PRIVACY POLICY

This is a translation provided for convenience. The Italian version, Informativa sulla privacy, is the legally binding text.

This policy explains how Codedesign S.r.l. processes the personal data of people who visit horrorcult.com and of people who sign up, under Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and Italian data protection law. It only describes what the site actually does.

Data controller

The data controller is Codedesign S.r.l., Via Nino Pesce 38, 18018 Taggia (IM), Italy, VAT number IT01739830089. HorrorCult is a Codedesign website.

You can contact us by email at [email protected], by certified email (PEC) at [email protected] or by phone on +39 0184 716 626.

Data we process

Visiting the site

To show you the pages, our server receives, like any web server, your IP address and the technical details of the request (page requested, browser, language). Traffic goes through Cloudflare, which protects the site from attacks and abuse and tells us the country you are connecting from: we use it, without storing it, to show you on a film page the streaming platforms available in your country.

To check that the site works we record technical error messages and, for a randomly chosen share of requests (about one in ten), response times and the path of the request across our services. These traces may contain the IP address of the connection (since traffic goes through Cloudflare, this is normally Cloudflare's address, not yours), the browser type and the page requested. They are collected by Codedesign's monitoring server, signals-monitoring.codedesign.it, on Microsoft Azure in Amsterdam (European Union), and are only used to find errors and slowdowns.

Account and sign-in

You sign up and sign in through our authentication service at identity.codedesign.it, run by Codedesign on Microsoft Azure in Amsterdam (European Union), which processes your email, your password (stored only in encrypted form, never readable by us) and your profile data. If you choose to sign in with Google, Google gives us your first name, last name, email and profile picture. Email address verification and password recovery emails are sent on our behalf by Twilio SendGrid.

In our database we keep: email, first and last name, your username (created from your name and editable in your profile), your profile picture (the Google one or an image you upload), country, language, the date you joined and of your last activity, your role on the site, the version and date of the texts you accepted, and your choices about the newsletter, the assistant and personalisation, with their dates.

Public profile

Your public profile shows your username, your profile picture, who you follow and who follows you, and the film lists ("Want to watch", "Watched and liked", "Watched and disliked") you decide to make visible: for each list you choose in your profile between "Everyone" and "Only me". Your first and last name are not shown.

Comments, images and reports

When you comment we process the text, any images you attach, the date and the content the comment refers to. Comments are public, with your username and picture. Images are stored in our storage space on Microsoft Azure.

Every new comment is examined by an automatic moderator based on artificial intelligence (an agent of Evolus, Codedesign's AI service): it receives only the text of the comment, without your name or any other data that identifies you, and can only flag it to the editorial team. If you report someone else's comment, we record who reported it, the reason and any note. Only the editorial team sees reports. If the editorial team decides to hide a comment, it hides it without deleting it.

If you delete one of your comments, we delete it straight away and for good, together with its text, images and the reactions and reports concerning it. If others have replied to it, an empty placeholder remains in its place, with no text or author, shown as "Content no longer available".

Preferences, reactions and people you follow

If you save a film as "Want to watch", "Watched and liked" or "Watched and disliked", react to content or follow another person, we keep that choice and its date, to show it to you and for the site features that use it (your profile, reaction counts, the activity of people you follow).

Newsletter

If you turn it on, when you sign up or from your profile, we keep your consent and its date. For now we only record your choice: once sending starts, we will use your email only to send you the newsletter, through Twilio SendGrid.

Ghoulie, the assistant

Ghoulie is an artificial intelligence assistant you can turn on from your profile; until you do, it is not loaded. When you write to it, your messages are sent to Evolus, Codedesign's AI service, which answers using the HorrorCult catalogue. We do not pass your name or email to Ghoulie. Your conversation history is saved in your browser; Evolus keeps conversations for 12 months, then deletes them.

Searching the HMDB database

When you search for a film by describing it in words, the search text, without any data that identifies you, is sent to Microsoft's Azure OpenAI service, in the West Europe region, to work out its meaning and find the closest films.

Links to streaming platforms

On a film page the links to streaming platforms go through JustWatch, our partner: they are affiliate links: under our agreement with JustWatch we may receive a payment (commissions or paid clicks) if you use them, and this does not influence ratings or reviews. To show them, our server only asks JustWatch for the film and the country, never for data about you. When you click, you leave HorrorCult: JustWatch and the platform process your data under their own policies.

