Privacy Policy

2. The information processed

• •Contact and identity: the parent or guardian’s and the student’s name, email and phone number.
• •Age: the student’s date of birth, collected when the Ascentiq account is set up and checked against the minimum age of 14.
• •Academic background: school, programme and level, current and target grades, timeline, exam session.
• •Lesson data: the scheduled Zoom lesson, the audio-and-video recording and the transcript — recorded, transcribed and hosted by Zoom — the AI-generated study notes drawn from that transcript (concepts, worked examples, and notes on where the student struggled), and the searchable lesson archive the student keeps.
• •Practice data: exercises attempted and answers given, images of handwritten work, AI feedback and marks, and progress and mastery scores.
• •AI study-coach and AI-tutor chat: the messages exchanged with those assistants.
• •Billing: the payer’s name, email, billing address and codice fiscale, handled through the payment processor — card numbers are never held by Renzo Diaz.
• •Website data: pages visited on renzo-diaz.com (analytics, only with your cookie consent) and the information entered in the application form.
• •Technical data: server and application logs, and error reports.

3. Why the data is processed, and the legal basis

• •To deliver and personalise lessons — including scheduling, recording, transcription and the AI study notes — necessary to perform the contract (Art. 6(1)(b) GDPR).
• •Recording and transcription of live sessions, session replays, and AI-generated written summaries — performance of the contract (Art. 6(1)(b) GDPR). Replays and summaries are a core part of the paid service. Where the student is a minor, the parent or legal guardian is the contracting party.
• •To maintain the searchable lesson archive the student keeps — necessary to perform the contract; recording is a defined feature of the service, also confirmed in the Client Agreement or, for a fixed-package program, the Program Agreement.
• •To provide the practice exercises, AI grading and AI study tools — necessary to perform the contract.
• •To process payments and keep accounting records — to perform the contract and to comply with tax and accounting obligations (Art. 6(1)(b) and (c) GDPR).
• •To improve the service and prevent abuse, using data in aggregated or de-identified form wherever possible — legitimate interest (Art. 6(1)(f) GDPR), balanced against your rights.
• •To communicate about scheduling, updates and support — necessary to perform the contract. Optional or marketing communication relies on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

4. Testimonials, reviews and case studies

• •Where a student or a parent has published a public review of the Services — for example on Google — Renzo Diaz may quote it on this website with a link back to the original, so a reader can verify it independently. This relies on the reviewer having chosen to make those words public themselves.
• •Publishing the categories that accompany the review — the student’s or parent’s first or full name, the subject and level, the school, the grade change, the university the student went on to attend, and a link to the review — is done only with that person’s separate, specific, opt-in consent (a parent’s or guardian’s where the student is a minor, including for the university), recorded with the date, the exact wording shown and its version.
• •A document or screenshot (a school notice, an email, a results screenshot) is authorised separately, one item at a time: the exact redacted version is shown to the person first, and it is published only where no other individual in it is identifiable. A link to a professional profile such as LinkedIn is published only with the adult former student’s own specific consent.
• •Clips from sessions. Renzo Diaz never uses a recording (video, audio or transcript) of a session for marketing, social media or other promotion without separate, specific written approval for each clip, given by the parent or legal guardian of a minor student (and, where appropriate, by the student). This approval is optional, is never a condition of the service, and you can withdraw it at any time; Renzo Diaz then stops using the content going forward.
• •Consent is granular: you may agree to some items (for example, first name and subject) and decline others (for example, school name or exact grades).
• •Consent can be withdrawn at any time, as easily as it was given, by writing to renzo@ascentiq.io. On withdrawal, the material is removed from the site at the next update and from the structured data; content already cached by third parties such as search engines is outside Renzo Diaz’s control, and a removal request will be made where possible.
• •Absent consent, a case may still be described on the site only in genuinely de-identified form — no name, no school, no uniquely identifying detail — and any underlying documents, screenshots or images are withheld. Short verbatim excerpts of the written messages behind such a case (a school’s notice, a teacher’s email, a parent’s message) may be quoted on the site, anonymised: no names, no schools and no images, only the type of document and its date.

5. The lesson pipeline and the third parties involved

• •A lesson runs on Zoom, which records the audio and video, generates the transcript, hosts the recording and can provide a share link to it. The recording and transcript are brought into the platform and stored by Supabase; a set of study notes is then generated from the transcript by an AI provider (OpenAI). Practice work is graded, and the AI study coach runs, through OpenAI and Groq. Payments run through Stripe — subscription billing and one-time payments for tutoring programs, and invoicing data. Introductory calls are booked through Calendly, and business email (scheduling, summaries and invoices) runs on Microsoft Outlook.
• •Each of these acts only as a processor, on the controller’s instructions, under a data-processing agreement meeting Article 28 GDPR. The full register — what each one does, the data it sees, where it operates and the transfer safeguard — is at renzo-diaz.com/sub-processors.
• •Personal data is never sold, and never shared with third parties for their own marketing. Data may be disclosed to public authorities only where required by law.

