Privacy Policy

This notice explains how personal data of people who use the ASTRA Bocconi app (the “App”) and the astrabocconi web pages that serve it (the “Website”) is processed. We follow the principles of lawfulness, fairness, transparency, minimisation and storage limitation set out in the GDPR.

The data controller is ASTRABOCCONI – APS (Associazione di Promozione Sociale), registered office Via Roberto Sarfatti, 7 – 20136 Milan (MI), Italy.

• Tax code: 97943660155
• VAT number: 13411890968
• Contact email: info@astrabocconi.com
• Certified email (PEC): astra.bocconi@pec.it
• Website: www.astrabocconi.com

For any request about your personal data, write to the contact email above.

Account and sign-in. Your university email address (@studbocconi.it or @unibocconi.it) and the one-time code we email you to sign in. There is no password. We also store your name if you give it, and a randomly chosen avatar seed (a short random string that selects your cartoon profile picture; it is not derived from your name or email).

Study profile. If you provide it: degree programme, track, year of study and class. It is used to show you the right content and to target notifications.

Points, rewards and activity. Your points balance and history, rewards you redeem (including any voucher or pick-up code), events you register for or get tickets to, discounts used at partner venues, and your rotating membership card QR code.

Support messages. If you write to us from the app’s support screen: your message, its category, the app version and your phone platform (iOS or Android), linked to your account so we can reply.

Device and session data. When you sign in we store a session record that includes your IP address and your browser or app user agent (device and operating-system details). If you allow notifications we store a push token that identifies your device for delivery, with its platform.

Crash and performance data. The app sends crash reports and performance traces to our error-monitoring provider (Sentry): device model, operating-system and app version, the screen you were on and the technical error. We do not attach your name, email or account identifier to these reports. The provider sees your IP address as part of the connection.

Camera (partner venue accounts only). The camera is used only to read the QR code on a member’s card in real time. No image or video is saved or sent to us.

Location. The App does not collect your location. The “Discounts” map shows venue positions; loading map tiles discloses your IP address to the map provider.

Stored only on your phone. The grade calculator keeps your exams and grades on your device. They are not sent to ASTRA.

Website visitors. The public pages (home, privacy, support) use a privacy-friendly analytics tool (Umami) run by ASTRA. It uses no cookies and builds no profile of individual visitors; it records page views and general technical details such as browser and country. The staff dashboard and sign-in page do not load analytics.

a) Providing the service Sign-in, points, rewards, events, materials, discounts, your card and support. Legal basis: performance of a contract or pre-contractual steps requested by you (art. 6(1)(b) GDPR). Providing this data is necessary to use the App.

b) Push notifications News, events and service messages, only if you allow notifications on your device. Legal basis: consent (art. 6(1)(a)). You can withdraw it at any time in your phone settings; the rest of the App keeps working.

c) Security and reliability Preventing abuse and unauthorised access (for example limits on sign-in code requests) and finding and fixing crashes. Legal basis: our legitimate interest (art. 6(1)(f)).

d) Legal obligations Processing required by law. Legal basis: legal obligation (art. 6(1)(c)).

We do not sell personal data, show advertising, or take decisions about you by automated means that have legal or similarly significant effects.

We use the following providers, appointed as processors under art. 28 GDPR or acting as independent controllers where noted:

• Vercel Inc.: hosting of the App’s API and of the Website (servers in Frankfurt, EU).
• Neon Inc.: the main database (accounts, points, rewards, events, support messages), in the same EU region.
• Supabase Inc.: storage of the course handouts and guides catalogue. These files are publicly downloadable and contain no personal data about you.
• Aruba S.p.A.: the mail service that sends your sign-in codes and service emails.
• Mapbox, Inc.: maps in the “Discounts” section (receives your IP address and technical device data when maps load; the provider’s usage telemetry is switched off in the App).
• Expo (650 Industries, Inc.) with Apple (APNs) and Google (FCM): delivery of push notifications. They receive your push token and the notification text.
• Functional Software, Inc. (Sentry): crash and performance monitoring, as described above.
• Eventbrite, Inc.: ticket sales. When you tap “Get tickets” you leave the App and buy on Eventbrite under its own privacy policy; payment data goes to Eventbrite, never to ASTRA. For in-app discounts ASTRA creates a single-use discount code on Eventbrite for you; we do not send your identity to Eventbrite.
• DiceBear (api.dicebear.com): generates the cartoon avatar image. It is called only by our servers, with the random avatar seed; it receives no name, email, account identifier or your IP address.
• OpenAI, L.L.C.: only for the “Ask ASTRA” virtual assistant, which is currently switched off and not available in the App. If it is enabled again, the text of the questions you type would be sent to OpenAI to produce an answer, and this notice will be updated first.
• Advisers, professionals and public authorities, within the limits of the law.

The up-to-date list of processors is available on request. Data is not disseminated to the public.

Some providers (for example Sentry, Expo, Mapbox, Eventbrite, Apple, Google) are based in the United States or may process data there. Such transfers rely on the safeguards in art. 44-46 GDPR: the EU-US Data Privacy Framework where the provider is certified, or the European Commission’s Standard Contractual Clauses. Our hosting and database run in the EU.

• Account, profile and activity: while your account exists. If you delete your account, they are removed or anonymised straight away, as described in the next section.
• Sign-in sessions (including IP address and user agent): until they expire or you sign out, and deleted when the account is deleted.
• Push tokens: until you turn notifications off, replace the device or delete the account.
• Support messages: while your account exists. They are deleted when you delete your account.
• Crash reports: kept by our monitoring provider for a limited period (by default 90 days).
• Technical server logs (including IP address): short-lived, held by our hosting provider for a limited period.
• Data we must keep by law: for the terms the law sets.

You can delete your account yourself in the App (Profile, Delete my account). Deletion takes effect immediately and cannot be undone.

Removed or anonymised immediately: your email address (replaced by an unusable placeholder, which also frees it for a future sign-up), name, avatar, study profile, all sign-in sessions and credentials, push tokens, event registrations and tickets, in-app discount codes, material access records, partner-discount usage records, memberships and consents. Your support messages are deleted, and the personal discount codes ASTRA created for you on Eventbrite are revoked.

Kept, without identifying you: the points ledger and your reward redemptions. Ledger entries cannot be changed by design (this protects the integrity of the points system), so they stay attached to an anonymous account that has no name, email or other personal details and can never be signed into. The staff audit log (who changed what in the staff dashboard) is also kept. We also keep a one-way fingerprint (a cryptographic hash) of your email address on that anonymous account, so that deleting and re-registering cannot be used to claim the one-time signup bonus again; the address cannot be recovered from it. Legal basis: our legitimate interest in preventing abuse (art. 6(1)(f)).

Backups: database backups held by our provider are overwritten on their own short rolling schedule; deleted data is not restored into the live service.

If you cannot sign in, email us from your university address and we will delete the account for you.

You may at any time exercise the rights in articles 15-22 GDPR: access, rectification, erasure, restriction, data portability, objection, and withdrawal of consent (without affecting processing done before withdrawal).

To exercise them, email the controller at the address above. We will answer within the legal deadline (normally one month, extendable in complex cases).

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Signing in requires a Bocconi University email address, reserved for enrolled students. We do not knowingly collect data from children outside this context. If we learn that data of a minor was processed without the consent of a person with parental responsibility, we will delete it without undue delay.

We may update this notice, for example when we add a provider or a new kind of data. The date of the last update is shown at the top. For material changes we will tell users through the App.