YOUR INFORMATION
Privacy policy
Last updated:
Sophia Lab uses your account information to let you register and sign in, and security records to protect the service. You can request access, corrections or deletion by emailing admin@davidtonarini.com.
Who is responsible
Sophia Lab is operated by David Tonarini, the controller of the personal data described here. Contact: admin@davidtonarini.com. This policy covers the Sophia Lab website and its account system at sophialab.davidtonarini.com. It does not cover the separate WordPress website or the independent services of sign-in providers.
Information we collect
- Account details: your name, email address, internal account identifier, verification status, and account creation, update and last-login times. Email/password registration stores a password hash, rather than your readable password.
- Optional social sign-in: when you choose Google, Facebook or Microsoft, the enabled provider supplies your profile name, email address when available, and a provider-specific account identifier. Google may also supply an email-verification status. We store the identifier to recognize your account on later sign-ins. The current integration does not request your friends, posts or contacts and does not store provider access tokens in the account database.
- Verification and recovery: hashed, expiring email-verification and password-reset tokens, together with their purpose and use status.
- Security records: authentication events and their outcome, time, associated internal user identifier when available, IP address, browser/user-agent information, request identifier, and limited event details such as sign-in method. Rate-limiting records help prevent repeated abusive requests.
- Support requests: the email address, message and related information you send us when requesting help or exercising your rights.
Providing the required account details is necessary to create and use an account. You can browse the public collection without registering. Optional learning, questionnaire and research features described on the landing page are not part of the current account system; this policy does not authorize collecting additional research or sensitive data.
Why we use this information
We use account information to provide the service you request: registration, email verification, sign-in, access to your dashboard, password recovery and account support. Where the GDPR applies, the legal basis is performance of the service agreement or steps taken at your request before entering it (Article 6(1)(b)).
We use security and rate-limiting records for our legitimate interests in protecting accounts, preventing fraud and abuse, and investigating incidents (Article 6(1)(f)). We may also process information to comply with applicable legal obligations (Article 6(1)(c)). Authentication emails are service messages. This account system does not use your data for advertising or automated decisions producing legal or similarly significant effects.
Cookies and browser storage
Signing in uses an essential session cookie named sophia_session. It supports authentication and protection against forged requests and is configured as a browser-session cookie. The current website does not install advertising or analytics cookies. If you visit a social sign-in provider, that provider may use its own cookies and process your visit under its privacy policy.
Service providers and social sign-in
Hostinger supplies website/database hosting and the configured account email service. Hosting and email providers process technical information needed to operate these services and may keep their own operational records. Access to account information is limited to the operator and service providers where needed to run, secure or support the service, or where disclosure is legally required. We do not sell account information.
Choosing social sign-in redirects you to the provider, which processes information under its own terms. See the Google Privacy Policy, Meta Privacy Policy and Microsoft Privacy Statement. Provider services may involve international processing; their policies explain their locations and transfer safeguards. Contact us for information about the arrangements applicable to Sophia Lab's hosting and email services.
How long information is kept
Account information is kept while your account remains active, until you request deletion, or until the service no longer needs it. Verification links expire after 24 hours and password-reset links after 30 minutes. Expiration prevents use of a token; it does not itself remove the stored record.
Security records are kept separately from account data for as long as needed to investigate misuse, protect accounts, resolve disputes or meet legal obligations. Their retention is assessed according to those purposes, including when you request deletion. The system supports moving records older than three months into an archive; archiving is not deletion and does not establish a three-month retention limit. Expired-token and rate-limit cleanup likewise depends on maintenance being run.
Where hosting backups exist, deleted information may remain until the relevant backup is replaced or expires. Backups are not used to make a deleted account available again in normal operation. Contact us for details of retention relevant to a particular request.
Your choices and rights
Subject to applicable law, you may request access to your personal data, correction, deletion, restriction of processing or a portable copy of information you supplied. You may object to processing based on legitimate interests. Contact admin@davidtonarini.com; we may verify account ownership before making changes. Never send your password, passkey, PIN or verification codes.
We aim to respond without undue delay and, where the GDPR applies, normally within one month. If an extension or an exception applies, we will explain it. You may complain to your local data-protection authority, including in the EU country where you live or work or where you believe an infringement occurred.
For the practical deletion process, read Account and data deletion. Disconnecting a social provider alone does not delete your Sophia Lab account.
Changes to this policy
We will update this page when the service's data handling changes and revise the date above. Material changes will be communicated where appropriate. New uses of information, such as optional research participation, require their own information and any consent required before collection.