Privacy Policy

This Privacy Policy explains how Inkwell (“Inkwell”, “we”, “us”, “our”) collects, uses and protects your personal data when you visit our website, create an account or subscribe to our service. We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and Italian Legislative Decree 196/2003 (the Italian Data Protection Code), as amended.

1. Who we are (Data Controller)

Inkwell is operated by Emanuele Mario Achenza, an individual entrepreneur (ditta individuale) trading as “Inkwell”, with business address at Via Manfredonia 4, 20142 Milano, Italy, VAT no. (P. IVA) IT02885410908. Emanuele Mario Achenza is the data controller responsible for your personal data.

For any privacy enquiry or to exercise your rights, contact us at hello@inkwell-letters.com. We have not appointed a Data Protection Officer, as we are not required to do so.

2. Who can use Inkwell

Inkwell is intended exclusively for adults aged 18 or over. The service is not directed to children, and we do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a person under 18, we will delete it without undue delay.

3. What personal data we collect

• Account & contact data: your name, email address, password (stored only in hashed form) and, optionally, your phone number.
• Postal correspondence: your postal address and the content of the letters you and your assigned teacher exchange, so we can produce and deliver them.
• Learning profile: the information you provide during onboarding, such as your target language, level, native language, age range, interests, writing frequency, handwriting preference, learning goals, pen-pal notes and correction preferences.
• Billing data: your subscription plan and status and the identifiers assigned by our payment provider. We never receive or store your full card details — these are handled entirely by Stripe.
• Communications: messages you send us (e.g. via the contact form or email) and, if you opt in, your newsletter subscription status, including bounce/complaint signals used to keep our mailing list clean.
• Technical data: a strictly-necessary session cookie, your cookie preferences, and standard server logs (such as IP address and timestamps) generated for security and abuse prevention.

Please do not include special categories of data (e.g. data revealing health, religion or political opinions) in your letters or profile unless strictly necessary; we do not request such data and process it only where you voluntarily provide it as part of your correspondence.

4. Why we use your data and our legal bases

• To provide the service — creating your account, building your learning profile, assigning a teacher, and producing, delivering and exchanging letters: performance of a contract (Art. 6(1)(b) GDPR).
• Billing, accounting and fraud prevention: performance of a contract and compliance with legal obligations (Art. 6(1)(b) and (c) GDPR).
• Security, service integrity and abuse prevention: our legitimate interestsin keeping Inkwell safe and reliable (Art. 6(1)(f) GDPR).
• Newsletter and marketing emails: only with your explicit, opt-in consent(Art. 6(1)(a) GDPR), which you may withdraw at any time.
• Analytics and marketing cookies: only with your consent via the cookie banner (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). See our Cookie Policy.

5. Newsletter and marketing

If you opt in, we send you our newsletter and occasional updates using our email provider (Resend). Every message contains an unsubscribe link, and you can withdraw consent at any time from your account or by contacting us; withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

6. Who we share your data with

We do not sell your personal data. We share it only with service providers who process it on our behalf under data-processing agreements (Art. 28 GDPR), and only as needed to run Inkwell:

To deliver physical letters, your postal address is necessarily disclosed to the postal and courier services that carry the mail. We may also disclose data where required by law or to establish, exercise or defend legal claims.

7. International transfers

Your data is primarily stored within the European Economic Area (EEA) and the United Kingdom. The UK benefits from a European Commission adequacy decision. Where a provider processes data in the United States or elsewhere outside the EEA, the transfer is protected by an adequacy decision (e.g. the EU–US Data Privacy Framework) or by Standard Contractual Clauses with appropriate supplementary measures, as required by Chapter V GDPR. You can request a copy of the relevant safeguards by contacting us.

8. How long we keep your data

• We keep your account and learning data, and your letters, for as long as your account is active.
• After you delete your account, we erase or anonymise your personal data without undue delay and in any event within 30 days.
• We retain invoices and accounting records for 10 years, as required by Italian civil and tax law (Art. 2220 of the Italian Civil Code).
• We keep limited records (e.g. suppression lists) where necessary to comply with your choices and our legal obligations.

9. Security

We apply appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls and restricted administrative access. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the competent authority of any breach where legally required.

10. Your rights

Under the GDPR you have the right to:

• access your personal data and obtain a copy;
• rectify inaccurate or incomplete data;
• erase your data (“right to be forgotten”);
• restrict or object to processing, including processing based on legitimate interests;
• data portability (receive your data in a structured, machine-readable format);
• withdraw consent at any time, where processing is based on consent.

You can exercise these rights directly:

• Export your data from your dashboard, or by emailing us.
• Delete your account and data from your dashboard settings.
• Contact us at hello@inkwell-letters.comfor any other request. We respond within the time limits set by the GDPR (normally one month).

You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Roma; www.gpdp.it), or with the authority in your EU country of residence.

11. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, and we do not carry out profiling of that kind.

12. Cookies

See our Cookie Policy for full details of the cookies and similar technologies we use.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post any changes on this page and update the “last updated” date above; material changes will be communicated where appropriate.