Privacy Policy
In brief. Serenlibrità lets you share books with readers near you. We collect the bare minimum, show only your approximate area (150–300 m, never your exact address), and give you control over every choice — there is a switch for each one, listed in §11. The service is reserved to people aged 18+.
1. Data controller
The data controller is Alberto Galassi (a natural person). For any privacy-related request you can write to [email protected]. No Data Protection Officer (DPO) has been appointed: the privacy contact above is the reference point for exercising your rights.
2. What data we process, for what purposes and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and managing your account | Email, password (hashed), display name | Performance of a contract (Art. 6.1.b) |
| Age verification (service reserved to adults) | Date of birth | Performance of a contract (Art. 6.1.b) |
| Profile and library shared with the community | Name, bio, status message, neighbourhood, books, avatar, literary character | Performance of a contract (Art. 6.1.b) |
| Showing you who reads nearby | Approximate location (obfuscated point 150–300 m) | Performance of a contract (Art. 6.1.b) |
| Letting whoever receives a loan request see how far away you are, so they can decide whether and where to meet | Approximate area and distance in bands (never in metres), shown only to the counterpart of that request | Performance of a contract (Art. 6.1.b) |
| Mutual ratings after a completed loan | Star rating and published average, without the rater's text | Performance of a contract (Art. 6.1.b) |
| Showing others when you last signed in, inside a conversation | Date of last sign-in, rounded | Performance of a contract (Art. 6.1.b) |
| Showing your contact details to other users | Preferred contact of your choosing | Consent (Art. 6.1.a), revocable |
| Messages between users for loans and in matches | Message content | Performance of a contract (Art. 6.1.b) |
| "Discover": suggesting people who have read the same books as you, or who would swap one with you | The books you mark in Discover (read and would talk about it / would like it / pass; nobody ever sees a "pass"). Only the person you match with sees them, and only the ones you have in common: never the full list, never other users. In a taste match, where you live does not appear, not even your city | Performance of a contract (Art. 6.1.b) |
| Reading groups: what you write is read by the other members | Posts and replies, group membership | Performance of a contract (Art. 6.1.b) |
| Letting you leave a book as a gift in a public book box — in Italian a cassetta dei libri — or another public spot, and letting you flag that it is there | The link between your account and the spot or the book — who flagged the box, who left the book, who took it — and the optional photo of the spot. Nothing else. That link is never shown to any other user: we keep it for moderation only | Performance of a contract (Art. 6.1.b) |
| Letting you manage a spot — your bookshop, your café with a shelf of books, the book box your residents' group looks after — once we have checked it: keeping its details up to date and, for a bookshop or café, the window of books people can find there | Your management request (the spot, what kind of place it is, the note you write to us, its status and the dates of our decision); what you publish on the spot's public page: name, address, opening hours, website, phone number and photo of the premises, and the books in the window. Anyone who opens the page sees the phone number and the photo, so use the shop's number, not your personal one. Your name does not appear on the page: only we know that you manage it. The role's service emails: a confirmation when we approve your request and, every thirty days while the window has books in it, a reminder asking whether everything is still there. We receive an email with your request, showing your display name and never your email address | Performance of a contract (Art. 6.1.b) |
| Telling you what concerns you (requests, messages, deadlines) | In-app notifications; email; push notifications if you enable them | Performance of a contract (Art. 6.1.b) |
| Reminders and digests to help you use the service | Digest of unread notifications; a reminder if your shelf is empty | Legitimate interest (Art. 6.1.f), with opt-out |
| Announcing new books on Serenlibrità's social channels | Book title, author and category — never who owns it, where it is, or the cover you uploaded | Legitimate interest (Art. 6.1.f), with opt-out |
| Moderation: reports, blocks between users, removals | Reported content, reason, outcome, who blocked whom | Legitimate interest (Art. 6.1.f) and legal obligations (Art. 6.1.c) |
| Security, anti-abuse, technical logs | Logs, IP addresses, rate-limiting | Legitimate interest (Art. 6.1.f) |
| Sign-in register: knowing when your account was accessed, spotting unusual sign-ins, and being able to answer a lawful request from the authorities | Date and time of each successful sign-in, IP address, browser/device type. We do not log your browsing, only the sign-in itself | Legitimate interest (Art. 6.1.f) and legal obligations (Art. 6.1.c), including Article 18 of Regulation (EU) 2022/2065 |
| Aggregate statistics (Matomo) | Anonymised usage data, no cookies | Legitimate interest (Art. 6.1.f) |
| Advertising (Google AdSense), to help cover the project's costs | Advertising identifiers and browsing data collected by Google on public pages | Consent (Art. 6.1.a), revocable from the banner |
| Consent register (proof that consent was given and withdrawn) | Consent type, policy version, dates of granting and withdrawal | Legal obligation (Art. 7.1) |
Your email address is required to have an account: without it, registration is not possible. All other choices (contact, geolocation, visibility, notifications) are optional and under your control from your profile — the full list of switches is in §11.
