Privacy Policy
Last updated: 19 August 2026
1. Scope of this Notice
This Privacy Notice describes how personal information is collected, used, disclosed and retained in connection with the website yuujou.it (the “Site”) and the services made available through it. It is provided pursuant to applicable data protection laws, including Regulation (EU) 2016/679 (the “GDPR”) and the comprehensive privacy statutes in force in a number of United States jurisdictions.
This Notice applies solely to the Site and does not extend to any third-party website that may be reached through links appearing on it.
2. Controller and Contact
The controller of the processing described herein is Alain Labricciosa Gallese, an individual domiciled in Italy, who may be contacted at alain@yuujou.it.
No Data Protection Officer has been appointed, the conditions set out in Article 37(1) GDPR not being met. Enquiries addressed to the contact above reach the responsible person directly.
3. Categories of Personal Information Collected
3.1 Information provided by the user
Upon registration: username, email address, password (stored as a cryptographic hash and not intelligible to any person, including the controller), date of birth, sex and country of residence.
Where the user elects to provide them, the optional profile fields: photograph, city, languages spoken and studied, interests and introductory text.
Content published by the user: posts, comments, images, videos, private messages, events and articles.
Where the user contacts the controller: the sender’s address and the content of the communication.
3.2 Information collected automatically
The systems operating the Site record, in the ordinary course of their operation, information whose transmission is inherent in the use of Internet communication protocols: IP address, date and time of the request, resource requested and browser characteristics. Such information is used solely to operate the Site and to ensure its security.
Information conveyed by cookies is described in Article 13 below.
3.3 Information not collected
No biometric data, and no special categories of data within the meaning of Article 9 GDPR, are processed. No profiling for advertising purposes is carried out.
4. No Sale, Sharing or Targeted Advertising
Personal information is not sold and not shared, as those terms are defined under the California Consumer Privacy Act and comparable statutes of other United States jurisdictions. No cross-context behavioural advertising is conducted, no advertising is displayed on the Site, and no advertising cookies are set.
Accordingly, there exists no sale, sharing or targeted advertising from which to opt out.
5. Purposes of Processing and Legal Bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creation and administration of the account; provision of the service requested | Performance of a contract — Art. 6(1)(b) |
| Publication of user content and its display to other members according to the visibility settings selected | Performance of a contract — Art. 6(1)(b) |
| Transmission of service communications: address confirmation, credential recovery, notifications | Performance of a contract — Art. 6(1)(b) |
| Prevention of abuse, unsolicited messaging and unauthorised access; diagnosis of malfunctions | Legitimate interests in the security and continuity of the service — Art. 6(1)(f) |
| Measurement of Site traffic | Consent, withdrawable at any time — Art. 6(1)(a) |
| Retention of evidence of acceptance of the contractual and informational documents | Compliance with a legal obligation, in relation to Art. 7(1) — Art. 6(1)(c) |
| Response to lawful requests of competent authorities | Compliance with a legal obligation — Art. 6(1)(c) |
With respect to processing founded on legitimate interests, the controller has conducted the balancing assessment contemplated by Recital 47 GDPR and has determined that the interest in protecting the infrastructure is not overridden by the interests or fundamental rights of data subjects, having regard to the limited scope of the information processed, the brevity of its retention and the absence of any further use. The right to object under Article 11 below is unaffected.
6. Mandatory and Optional Information
The information identified as necessary for registration — username, a valid email address, a password and date of birth — must be provided in order for an account to be created; the sole consequence of withholding it is that registration cannot proceed.
All other information is optional and its omission has no effect on the use of the service.
7. Retention Periods
| Information | Period |
|---|---|
| Account and published content | For the duration of the relationship; upon deletion of the account, the data and associated content are erased |
| Server logs | Fourteen days, after which they are overwritten automatically |
| Correspondence addressed to the controller | For such period as is necessary to respond and to record that the matter was addressed |
| Evidence of acceptance of documents | For the duration of the relationship and for such period as is necessary to establish or defend a legal claim |
| Analytics information | Cookies expire after no more than thirteen months; aggregate data remain in the analytics console |
| Unconfirmed registrations | Seven days, after which the unconfirmed profile is deleted |
8. Recipients
Personal information is not disclosed to the public, save for such content as the user elects to make visible to other members through the settings of their profile.
Information is disclosed to the providers that furnish the services necessary to operate the Site, engaged as processors under Article 28 GDPR where applicable:
| Recipient | Service | Scope |
|---|---|---|
| DigitalOcean | Infrastructure hosting the Site (Frankfurt, Germany) | Continuous |
| Google Ireland Ltd. / Google LLC | Measurement of Site traffic | Subject to consent only |
| Brevo (Sendinblue SAS, France) | Transmission of service communications | Upon dispatch. The provider records opens and link clicks |
| Aziende Italia S.r.l. (and its sub-processors) | Mailbox of the controller | Where the user writes to the controller |
| Agora Lab, Inc. (United States of America) | Real-time audio and video communication | For the duration of participation only |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) | Voluntary contributions. Acts as an independent controller, not as a processor | Upon opening the support page, where the payment button is loaded, and in order to carry out the contribution |
| YouTube | Preview images of embedded videos | Playback occurs solely upon the user’s action; prior thereto only the preview image is requested |
9. International Transfers
The Site and its database reside on infrastructure located in Germany; the data accordingly remain within the European Union.
