Privacy Policy

We process personal data of users for the following purposes:

• Authentication and user session

  We use JSON Web Token (JWT) and refresh tokens to securely manage access to protected services. The legal basis is the execution of a contract (Art. 6(1)(b) GDPR) or the legitimate interest of the Controller to ensure account security (Art. 6(1)(f) GDPR).

• Website analytics

  With Google Analytics we collect anonymous information about website traffic and user behavior (pages visited, time spent, geographic origin). The legal basis is explicit consent (Art. 6(1)(a) GDPR), given via the cookie banner.

• Authentication data: email, username and hashed password (we do not store plain‐text passwords); JWT and refresh tokens.
• Navigation data (Google Analytics): anonymized IP address, entry/exit page, session duration, referral parameters, operating system and browser.

Data are processed using IT and telematic tools; we implement appropriate technical and organizational measures to ensure security, confidentiality, and integrity:

• JWTs have a limited lifespan (e.g. 15 minutes) and are renewed via a refresh token valid for a longer period (e.g. 7 days), both signed with a secret key.
• Authentication logs are retained for up to 6 months for security monitoring and analysis.
• Google Analytics data are stored according to Google’s settings (typically 14 months) and anonymized (IP masked).

• Technical cookies

  Necessary for authentication (e.g. session persistence).

• Third-party cookies

  Google Analytics cookies used for statistical purposes; no personally identifiable information is collected without consent.

Under Articles 15-22 GDPR, you may at any time:

• Obtain confirmation of the existence of your data and access them.
• Request correction, restriction of processing, or deletion (“right to be forgotten”).
• Object to processing for legitimate reasons or withdraw consent.
• Request data portability (e.g. export of profile and settings).

Requests should be sent to privacy@psmjourney.com. We will respond within 30 days.

Data may be shared with:

• ICT service providers (hosting, server maintenance).
• Google Ireland Ltd. for Google Analytics, under a data processing agreement.

We do not disclose data to third parties for marketing purposes without prior consent.

Google Analytics data may be transferred to the USA based on the EU Standard Contractual Clauses approved by the European Commission.

We implement:

• Secure HTTPS/TLS connections.
• JWT encryption and signature.
• Access controls and permissions.
• System log monitoring.

We may update this policy at any time. Please review it periodically for changes.

Data Controller

Vincenzo Raffa - privacy@psmjourney.com