6. International transfers

The lesson, its recording, its transcript and its storage all stay within the EEA — the Zoom account runs under EEA data residency, and Supabase storage is in Ireland. The processors that operate in the United States are the two AI providers (OpenAI, and Groq — whose compute is in the US; its contracting entity for the EEA is Groq UK Limited), the payment processor’s head-office infrastructure (Stripe), and some hosting edge locations (Vercel). Outside the EU–US Data Privacy Framework, the United States is not the subject of an EU adequacy decision; those transfers rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), together with supplementary measures assessed in line with EDPB Recommendations 01/2020 (encryption in transit and at rest, restricted access). A copy of the Clauses is available on request. Calendly, used to book introductory calls, also operates in the United States; it relies on its certification under the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), with the Standard Contractual Clauses as a fallback. Business email runs on Microsoft 365, under its EU Data Boundary commitment to store and process the data in the EU and EFTA. The AI providers process data through their business APIs on Renzo Diaz’s instructions, and do not use it to train or fine-tune their models.

7. Automated processing and AI

Three parts of the service involve automated processing by third-party AI models: grading of practice work, generation of the study notes from a lesson transcript, and the AI study coach. Before a lesson transcript is used to generate study notes, speakers are labelled by role (Tutor / Student), not by name. These outputs are study aids. They are not certified assessments and produce no legal effects in the sense of Article 22(1) GDPR — real exam grades, school reports and university admissions are unaffected by them. You can ask for a person to review any AI grading decision by writing to renzo@ascentiq.io; a human reassesses it within one month. You can object to the AI processing at any time (Art. 21 GDPR); because these features are part of how the service works, objecting may limit what the student can use. The AI providers do not use the data to train or fine-tune their models.

8. Storage, security and retention

• •Data is stored on encrypted, access-controlled platforms; database access is row-level restricted, and sensitive files such as images of handwritten work are served only through short-lived signed links.
• •Access is limited to Renzo Diaz and vetted processors acting under instruction. Reasonable technical and organisational measures are in place against unauthorised access, loss or misuse.
• •Lesson recordings, transcripts, AI study notes (the written session summaries) and progress data: kept for the duration of the engagement and for up to 6 months after it ends — the short tail so a student sitting an exam resit can still revisit the material — then deleted. Earlier deletion on request.
• •Practice attempts, images of handwritten work and AI feedback: kept while the Ascentiq account is active; anonymised or deleted on request.
• •AI study-coach and AI-tutor chat: kept on a rolling 90-day window.
• •Invoicing and accounting records: kept for 10 years, as required by Italian law (Art. 2220 of the Civil Code), even after an erasure request — with personal data reduced to what the accounting rules require.
• •Application data from people who do not go on to enrol: kept for up to 12 months.
• •Consent records: kept while the related content or engagement is live and for a short period afterwards as proof that consent existed; withdrawn consents are logged as withdrawn.

9. Minors

The coaching service is contracted by a parent or legal guardian. For every student under 18, the guardian provides the personal data, gives the consents described here, and exercises the student’s data-subject rights on their behalf; the guardian signs the Client Agreement (or, for a fixed-package program, accepts the Program Agreement at checkout) and is the payer. The student holds their own Ascentiq account (Google sign-in) and uses it to join lessons, watch recordings, read the study notes, practise and use the AI study coach. The minimum age to hold an account is 14 (Art. 2-quinquies of the Data Protection Code); the date of birth is collected at set-up and checked against it. Child-specific data — recordings, transcripts, AI notes, academic and progress data, school name — is treated with particular care and is never used for testimonials or marketing without the guardian’s specific opt-in consent.

10. Your rights and how to use them

Under the GDPR you have the right to request access to your data; to have it corrected or completed; to have it erased ("right to be forgotten"); to restrict or object to processing; to receive your data in a portable format; and to withdraw any consent at any time without affecting processing already carried out. Inside Ascentiq, "Download my data" and "Delete my account" in the profile handle access, portability and erasure directly. Otherwise, write to renzo@ascentiq.io (or the PEC address for a formal notice); a response follows within one month. A deletion request has a 24-hour confirmation step, after which personal data is removed within 30 days — except invoicing records, which are kept for the 10-year period Italian tax law requires. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali — garanteprivacy.it; Piazza Venezia 11, 00187 Roma; protocollo@gpdp.it; +39 06 696771).

11. Information not obtained directly from you

Two small categories of data reach the service from someone other than the person it is about. When a student enters a parent or guardian’s contact details, or when Zoom records the people present on a lesson call, that data is processed for the purposes and on the legal bases described above, and the same rights apply. Anyone in this position can contact renzo@ascentiq.io to see what is held or ask for it to be removed.

12. Cookies and analytics

• •On renzo-diaz.com, cookie consent is handled by the site itself, not a third-party platform; non-essential cookies and scripts are blocked until you consent, and your choice is stored only in your own browser.
• •Cookies are used for essential site functionality and, with your consent, for analytics (Google Analytics 4).
• •You can review or change your choice at any time through the cookie-settings link in the page, or by clearing cookies in your browser.
• •The Ascentiq platform has its own, separate cookie set (a sign-in token, a record of your cookie choice, and error monitoring only if you opt in), described in Ascentiq’s cookie notice.

Data controller and company information

• •Legal name: STUDIA DI RENZO IVAN DIAZ DELGADO
• •Registered office: Strada Santa Maria Bianca 21, 27058 Voghera (PV), Italy
• •VAT number (Partita IVA): 11342870968
• •Tax code (Codice Fiscale): DZDRZV92R31Z611T
• •Business Register number (REA): PV-334184
• •Email: renzo@ascentiq.io
• •PEC: renzodiaz@postecert.it