3. Your location
We never store your address or exact coordinates. At the point of entry your real location is obfuscated and discarded server-side: we only retain an approximate point (150–300 m). This is a data-minimisation and privacy by design measure (Art. 5.1.c and 25). Images you upload are stripped of GPS/EXIF metadata.
The same rule applies to the optional photo of a book box: it is re-encoded on arrival and its EXIF metadata, including the GPS position recorded by the phone, is not kept. Book boxes and libraries, unlike your profile, have an exact position: they are public places, not people's homes.
What the other person sees when there is a loan request
A loan is handed over in person, so whoever receives your request — and only them, only for that request — can see how far away you are. Specifically:
- a distance band (“2 km from you”), never the metres: the bands are the same ones you already see on other people's books when you search;
- the area name you wrote in your profile, only if you left “Show my neighbourhood” switched on;
- a map with two 300 m circles — theirs and yours — with no pin at all, only if you left “Show on the map” switched on.
Both points are the already-obfuscated ones, so the distance shown may differ from the real one by up to about 600 metres: the bands also serve to absorb that error rather than display it. If you withdraw your geolocation consent, or never set a location, the other person simply reads “Location not shared” — the screen is identical in both cases, deliberately, so it cannot reveal which one applies.
Only the distance band travels by email, and only in the new-request notice (“someone 2 km from you asked to borrow…”), so you can decide from your phone without opening the site. The area name, the map and the coordinates never leave the site: on an external mail service the name of a neighbourhood looks too much like an address.
4. Notifications: in-app, email and push
We tell you about what concerns you in three ways, and you govern them separately.
- In-app. Notifications stay inside the site, in the notification centre. They are always there: they are how the service tells you something happened.
- Email. They contain the minimum needed to understand and decide — never the text of the messages you received. Each type has its own switch (§11).
- Push on your device. Only if you enable them from your browser. To make them work we store the delivery address your browser assigns us (a unique URL) and two cryptographic keys. That address belongs to your browser's push service — Google for Chrome and derived browsers, Mozilla for Firefox, Apple for Safari — and to deliver the notice we have to go through them: see §7 and §8. You can revoke them from the site or from your browser settings; from that moment the address is no longer valid.
5. Books announced on social channels
Serenlibrità has an Instagram page and a Facebook page where recently added books are announced. The image and text published contain only the title, author and category of the book: never the name of whoever owns it, never their area or location, and never the cover you uploaded. If you would rather your books did not appear, there is a switch in your profile (§11) and it applies to every book from that moment on.
Anyone opening those posts on Instagram or Facebook is nevertheless on a Meta platform, which processes its own visitors' data under its own rules: that is outside our control and concerns their visit, not your Serenlibrità account.
6. Moderation, reports and blocks
You can report content and block a person. In both cases we keep the minimum needed to act and to show that we did: the reported content, the reason you gave, the date and the outcome; for a block, the fact that you blocked that person. The person reported is not told who reported them. This data is used only for moderation and to answer any request from the authorities, never to profile you.
7. Who we share data with
We rely on processors who handle data on our behalf:
- Aruba — hosting and email (Italy/EU);
- Cloudflare — CDN and security: it sees traffic to the site;
- OpenStreetMap Foundation — maps: when you open a map it is your browser that requests the images, and OpenStreetMap receives your IP address. The list of book boxes and libraries, on the other hand, is queried by our servers only, from a command that runs on its own: by that route no data about your browsing leaves for OpenStreetMap;
- browser push services (Google, Mozilla, Apple) — only if you enabled push notifications, and only to deliver them;
- Open Library and Google Books — queried by our servers to retrieve title, author and cover from an ISBN: the book code travels, no data about you.
