Privacy and cookie notice — My Station News
This is a translation of the Italian text, which prevails in case of doubt.
This notice explains what personal data My Station News processes, why, with which tools and for how long, under the legal framework in force ("GDPR", EU 2016/679).
1. Data controller
Marco Gimmelli, via Aristotele 39, 20128 Milan, Italy, VAT number IT07940840965. Contact for any privacy request: will [at] mystation.news.
2. What data is processed
| Category | Data | Where it comes from |
|---|---|---|
| Account | email address, password (stored only as an encrypted fingerprint, never in clear), interface language, dates of registration, confirmation, last access; declaration of legal age and acceptance of the terms, with date and version | from you |
| Briefing | recipient email, language, sending time, country and time zone, chosen sources, status of the briefing, outcome of the deliveries | from you |
| Narrating voice | name and description written by you, answers to the questions, profile text composed by the service | from you; the profile from the service |
| Consent to the profiling of the voice | date of the explicit consent | from you |
| Security | IP address and encrypted fingerprint of the email in sign-in, sign-up and password recovery attempts; IP address in the technical logs of the server | from your device |
| Communications | the messages you write to us at will [at] mystation.news | from you |
Special categories of data. The description of the voice and the answers to the questions may reveal your opinions, so they are processed only with your explicit consent (art. 9(2)(a) GDPR), which we ask for before creating the voice. If you do not give it, the description is neither stored nor used.
No payment data, precise location data or browsing data for statistics or advertising are processed.
3. Why it is processed and on what basis
| Purpose | Legal basis |
|---|---|
| Create and manage the account, prepare and send the briefing every day, handle pausing, unsubscribing and deletion | performance of the service you asked for (art. 6(1)(b)) |
| Create the narrating voice from the description and the answers | explicit consent (art. 9(2)(a); art. 6(1)(a)) |
| Confirm the recipient's address and allow them to stop receiving the briefing | performance of the service and legitimate interest in not sending emails to people who did not ask for them |
| Protect the service from abuse, unauthorised access and excessive use (limits on attempts, anti-bot checks) | legitimate interest (art. 6(1)(f)) |
| Answer your requests | performance of the service / legitimate interest |
| Comply with legal obligations | legal obligation (art. 6(1)(c)) |
Automated processing. The voice and the briefing are produced by automated procedures and language models (LLMs). This processing only serves to write the briefing: it does not produce decisions with legal or otherwise significant effects on the user (art. 22 GDPR).
4. Who the data is entrusted to
Your data is not transferred or sold. It is processed on our behalf, as data processors, only by the providers needed for the service:
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | infrastructure for preparing the briefings | European Union (Paris) |
| Anthropic | language models that currently read the description and the answers to create the voice and write the briefing from the news of the sources | United States |
| Amazon Web Services (Amazon SES) | sending emails (confirmations, notifications, briefing) | Paris eu-west-3 |
| Cloudflare | email forwarding and anti-bot check on forms (Turnstile) | United States / global network |
The selected sources receive the normal requests to read their feeds from our server, never your data.
Transfers outside the European Union. Transfers take place on the basis of the EU-US Data Privacy Framework, for certified providers, or of the standard contractual clauses approved by the European Commission.
5. How long it is kept
- Account, briefings, voices and consent: as long as the account exists. If you delete a briefing or the account, the related data is deleted straight away from the database.
- Access attempts (IP and fingerprint of the email): for the time needed for security checks, then deleted automatically.
- Technical logs of the server and of the service: for a limited period, then deleted with the weekly rotation of the logs.
- Server backups: deleted data may remain for a limited period in the backups, which are overwritten periodically.
- Emails you write to us: for the time needed to reply and handle the request.
6. Access, deletion, withdrawal
You can ask at any time for access to your data and a copy, its rectification, erasure, the restriction of processing, portability, and object to processing based on legitimate interest (arts. 15–22 GDPR), by writing to will [at] mystation.news.
Some things you can do yourself, from your area: change the briefing, pause it, recreate the voice, delete the account with all related data.
You can withdraw consent to the processing of the description and the answers at any time, by deleting the briefing or the account or by writing to us; withdrawal does not affect processing carried out before. Without consent it is not possible to create a voice.
For any other need you can contact the competent authority, the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it).
7. Recipients other than the user
If a user gives your address as the recipient of their briefing, we process your email address only to ask you to confirm and, if you confirm, to send you the briefing. You can stop receiving it at any time with the link at the bottom of each briefing.
8. Cookies
The site uses only technical cookies, needed for it to work: there are no statistics, profiling or advertising cookies, nor third-party cookies. This is why we do not ask for consent to cookies.
| Cookie | What it is for | Duration |
|---|---|---|
MYSTATION | session: keeps you signed in while you browse and protects the forms | until the browser is closed |
MYSTATION_RICORDAMI | only if you choose "Remember me": signs you back in on that device | 30 days |
lingua | remembers the language you chose for the site | 1 year |
9. Security
Passwords are stored only as an encrypted fingerprint, as are the codes of the confirmation and password recovery links; communications with the site are encrypted (HTTPS).
10. Changes to this notice
The version in force is always published on this page. Relevant changes are communicated by email.