Introduction

Your privacy is important to us. This Privacy Policy describes how PopcornCrew collects, uses, and protects your personal information when you use our platform.

Data Controller

The data controller is Davide Bortoloni, located at via Belfiore, 20, 10042, Nichelino (TO), VAT 13496410963.

Website: davidebortoloni.com

Data We Collect

Data Provided Directly

First and last name
Email address
Username
Password (encrypted)
Notification preferences
Created movie lists
Reason for account deletion, if you choose to provide it (optional)

Data Collected Automatically

IP Address: used for technical and security purposes (abuse detection, session management). For statistical purposes, the IP is never stored in clear text: it is converted into a non-reversible code (hash) using a server secret key.
Country of origin: derived from the IP address at the time of the visit (only the two-letter country code, no precise geolocation).
Device and browser information: user agent, device type (mobile, tablet, desktop), referrer of the previous page.
Navigation data: URLs of visited pages, internal route name, session identifier (hashed), date and time of visit, server response time.
Essential technical cookies and, with your consent, advertising measurement cookies (see dedicated section).

How We Use Your Data

Provide and improve our services
Personalize your experience
Send important notifications and communications
Analyze platform usage in an aggregated and pseudonymous form
Prevent fraud and ensure security
Comply with legal obligations
Understand why people leave the platform, to improve the service
Measure the effectiveness of our advertising campaigns (only with your consent)

Legal Basis for Processing

The processing of your personal data is based on the following legal bases provided by the General Data Protection Regulation (GDPR):

Contract Execution

The processing of data for account management, provision, and improvement of our services is necessary for the execution of the service contract you accepted by using the platform.

Consent

Processing for sending promotional and marketing communications and for the use of third-party advertising measurement cookies (Google Ads) is based on your explicit consent, revocable at any time (for communications from account settings; for cookies via "Manage cookies").

Legitimate Interest

Processing to personalize your experience, analyze platform usage in an aggregated and pseudonymous form (through our internal analytics tools), prevent fraud and ensure security, and understand why people decide to leave the platform is based on our legitimate interest to improve services and protect the platform and its users. This analysis is conducted exclusively with our own tools, without profiling cookies and without involving third-party companies. The measurement of advertising campaign effectiveness through Google occurs only with your consent (see the "Cookies and Similar Technologies" section).

Legal Obligation

Processing to comply with legal, fiscal, or administrative obligations is necessary to fulfill obligations provided by law.

Data Sharing

We do not sell your personal data. Your data is processed or may be shared only in the following circumstances:

Technical Service Providers

Your data is processed by technical service providers necessary for the operation of the platform (hosting and email management). We do not actively share your data with these providers; they process the data only because they provide the necessary infrastructure services. All providers used are located within the European Union.

The providers we use include:

Laravel Cloud (AWS): Hosting service for the platform. Servers are located in the European Union (Frankfurt, Germany).
Hostinger: Service for domain and email management. Data is processed within the EU.

APIs and External Content Services

We use the API of The Movie Database (TMDB) to provide information on movies and multimedia content. The use of the TMDB API is in accordance with their terms of service and does not involve sharing users' personal data with TMDB. Movie data is retrieved only when necessary to provide the service.

To derive the country of origin from the IP address, we use a local database provided by MaxMind (GeoLite2): the lookup occurs entirely on our servers, the IP address is never transmitted to MaxMind.

Advertising Measurement (only with your consent)

If you consent to measurement cookies, we share with Google Ireland Limited (Google Ads) the data necessary to measure the conversions of our campaigns. Google acts as an independent controller for these purposes and may transfer data to the United States, based on the EU-US Data Privacy Framework adequacy decision. You can revoke consent at any time via "Manage cookies".

Other Circumstances

When required by law or to protect our rights
In case of merger, acquisition, or sale of assets
With your explicit consent

Data Security

We implement technical and organizational security measures to protect your personal data, including encryption, access controls, and continuous monitoring. Passwords are always encrypted using secure algorithms. IP addresses used for statistical purposes are hashed with a secret key, so they are not traceable to the original user.