Images and content from other sites

Some images are loaded by your browser directly from the servers of whoever publishes them: posters and photos from The Movie Database (TMDB), article covers from the publications we cite, and the profile pictures of people who sign in with Google from Google's servers. These sites therefore receive your IP address and your browser's technical data, as with any image on the internet.

We serve YouTube video thumbnails ourselves: without your consent your browser does not contact YouTube. YouTube videos (through youtube-nocookie.com) and TikTok videos only load if you accept "External content" in the cookie banner; from that moment YouTube and TikTok receive the data of your visit, under their own policies. Details are in the cookie policy.

Statistics, only with your consent

If you accept "Statistics" in the cookie banner, the site loads Google Analytics 4, which stores cookies with a random identifier in your browser and sends Google the pages you visit, data about your device and browser and the referring page. We have enabled IP address anonymisation and turned off Google Signals and ad personalisation: the data is not used for advertising. Until you accept, and if you refuse, Google Analytics is not loaded.

Your cookie choice

When you choose in the cookie banner we record a random code for the choice, the version of the cookie policy, the categories accepted, the date, the language and, if you are signed in, your account. We do not record your IP address. We need this to prove the consent you gave us; we keep it for 24 months, then delete it automatically.

The "For you" page

The "For you" page arranges news, films, reviews and lists according to your taste. It is for members only and works only if you turn it on, with explicit consent that we ask for the first time you open it and that you can change from your profile. Without consent you see the same version as everyone else and we record nothing.

With personalisation on:

• we record what you do on the site: the pages and film pages you open, approximate reading time, clicks on trailers and platforms, searches, the items on the "For you" page you have seen and the requests you write in its chat. With each event we save the date, the language and the type of device (phone, tablet or computer). Each event is deleted automatically after 90 days;
• we also use the choices you already make on the site: film preferences, reactions, comments and the people you follow;
• we build a profile of your taste: an automatic calculation weighs subgenres, genres, directors, decades, countries and platforms; about every 6 hours, if there is new activity, an artificial intelligence agent of Evolus receives those scores and a summary of recent events, without your name or email, and writes a short reading of your taste and the order of the blocks on the page;
• when you write in the page's chat, the text is sent to Evolus to choose the content to show you. On our side the request stays among the events, for 90 days; Evolus keeps conversations for 12 months, like Ghoulie's.

You can see your taste profile, correct it ("not for me", "less like this") and delete your profile and events at any time from the page and from your profile. If you turn personalisation off we stop recording and delete your events and taste profile.

Personalisation only decides which content we show you and in what order: it has no legal effects or similarly significant effects on you. The reading of your taste is written by an artificial intelligence and can be wrong: that is why we label it and you can correct it.

Purposes and legal bases

• Providing the service you ask for by signing up: account, profile, comments, preferences, reactions, people you follow, search, data export and deletion: performance of the contract, that is the terms of service, Article 6(1)(b) GDPR.
• Showing you the site and protecting it, including Cloudflare, technical error messages, telemetry, comment moderation (including automatic moderation) and handling reports: our legitimate interest in a working, secure and civil site, Article 6(1)(f) GDPR. You can object by writing to us.
• Showing you the platforms in your country with JustWatch links: our legitimate interest, Article 6(1)(f) GDPR.
• Newsletter, Ghoulie and the "For you" page: only with your consent, Article 6(1)(a) GDPR, which you can withdraw at any time from your profile.
• Statistics with Google Analytics and external content (YouTube, TikTok): only with your consent, Article 6(1)(a) GDPR and Article 122 of the Italian Personal Data Protection Code (Legislative Decree 196/2003), which you can withdraw from "Cookie preferences" at the bottom of every page.
• Proving the consents we received and complying with legal obligations or requests from authorities: Article 6(1)(c) and (f) GDPR.

We do not use your data for purposes other than those listed and we do not sell it.

Providing your data

You do not have to give us any data to visit the site. To sign up we need your email, your statement that you have read this policy and your acceptance of the terms: without them we cannot create your account. Newsletter, Ghoulie, personalisation, statistics and external content are optional: if you do not turn them on, the rest of the site works the same way.

