Privacy policy

Last updated: 1 November 2026

Who is responsible

The data controller for this website is Eugenio Scarlato, an individual trading as “ADHD Brain OS”, Via del Gaudio 5, 87100 Cosenza (CS), Italy. Email: euscarlato@gmail.com.

What we collect and why

• Free Starter Kit sign-up. When you request the free kit we store the email address you enter. We use it to give you the download and, after you confirm your address through the confirmation email we send (double opt-in), to send a few tips over the next 10 days and then occasional tips and offers about ADHD Brain OS. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time by using the unsubscribe link in any email or by writing to us; this does not affect processing before withdrawal.
• Purchases. Payments are processed by Stripe (Stripe Payments Europe Ltd., Ireland). We receive your name, email, billing country and order details, but never your full card number. Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligations such as tax and accounting records (Art. 6(1)(c)).
• Support emails. If you write to us we use your message to answer you (Art. 6(1)(b) or (f)).
• Technical data. Our host keeps short-lived server logs (such as IP address and browser type) to deliver and secure the site (Art. 6(1)(f), legitimate interest). We do not use advertising or analytics cookies.
• Visit statistics. We use Cloudflare Web Analytics to count page visits in aggregate. It sets no cookies and does not track you across sites or build a profile of you (Art. 6(1)(f), legitimate interest).

Who processes data for us

• Brevo (Sendinblue SAS, France, EU): storing the email list and sending the confirmation email and the tips emails. Every email has a one-click unsubscribe link.
• Cloudflare, Inc. (USA): privacy-friendly, cookie-free website visit statistics.
• Netlify, Inc. (USA): website hosting and the free-kit sign-up form (it keeps a copy of form entries).
• Stripe (Stripe Payments Europe Ltd., Ireland): payments, receipts and invoices.
• Google (Google Drive): delivery of the downloadable files. Google may process your IP address when you open a download link.

Where data is transferred outside the EU/EEA, this is based on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

How long we keep it

Email-list data (Brevo, and the copy of the sign-up form entry at Netlify): kept until you unsubscribe or ask us to delete it, then deleted. Purchase and invoice records: as long as tax law requires (in Italy, generally 10 years). Support emails: up to 24 months after the conversation ends.

Your rights

You can ask for access to, correction, deletion, restriction or portability of your data, and you can object to processing based on legitimate interest. Write to euscarlato@gmail.com. You also have the right to lodge a complaint with a supervisory authority. In Italy that is the Garante per la protezione dei dati personali (garanteprivacy.it).

Health information

We do not ask for health information. Anything you write in the planner, tracker or your AI chats stays on your own devices and accounts. We never see it.