The controller of personal data is Connexa Studios, based in Italy. For any privacy-related request you can write to privacy@telos.connexastudios.com.

We collect the following categories of data:

• Registration data: first name, last name, email address, password (hashed with bcrypt)
• Social sign-in data: if you use Google OAuth, we receive the name, email and profile photo provided by Google
• Usage data: pages visited, features used, session timestamps
• Technical data: IP address, browser type, operating system (for security purposes only)

We don't collect payment data directly — any transactions are handled by PCI-DSS certified providers.

Your data is used to:

• Create and manage your account on the platform
• Provide you with the Service's features (dashboard, telemetry, calendar)
• Send you service communications (password reset, important updates)
• Improve the platform through aggregated, anonymized analysis
• Prevent fraud and ensure the security of the Service

We don't use your data for third-party advertising.

The processing of your data is based on:

• Performance of a contract (Art. 6.1.b GDPR) — necessary to provide you with the Service
• Consent (Art. 6.1.a GDPR) — for optional communications such as the newsletter
• Legitimate interest (Art. 6.1.f GDPR) — for security and fraud prevention

We use the following types of cookies:

• Session cookies: necessary to maintain your sign-in — no consent required
• Preference cookies: save your display settings
• Analytics cookies: anonymous aggregated data to understand how the platform is used

We don't use third-party advertising-profiling cookies.

Your data is retained for the entire duration of your account and for a maximum period of 12 months after deletion, except where legal obligations require longer retention.

Security and access logs are deleted after 90 days.

We don't sell your data. We may share it exclusively with:

• Hosting provider (Hostinger) — for the technical infrastructure
• Google LLC — if you use Google login (subject to Google's Privacy Policy)
• Competent authorities — only if required by law

As a user you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — the "right to be forgotten" — remove your account and all associated data
• Portability — receive your data in a readable format (JSON/CSV)
• Objection — object to processing based on legitimate interest
• Withdrawal of consent — at any time for consent-based processing

To exercise these rights write to privacy@telos.connexastudios.com. We will respond within 30 days.

We adopt technical and organizational measures to protect your data:

• Encrypted connections via HTTPS/TLS
• Passwords hashed with bcrypt (never in plain text)
• Database access limited to authorized personnel
• Regular backups with encryption at rest

We may update this policy to reflect changes to the Service or to regulations. In case of significant changes we will send you an email notification at least 15 days before they take effect.