Dear User, EU Regulation 2016/679 (GDPR) grants every individual the right to the protection of their personal data. We wish to inform you that the processing of your data, carried out in connection with your use of the Mnemonica platform (the “Platform”), is performed in full compliance with the principles of lawfulness, fairness, relevance, proportionality and transparency. This Notice concerns the personal data processed in relation to the User of the Platform, both through the web application and through the mobile applications for iOS and Android.
Data Controller and allocation of roles
MNEMONICA S.r.l. - Via Piediluco 7, 00199 Rome (RM), Italy - VAT IT 13568841004 - privacy@mnemonica.com
In relation to the different processing activities connected to the Platform, roles are allocated as follows:
- User registration and account data (name, surname, email/username, display name, profile picture/avatar where provided, and technical authentication data such as the public key associated with the passkey or, for sign-in with an external identity, the identifier assigned by Google or Apple): Mnemonica acts as autonomous Data Controller, to enable access to and use of the Platform, to comply with legal obligations and for the further purposes set out in this Notice.
- Personal data possibly contained in Projects and Contents uploaded and managed by the Customer on the Platform (including data relating to Users within such Projects, such as comments and materials): the Customer who created the Project is the Data Controller, while Mnemonica acts as Data Processor, appointed under Art. 28 GDPR, processing such data solely on the Customer’s instructions. The processing of the Customer’s own data as autonomous controller is described in the separate Customer Privacy Notice, available on request at privacy@mnemonica.com.
Personal data processed and source
The following User data are processed: name and surname; email address, which also serves as the login username; display name; profile picture (avatar), optional; if not provided, Mnemonica automatically generates an avatar showing the initials of the first and last name provided by the User.
Source of the data (Arts. 13-14 GDPR). Data are ordinarily provided directly by the User at registration (Art. 13). If the User registers or signs in with an external identity “Sign in with Google” or “Sign in with Apple” (OpenID Connect), Mnemonica receives from the relevant provider the name, email address and, where available, the profile picture (Art. 14); processing by Google and Apple, as independent controllers limited to the authentication they manage, is governed by their respective privacy policies (policies.google.com/privacy; apple.com/legal/privacy). With Apple’s “Hide My Email”, the address communicated to Mnemonica is an anonymous relay address (@privaterelay.appleid.com), still referable to the User.
Sign in with Google or Apple. In this case Mnemonica receives from the provider, through the openid, email and profile scopes only, the data indicated above and stores: the stable identifier assigned by the provider (subject identifier) and the provider’s name; the email address and its verification status as reported by the provider; the name; the date on which the identity was linked and the date it was last used (sign-in or re-verification), without keeping a history. These data are used to authenticate the User, to distinguish linked identities in the account settings and, at registration, to pre-fill the User’s name where not already provided. Accounts are never linked automatically on the basis of the email address: an external identity can only be linked by the User while signed in. To facilitate sign-in, Mnemonica may send the provider the email address indicated in the invitation. Mnemonica does not retain the access or refresh tokens issued by the provider. Mnemonica’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Authentication. To complete registration, email verification is required. Access is passwordless, by means of a passkey, a single-use sign-in link by email (magic link) or sign-in with an external Google or Apple identity. For passkeys, Mnemonica processes and retains only the public key associated with the User’s device: no biometric data (fingerprint, face) is transmitted to, or processed by, Mnemonica, remaining confined to the device. All authentication information is protected and transmitted via encrypted HTTPS/TLS protocol.
Technical device identifiers. In order to recognise authorised devices, maintain the session and prevent unauthorised access, Mnemonica generates and stores a technical identifier of the application installation, linked to the User’s account, together with the device keys and restore keys used for authentication. These identifiers are generated on the device, do not allow the User to be identified outside the Platform and are not disclosed to third parties, including the diagnostic and statistics tools described below.
Technical data of the mobile applications. The iOS and Android applications use Google’s Firebase services (see 4 and 5) and process:
- Crash reports and diagnostics (Crashlytics), collected to keep the application stable: a random installation identifier, device model, operating system version, device state at the time of the error and the technical error trace. No User or account identifier is collected, nor any text typed by the User, nor identifiers of Projects or Contents.
- Usage statistics (Firebase Analytics), collected only with the User’s consent, requested on first launch of the application and withdrawable at any time in Settings: a random installation identifier, device model, operating system, language, application version, approximate country and region derived from the IP address (which, according to Google’s documentation, is not logged), screens viewed and features used. Event parameters consist solely of predefined values, numbers or yes/no values. The following are not collected: text typed by the User, names, email addresses, titles of Projects, Contents or comments, the account identifier, the server address, or advertising identifiers (Advertising ID, IDFA). Usage statistics are not linked to the User’s account and are not used for advertising purposes.
- Push notifications: the device notification token, registered only after sign-in and deleted on sign-out.
