved by the European Commission.

Other Circumstances

When required by law or to protect our rights
In the event of a merger, acquisition or sale of assets
With your explicit consent

Data Security

We implement technical and organisational security measures to protect your personal data, including connection encryption, access controls, firewalls and continuous monitoring. Passwords are always encrypted using secure algorithms. IP addresses used for statistical purposes are hashed with a secret key so that they cannot be traced back to the original user. Photos you attach to comments are re-encoded and stripped of metadata (for example, the location where they were taken).

Retention Period

We retain your personal data only for as long as necessary for the purposes for which it was collected, in accordance with the principles of data minimisation and storage limitation set out in the GDPR:

Account data: Username, first name, last name, password, lists and content you have published are retained until your account is deleted, except as indicated in the following point. You can request deletion at any time from your account settings.
Account deletion: When you delete your account, it is first deactivated for 30 days: it disappears from all public areas of the platform, but your data remains intact and, if you return within that period, you will find everything as it was. After 30 days, the account and its content are permanently deleted. From the time of the request, we retain for 90 days the essential identifying data (name, username, email address), the date and any reason you chose to provide, for security, abuse prevention and service improvement purposes. After this period, the identifying data is automatically deleted, while the stated reason, any comment (which we invite you not to fill in with personal data) and statistical information that can no longer be linked to you remain.
Email address: Retained for up to 2 years after the last activity on the platform or until the account is deleted, whichever occurs first.
Notification preferences: Retained until the account is deleted or the preferences are changed.
Detailed visit data (analytics): Raw data relating to individual visits (URL, route, user agent, hashed IP, country, device, timestamp) are retained for a maximum of 90 days from collection, after which they are automatically deleted.
Searches: The search text and the title opened from the results are retained for 90 days to improve search quality, and then automatically deleted.
Registration source: Remains associated with your account until you delete it.
Anonymous aggregated data: Statistical data aggregated by day and by route (for example: total number of visits to a page on a given day) contain no personal identifier and may be retained indefinitely for historical analysis purposes.
System and security logs: Technical logs necessary for diagnostics, security and abuse prevention are retained for a maximum period of 12 months, unless legal obligations require longer retention. Reports of technical errors encountered while using the platform are deleted 90 days after the last occurrence.
Backup copies: Database backup copies are retained for 7 days and then overwritten. Data deleted from the platform may therefore remain in these copies for up to 7 days.
Cookies: The cookie that keeps you logged in to your account lasts for up to 12 months or until you log out of the account; other persistent cookies may remain for up to 12 months or until manually deleted.
Data for legal obligations: Data necessary to comply with legal, tax or administrative obligations are retained for the period required by the applicable legislation (generally up to 10 years for tax obligations).

At the end of the retention period, the data are securely and permanently deleted, unless retention is still necessary to comply with legal obligations or for the establishment or defence of legal claims.

Cookies and Similar Technologies

We use essential technical cookies, which are necessary for the platform to function, and, only with your consent, OpenAI advertising measurement cookies. We do not use profiling cookies. You can give or withdraw your consent at any time via the “Manage cookies” link at the bottom of the page or in the privacy settings.

Essential technical cookies (no consent required)

Session cookies: recognise you while you browse and keep you logged in to your account.
Security cookies: protect forms from forged requests; Cloudflare may set its own cookies to distinguish visitors from automated attacks.
Preference cookies: store your settings (e.g. dark/light theme).

Advertising measurement cookies (only with your consent)

When you visit PopcornCrew without being registered, and until you complete registration, we use the OpenAI measurement pixel to find out whether one of our ads on ChatGPT led to a registration. We do not load it for people who already use the platform.

__oppref: remembers the ad code from which you arrived. Lasts 30 days.
__obref: a random browser identifier that contains no data about you. Lasts 12 months.

With your consent, when you complete registration the pixel sends this event to OpenAI together with the two identifiers. The OpenAI script may also read the email address, name and country you enter from the page forms: it transforms them in your browser into an encrypted code (SHA-256 hash), which cannot be reversed, and sends only that code, never the data in clear text. Passwords are never read. OpenAI uses this data to attribute the registration to the ad and returns only aggregated data to us.

If you refuse or withdraw your consent, the pixel sends nothing and the two cookies are deleted.

Fonts

Some of the site's fonts are loaded from Bunny Fonts (BunnyWay d.o.o., Slovenia), a European service that states that it does not use cookies and does not record visitors' IP addresses.

Usage Analytics (internal analytics, without cookies)

To understand which pages are visited most, we record some visit information on our servers (URL, internal route, user agent, device type, country derived from the IP address and a hashed, irreversible version of the IP address). This tracking takes place entirely on our servers, without profiling cookies and without third-party tools, on the basis of legitimate interest: consent is not required for this specific analysis. On the same basis and using the same internal tools, when you register we record where you came from on your first visit: this helps us understand which channels make us known, and we do not share it with anyone.

Your Rights (GDPR)

You have the right to:

Access: Request a copy of your personal data
Rectification: Correct inaccurate or incomplete data
Erasure: Request the deletion of your data
Restriction: Restrict the processing of your data
Portability: Receive your data in a structured format
Objection: Object to the processing of your data, including internal statistical tracking
Complaint: Lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it)

Contact

To exercise your rights or for any questions about privacy, you can contact us via:

Email: [email protected]

Changes to the Privacy Policy

We reserve the right to amend this Privacy Policy. Significant changes will be communicated by email or notification in the application. We invite you to consult this page periodically to stay informed.