Certain recipients identified in Article 8 are established in the United States and may process data outside the European Union. Such transfers are effected under the safeguards provided for in Chapter V GDPR, namely the standard contractual clauses adopted by the European Commission and, for participating providers, the EU-U.S. Data Privacy Framework. A copy of the safeguards adopted may be requested at the contact given in Article 2.
10. No Automated Decision-Making
No processing is carried out which produces legal effects concerning the user or similarly significantly affects them by automated means, including profiling, within the meaning of Article 22 GDPR. No system assigns scores or categories to users, nor selects content on the basis of their conduct.
11. Rights of Users
11.1 Rights afforded to all users, irrespective of residence
Users may request: confirmation of the information held concerning them and a copy thereof; its correction; its erasure together with the account; its export in a portable format; the restriction of its use; and the withdrawal of consent to analytics, by means of the «Cookie choices» link appearing in the footer of every page.
Requests are to be addressed to alain@yuujou.it. A response is provided without undue delay and in any event within thirty days. No user is subjected to discriminatory treatment for having exercised these rights, whether by denial of service or reduction of features, and no fee is charged.
11.2 Users resident in the United States
Comprehensive privacy statutes are in force in approximately twenty states, including California, Colorado, Connecticut, Texas and Virginia. These confer rights to know, to delete, to correct, to obtain a portable copy, and to opt out of the sale or sharing of personal information and of targeted advertising.
The rights first enumerated are afforded to every user, as set out in Article 11.1. The right to opt out has no object here, no sale, sharing or targeted advertising being conducted (Article 4).
Authorised agents. A request may be submitted through an authorised agent; verification of the agent’s authority may be required.
Browser signals. Where the browser transmits the Global Privacy Control signal, it is treated as a refusal of analytics cookies and the consent request is not displayed. Twelve states require that this signal be honoured; it is honoured in respect of every visitor, irrespective of residence.
11.3 Users resident in the European Union or the EEA
The rights set out above arise under the GDPR, together with the right to restrict processing and the right to object at any time, on grounds relating to the user’s particular situation, to processing founded on legitimate interests (Article 21 GDPR). Where objection is made, processing ceases unless compelling legitimate grounds are demonstrated which override the interests, rights and freedoms of the user.
Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal (Article 7(3) GDPR).
A complaint may be lodged with the competent supervisory authority; for Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).
11.4 Users resident in other jurisdictions
In the United Kingdom the corresponding rights arise under the UK GDPR, the competent authority being the Information Commissioner’s Office. In Canada, PIPEDA confers rights of access and correction and a right of complaint to the Office of the Privacy Commissioner. In Australia, the Privacy Act confers rights of access and correction and a right of complaint to the Office of the Australian Information Commissioner.
12. Security
Technical and organisational measures appropriate under Article 32 GDPR are maintained: transmission over encrypted protocol (HTTPS), storage of credentials as cryptographic hashes, restricted access to the infrastructure, daily backup of the database and maintenance of system updates.
No information system may be regarded as invulnerable. In the event of a personal data breach likely to result in a risk to the rights and freedoms of users, the controller shall proceed in accordance with Articles 33 and 34 GDPR and with applicable state breach-notification statutes.
13. Cookies
Cookies are text strings deposited on the user’s device by the Site. Strictly necessary cookies require no consent; all others are set solely upon consent.
13.1 Strictly necessary cookies
| Name | Function | Duration |
|---|---|---|
| sid | Maintains the user’s session during navigation | Until the browser is closed |
| bgEdgeMainPage | Retains the background image of the entry page | Until the browser is closed |
| cookiesAccepted | Retains the choice expressed as to cookies | Twelve months where accepted; six where refused |
| _set_language | Retains the language selected | Twelve months |
13.2 Analytics cookies
Set solely upon express consent.
| Name | Provider | Function | Duration |
|---|---|---|---|
| _ga | Google Analytics | Distinguishes one visitor from another | Thirteen months |
| _ga_DFD8GDMT7C | Google Analytics | Retains the state of the visit | Thirteen months |
The analytics service is configured so that the IP address is truncated and the data are not used for advertising or profiling purposes.
13.3 Withdrawal and refusal signals
Consent may be withdrawn at any time by means of the «Cookie choices» link in the footer of every page, or by deleting cookies through the browser settings. The Global Privacy Control signal is honoured as described in Article 11.2.
14. Minimum Age
The service is restricted to persons who have attained eighteen years of age. No information is knowingly collected from children. Where the controller determines that an account pertains to a minor, the account is closed and the associated data erased.
15. Amendments
This Notice may be amended. Amendments are published on this page together with the date of last revision; where they affect the manner of processing, notice is given on the Site.