- Google (AdSense) — only if you consent to advertising: in that case Google acts as an independent controller, not as our processor, and applies its own rules. Ads do not appear on legal pages or in the members' area. See the cookie page.
Matomo statistics are self-hosted by us (no third party). Other registered users see the profile data you choose to display. We do not sell data to anyone and we do not share it for third-party marketing.
8. Transfers outside the European Union
Some providers may process data outside the EU: Cloudflare, OpenStreetMap Foundation (United Kingdom), the push services of Google, Mozilla and Apple and Google for advertising (United States). The United Kingdom benefits from an adequacy decision of the European Commission; for the United States we rely on the Data Privacy Framework where applicable and, failing that, on standard contractual clauses. (Item under review with legal counsel.)
9. How long we keep data
| Data | For how long |
|---|---|
| Account, profile, books | As long as the account is active (with possible deletion after long inactivity, upon notice) |
| Approximate location | As long as the account is active, or until you remove it |
| Messages in loan conversations | As long as the account is active; on deletion your side is anonymised |
| Posts in reading groups | They remain readable by members; on account deletion they are anonymised |
| Ratings received | As long as the account is active; they feed the average in aggregate form |
| Books left in a book box (who left it, who took it) | As long as the entry stays open: after thirty days with no confirmation it expires on its own |
| Book boxes and libraries flagged, with the photo and who flagged them | As long as the spot stays published; the link with whoever flagged it is visible to moderation only |
| Managing a spot: the request, the shop's phone number and photo, the window | For as long as you manage the spot. You can stop whenever you like from “My book spot”: the role ends and, if nobody else manages the spot, the window is emptied and the phone number is deleted from the page. If you added the spot yourself, you can also take it off the map. The same happens if you close your account: all your management roles end and the books you put in a window are no longer linked to you. The request itself stays, closed, for moderation only |
| Push notification subscriptions | As long as you keep them on; an expired or revoked address is deleted |
| Reports and blocks | The time needed for moderation and by law |
| Security logs | 6 months |
| Sign-in register (date, time, IP) | 6 months, then deleted automatically. It is kept for that period even if you close your account, but with the link to your profile removed: this is the exception provided for by Art. 17(3) GDPR, and it exists so that someone who commits abuse cannot erase the trace of it by closing their account |
| Consent register | For the duration of the processing and the terms set by law (it is the proof that consent existed) |
10. Your rights
At any time you can access your data, rectify it, erase it, restrict its processing, object to processing based on legitimate interest, obtain portability and withdraw consents (from your profile settings, in one click; withdrawal does not affect what was done before). You can download your data in JSON format and delete your account from your personal area: deletion anonymises whatever cannot be removed without destroying other people's conversations. To exercise your rights: [email protected]; we reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
11. The switches you have
They are all in your profile and take effect the moment you touch them.
| Switch | What it governs |
|---|---|
| Geolocation consent | Every use of your area: proximity search, map, distance shown to the counterpart. Withdrawing it removes you from all geographic reads |
| Contact consent | Whether the contact you wrote is visible on your profile |
| Profile visibility consent | How much of your profile is shown to other members |
| Show bio · neighbourhood · character | The individual items of your public profile |
| Show on the map | Whether your books appear as an area on the map, and whether the counterpart sees the mini-map |
| Show last sign-in | The “last seen” line inside conversations |
| Email: new messages · loan events · digest · reminders | Each type of email, separately. Digests, reminders and announcements can also be turned off from the “Unsubscribe” link at the bottom of each of those emails, without signing in |
| Announce my books on social | Whether your books enter the Instagram and Facebook posts |
| Push notifications | Enabled and revoked from the browser |
12. Minors
Serenlibrità is reserved to people aged 18 or over. We do not knowingly collect data from minors. If we find that an account belongs to a minor we close it and delete the data.
13. Automated decision-making
We do not carry out profiling or automated decision-making with legal or similarly significant effects. The “near you” search is a simple geographic filter on the approximate point; the rating average is an arithmetic calculation on the votes received and does not by itself determine any consequence for your account.
14. Changes
If we update this policy, we will publish the new version and its date here. In case of substantial changes we will inform you appropriately and, where processing relies on consent, we will ask you to give it again.