Retention Period

We retain your personal data only for as long as necessary for the purposes for which they were collected, in compliance with the principles of minimization and storage limitation provided by the GDPR:

Account data: Username, first name, last name, password, and movie lists are retained until your account is deleted, except as indicated in the following point. You can request deletion at any time from your account settings.
Data related to account deletion: When you delete your account, we retain essential identifying data (name, username, email address), the date of deletion, and any reason you chose to provide for 90 days, for security, abuse prevention, and service improvement purposes. After this period, identifying data is automatically deleted, leaving only the indicated reason, any comment (which we invite you not to fill with personal data), and statistical information, no longer traceable to you.
Email address: Retained for up to 2 years after the last activity on the platform or until account deletion, if earlier.
Notification preferences: Retained until account deletion or until preferences are changed.
Detailed visit data (analytics): Raw data related to individual visits (URL, route, user agent, hashed IP, country, device, timestamp) is retained for a maximum of 90 days from collection, after which it is automatically deleted.
Anonymous aggregated data: Aggregated statistical data per day and per route (e.g., total number of visits to a page on a given day) does not contain any personal identifiers and may be retained indefinitely for historical analysis purposes.
System and security logs: Technical logs necessary for diagnostics, security, and abuse prevention are retained for a maximum period of 12 months, unless legal obligations require longer retention.
Cookies: Duration varies based on the type of cookie. Session cookies are deleted when the browser is closed, while persistent cookies may remain for up to 12 months or until manually deleted.
Data for legal obligations: Data necessary to fulfill legal, fiscal, or administrative obligations is retained for the period required by applicable law (generally up to 10 years for fiscal obligations).

At the end of the retention period, data is securely and permanently deleted, unless retention is still necessary to comply with legal obligations or for the exercise or defense of rights in legal proceedings.

Cookies and Similar Technologies

We use essential technical cookies for the operation of the platform and, only with your consent, third-party advertising measurement cookies (Google). On your first visit, we show you a banner where you can accept or reject non-essential cookies; until you consent, advertising measurement cookies are not installed. You can change your choice at any time via the "Manage cookies" link in the site footer and in your account Privacy settings.

Essential Technical Cookies (No Consent Required)

Session cookies: recognize you during navigation and maintain access to your account. Deleted when the browser is closed.
Preference cookies: store your settings (e.g., dark/light theme).
Consent cookies: store the choice made on the banner, so it is not asked again on each visit.

Advertising Measurement Cookies (Only with Your Consent)

If you consent, we use the Google Ads tag to measure the effectiveness of our campaigns (e.g., how many people, after seeing an ad, register). For this purpose, Google may install cookies on your device, including _gcl_au (and other _gcl_*), with a duration of up to about 90 days.

Purpose: measurement of advertising campaign conversions.
Legal basis: your consent (Art. 6, para. 1, letter a GDPR), revocable at any time.
Third party: Google Ireland Limited. Google may transfer data to the United States; the transfer is governed by the EU-US Data Privacy Framework adequacy decision, to which Google adheres, and by standard contractual clauses.
Technology: we adopt Google's Consent Mode, which keeps cookies disabled by default until you give consent.

If you refuse or have not yet chosen, these cookies are not installed. You can revoke consent at any time from "Manage cookies": revoking is as easy as consenting.

Usage Analysis (Internal Analytics, Without Cookies)

To understand which pages are most visited, we record some visit information on our servers (URL, internal route, user agent, device type, country derived from IP, and a hashed, non-reversible version of the IP). This tracking occurs entirely on our servers, without profiling cookies and without third-party tools, based on legitimate interest: for this specific analysis, consent is not required.

Your Rights (GDPR)

You have the right to:

Access: Request a copy of your personal data
Rectification: Correct inaccurate or incomplete data
Erasure: Request the deletion of your data
Restriction: Restrict the processing of your data
Portability: Receive your data in a structured format
Objection: Object to the processing of your data, including internal statistical tracking

Contact

To exercise your rights or for any privacy-related questions, you can contact us via:

Email: info@popcorncrew.it

Changes to the Privacy Policy

We reserve the right to modify this Privacy Policy. Significant changes will be communicated via email or notification in the application. We invite you to periodically review this page to stay informed.