- Remote configuration: installation identifier, application version, language and country, used to check the minimum supported version.
Watermark. Where the Customer enables watermarking in Screening Rooms, the User’s email address may be visibly overlaid on the content played back, to protect it against unauthorised disclosure; this processing is carried out by Mnemonica as Processor on behalf of the Customer (see 1).
The account is personal and unique and follows the User regardless of the Customers and Projects it is associated with.
Purposes, legal basis and nature of processing
| Purpose | Legal basis | Nature |
|---|---|---|
| Access to the Platform, account activation and management (including passwordless authentication: passkey, magic link, external Google/Apple identities), use of services | Art. 6.1(b) GDPR - performance of the contract/service | Necessary to use the Platform |
| Access security, recognition of authorised devices and prevention of unauthorised access (technical installation identifier, device keys and restore keys) | Art. 6.1(b) GDPR and Art. 6.1(f) GDPR - legitimate interest in the security of the service | Necessary to use the Platform |
| Push notifications relating to Project activity | Art. 6.1(b) GDPR, together with the device system permission | Optional - can be disabled in the device and application settings |
| Application stability and diagnostics (crash reports) | Art. 6.1(f) GDPR - legitimate interest in the proper functioning of the service | Not subject to consent - does not involve identification of the User |
| Usage statistics of the mobile application, to understand which features are used and improve the service | Art. 6.1(a) GDPR - consent; Art. 122 of Legislative Decree 196/2003 for storing and accessing information on the device | Optional - withdrawable at any time in the application Settings |
| Compliance with legal obligations | Art. 6.1(c) GDPR - legal obligation | Mandatory by law |
| Service communications (technical notices and “breaking changes”, maintenance, security, document updates) - sent from no-reply@mnemonica.com or notice@mnemonica.com | Art. 6.1(b) and 6.1(c) GDPR | Integral part of the service - not subject to consent |
| Sending of the newsletter, without any profiling | Art. 6.1(a) GDPR - consent | Optional - withdrawable at any time |
Mnemonica does not carry out profiling or automated decision-making. Data collected for statistical purposes are not used for advertising purposes and are not sold to third parties.
Recipients
Data is processed by Mnemonica personnel authorised under Art. 29 GDPR and may be disclosed to: cloud and infrastructure service providers (hosted within the EU), acting as data processors under Art. 28 GDPR; Google, as data processor, limited to the Firebase services used by the mobile applications (crash reports, usage statistics subject to consent, push notifications, remote configuration) and to the data indicated in 2; Apple, for the delivery of push notifications to iOS devices; the external identity providers (Google, Apple), where the User chooses to sign in with such identities, acting as independent controllers limited to the authentication they manage (see 2); public, judicial or supervisory authorities, where required by law. Your data is not sold to third parties for marketing purposes. The updated list of data processors is available on request at privacy@mnemonica.com.
Third-country transfers
Data processed through the Platform infrastructure is hosted within the European Union (AWS cloud infrastructure). Projects and Contents remain hosted within the European Union and are not involved in the flows described below.
The Firebase services used by the mobile applications (see 2 and 4) involve a transfer of the related technical data to the United States. That transfer takes place on the basis of the European Commission adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, to which Google LLC adheres.
Certain ancillary processing entrusted to other processors - for example support communications - may involve transfers to third countries, carried out solely in compliance with Chapter V of the GDPR, through adequacy decisions or standard contractual clauses (SCCs) under Art. 46.
Retention periods
| Data type | Retention period |
|---|---|
| Account and usage data | For the duration of the relationship. Account deletion is initiated by the User and results in anonymisation of the data relating to them (non-personal statistics may be retained) |
| Technical installation identifier, device keys and restore keys | For as long as the device remains linked to the account. By way of exception to the rule applicable to account data, these data are erased, not anonymised, upon account closure, as well as after 18 months from the last use of the device |
| External identity data (Google/Apple) | Until the identity is unlinked in account settings or the account is closed; in both cases the data are erased. Any name acquired at registration becomes account data and follows its retention period |
| Mobile application usage statistics (subject to consent) | 2 months at event and installation level; beyond that period only aggregated data not referable to a device remain available |
| Crash reports and diagnostics | Maximum 90 days |
| Push notification token | Until sign-out, uninstallation of the application or deactivation of notifications |
| Disaster-recovery backup copies | Maximum 6 months from the deletion trigger |
| Data subject to legal obligations | For the period required by applicable law |
Your rights
You have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7.3, e.g. for the newsletter).
Consent to mobile application usage statistics may be withdrawn at any time in the application Settings, with effect for the future and without affecting the lawfulness of processing carried out beforehand.
To exercise your rights: privacy@mnemonica.com.
Complaint: Garante per la Protezione dei Dati Personali - https://www.gpdp.it
Effective date (deployment): 17 October 2026