Privacy Policy

Last updated 22 July 2026

This Privacy Policy explains what personal data Primi Bocconi collects, why, on what legal basis, and what rights you have under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Italian data protection law.

1. Who is responsible for your data

The data controller is SFM LLC. You can contact us about any privacy question atciao@primibocconi.org.[DPO CONTACT if appointed]

2. What data we collect

Today, when you request the free recipe book or sign up for the free trial, we collect:

• your email address; and
• your baby's age range, only if you choose to share it.

That is the whole of what we collect right now. Nothing else.

When you subscribe to a paid plan, once membership is open, we will also collect:

• your name and account details;
• payment-related data handled through our payment processor, Stripe. Primi Bocconi itself never sees or stores your full card number; Stripe processes it directly under its own privacy terms; and
• basic usage and technical data needed to run the Service, such as login timestamps, device and browser information, and pages viewed in your member area.

3. Why we collect it, and our legal basis

Under the GDPR, we can only process your data where we have a valid legal basis. Here is how each purpose maps to a basis:

• Sending the free book, seven-day welcome series and recipe emails you signed up for- based on your consent, which you can withdraw at any time.
• Providing the subscription you purchase, including billing and access to member content- based on performance of the contract between you and us.
• Keeping the Service secure, preventing fraud and abuse- based on our legitimate interest in protecting the Service and our users, balanced against your rights.
• Issuing invoices and keeping accounting records- based on our legal obligation under Italian tax and accounting law.

We never sell or rent your data to third parties.

4. Who else processes your data

We use a small number of carefully chosen service providers, acting as our data processors, who handle data only on our instructions and under a data processing agreement:

• Supabase - stores our database, on servers located in Frankfurt, Germany (European Union).
• Vercel - hosts the Primi Bocconi website.
• Our email delivery provider - sends the emails you sign up for, and processes your address only to deliver them.
• Stripe - processes payments once you subscribe to a paid plan, under its own privacy policy.

These providers may process data under appropriate contractual and technical safeguards, as described in Section 6.

5. How long we keep your data

We keep your email and age range for as long as you remain subscribed to our free emails, and delete or anonymize it within a reasonable period after you unsubscribe or ask us to delete it. Once membership is open, we keep account and subscription data for as long as your account is active, and billing records for as long as Italian tax and accounting law requires us to keep them, even after you cancel.

6. International transfers

Where possible, we keep your data within the European Union, as with our Supabase database in Frankfurt. Where a provider we use processes data outside the EU/EEA, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses (SCCs), together with any additional safeguards required, to protect your data to the standard required by the GDPR.

7. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erasure of your data ("right to be forgotten"), subject to any legal obligation we have to keep certain records;
• restrict how we process your data in certain circumstances;
• data portability, to receive your data in a structured, commonly used format;
• object to processing based on our legitimate interest;
• withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal; and
• lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of your own EU country of residence.

Every email we send has a one-click unsubscribe link. To exercise any other right, write tociao@primibocconi.org and we will respond within the timeframe required by law.

8. Children's data

Primi Bocconi is a service for parents and carers, not for children. We do not knowingly collect personal data directly from children. Any reference to your baby's age range is data about your child that you, as the parent or carer, choose to share with us to personalize your menus, not data collected from the child.

9. Cookies

For details on the cookies and local storage Primi Bocconi uses, see ourCookie Policy.

10. Contact

ciao@primibocconi.org