How long we keep data

• Account and content: as long as the account is active. You can request deletion from your profile, confirming with your username: from that moment your profile, comments, reactions and the people you follow are no longer visible, and for 30 days you can cancel the request simply by signing back in. After that we permanently delete the account from the authentication service, your images and your data, including comments; where one of your comments has replies from others, an empty placeholder remains, with no text or author, shown as "Content no longer available". Members of the editorial team and authors of reviews, articles or lists cannot delete their account on their own, because that content belongs to the site: they write to [email protected].
• Proof of consent: we keep the version and date of the texts you accepted and the choices you made for as long as the account exists; after deletion they remain as proof, linked only to an anonymised account, and the record of cookie choices loses its link to the account.
• A comment you delete: we delete it straight away and for good, with its text and images; if it has replies from others, only the empty placeholder described above remains.
• Personalisation events: 90 days. Taste profile: as long as personalisation is on.
• Cookie choice: the cookie lasts 6 months; the record of choices on the server 24 months, then it is deleted automatically.
• Technical messages and telemetry: for as long as needed to diagnose problems, then they are deleted automatically.
• Google Analytics: user-level and event-level data is deleted by Google after 14 months.
• Conversations with Ghoulie and with the "For you" page chat: 12 months at Evolus; Ghoulie's history in your browser stays until you delete it.

Who receives the data

Your data is processed by Codedesign staff and the HorrorCult editorial team, who are authorised and bound to confidentiality, each only for what they need (for example, the editorial team sees reported comments). Evolus, the authentication service and the monitoring server are run by Codedesign itself: the data does not leave our organisation and stays in the European Union.

The following process data on our behalf, as processors under Article 28 GDPR:

• Microsoft Ireland Operations Limited, for hosting the site and our services, the database, image storage and the Azure OpenAI service used by search, in the West Europe region (Netherlands).
• Cloudflare, Inc., for protecting and delivering the site's traffic.
• Twilio Inc., with the Twilio SendGrid service, for verification and password recovery emails and, once it starts, for the newsletter.
• Google Ireland Limited, for Google Analytics, only if you accept statistics.

The following receive data as independent controllers, under their own policies: Google, if you sign in with your Google account; YouTube and TikTok, if you accept external content; JustWatch and the streaming platforms, when you follow one of their links; TMDB and the publications whose images we show, which receive your IP address when your browser loads them.

Transfers outside the European Economic Area

Some providers may process data in the United States: Cloudflare, Inc., Twilio Inc. for emails and, only if you accept statistics, Google LLC. These transfers are based on the EU-US Data Privacy Framework, the European Commission's adequacy decision of 10 July 2023; you can check certifications at dataprivacyframework.gov. Microsoft technical support may also take place outside the Union.

Only if you accept external content: Google, including for YouTube, states that it processes data on servers around the world and relies, for the United States, on the Data Privacy Framework (policies.google.com/privacy/frameworks); TikTok states that it transfers data outside the European Economic Area on the basis of adequacy decisions or standard contractual clauses (TikTok's EEA privacy policy).

Automated decisions

We do not take decisions based solely on automated processing that have legal effects or similarly significant effects on you. The automatic moderator can only flag a comment: hiding it is always done by a person on the editorial team, and hiding it does not mean deleting it. Personalisation of the "For you" page, if you turn it on, is a form of profiling that only decides which content to show you and in what order.

Minimum age

You must be at least 16 years old to sign up. If we find out that a younger person has signed up, we delete the account. If you think this has happened, write to us.

Your rights

Under Articles 15 to 22 GDPR you have the right to:

• access your data and obtain a copy: from your profile you can download a data export, a ZIP archive with a summary page (index.html), your comments (comments.html), your images (images/) and a JSON file (data.json); you can request it once every 10 minutes;
• have inaccurate data corrected: name, username, picture and country can be changed from your profile;
• have your data erased: from your profile you can delete your account, as described above (members of the editorial team and authors of reviews, articles or lists write to [email protected]);
• obtain restriction of processing;
• receive your data in a structured, machine-readable format (the JSON file in the export) and transmit it to another controller;
• object at any time to processing based on our legitimate interest;
• withdraw your consent at any time: newsletter, Ghoulie and personalisation from your profile, statistics and external content from "Cookie preferences" at the bottom of every page. Withdrawal does not make what was done before unlawful.

To exercise them, or for any question, write to [email protected] or [email protected]. We reply without undue delay and in any case within one month of receiving the request.

Right to lodge a complaint

If you believe your data is being processed unlawfully, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the supervisory authority of the EU country where you habitually live, work or where the alleged infringement took place.

Cookies

The site uses technical cookies and, only with your consent, Google Analytics cookies and YouTube and TikTok content. Details, and how to change your choice, are in the cookie policy.

Changes to this policy

We may update this policy. The version and date at the top of the page show the latest change. If the changes are significant, we will ask you to read and accept it again the next time you sign in.