Privacy Policy

Last updated: 4 August 2026 · Effective date: 4 August 2026

This Privacy Policy explains how we collect, use and protect your personal data when you visit portraitrealismacademy.com, submit an application, or purchase a spot in the Portrait Realism Academy masterclass (the "Academy").

Data Controller. Portrait Realism Academy — Federico Galliani.
Contact for any privacy matter: academy@portraitrealismacademy.com
The Academy is held at SOL Studios, 11000 W Janesville Rd, Hales Corners, WI 53130, USA.

1. What we collect

Category	Data	When
Application data	First and last name, email, phone/WhatsApp, Instagram handle, city, experience level, your message	When you submit the application form
Payment data	Name, email, billing country, transaction amount and status. We never see or store your full card number — payments are processed entirely by Stripe.	When you pay a deposit, balance or full tuition
Technical data	IP address, browser and device type, pages viewed, referring source, approximate location (country/city level)	Automatically, when you browse the site
Advertising data	Interaction with our ads and pages (page views, form submissions, checkout events), via cookies and the Meta Pixel	If you accept cookies / arrive from an ad
Communications	Emails, direct messages and their content	When you contact us or we contact you

2. Why we use it and on what legal basis

To evaluate your application and manage your participation — performance of a contract, or steps taken at your request before entering into one (GDPR Art. 6(1)(b)).
To process payments, issue receipts and comply with tax and accounting obligations — contract and legal obligation (Art. 6(1)(b) and (c)).
To send you information about your booking (confirmation, balance reminders, logistics, certificate) — contract.
To measure and improve our advertising and understand which content works — legitimate interest, and your consent where cookies are involved (Art. 6(1)(a) and (f)).
To protect the site from abuse, spam and fraud — legitimate interest.

We do not sell your personal data, and we do not use automated decision-making or profiling that produces legal effects on you.

3. Who we share it with

We share data only with providers that help us run the Academy, each acting under contract and only for the purposes below:

Provider	Purpose	Where
Stripe	Payment processing, receipts, refunds	USA / EU
Brevo	Sending transactional emails (confirmations, reminders)	EU
Meta (Facebook/Instagram)	Advertising measurement and audiences (Pixel and Conversions API)	USA / EU
Cloudflare	Website delivery, security and anti-abuse	Global
Google	Search Console (aggregated search statistics, no personal identifiers)	USA / EU
DigitalOcean	Server hosting of the site and application data	USA

We may also disclose data where required by law, or to establish, exercise or defend legal claims.

4. International transfers

The Academy takes place in the United States and some of our providers are US-based, so your data may be transferred outside the European Economic Area. These transfers are covered by the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework, together with additional technical safeguards such as encryption in transit.

5. How long we keep it

Applications that do not result in a booking — up to 24 months, then deleted.
Booking and payment records — 10 years, as required by tax and accounting law.
Marketing and advertising data — up to 180 days, or until you withdraw consent.
Emails and messages — up to 24 months after our last exchange.

6. Your rights

Wherever you live, you can ask us to:

Access the personal data we hold about you, and receive a copy
Correct data that is inaccurate or incomplete
Delete your data ("right to be forgotten"), where we are not required to keep it
Restrict or object to certain processing, including direct marketing
Port your data to another provider in a machine-readable format
Withdraw consent at any time, without affecting processing already carried out

Write to academy@portraitrealismacademy.com — we reply within 30 days. If you are in the EU/EEA you also have the right to lodge a complaint with your national data protection authority (in Italy: Garante per la protezione dei dati personali).

If you are in California (CCPA/CPRA)

You have the right to know what personal information we collect and why, to request deletion, to correct inaccurate information, and to opt out of "sharing" for cross-context behavioural advertising. We do not sell personal information. You will never be discriminated against for exercising these rights. To opt out of advertising cookies, decline them in the banner or use your browser's privacy controls.

7. Cookies and tracking

We use two kinds of cookies:

Necessary — required for the site to work and stay secure (e.g. Cloudflare security). These are always active.
Advertising and measurement — the Meta Pixel, which tells us whether visits, applications and purchases come from our ads. These load only after you accept the banner.

We also use Meta's Conversions API: when you submit an application or complete a payment, our server sends Meta a confirmation of that event, with your email address hashed (irreversibly encoded, never in plain text) so the same action is not counted twice. You can opt out at any time by declining cookies, using your browser or device privacy settings, or adjusting your Meta ad preferences.

8. Security

The site is served over HTTPS with a security layer in front of it. Application data is stored on an access-restricted server. Payment card details never reach our systems: they are handled directly by Stripe, a PCI-DSS Level 1 certified provider. Access to personal data is limited to the people who need it to run the Academy.

9. Children

The Academy is intended for professional tattoo artists and is not directed to anyone under 18. We do not knowingly collect data from minors. If you believe a minor has provided us with data, write to us and we will delete it.

10. Changes to this policy

If we make material changes we will update the date at the top of this page and, where the change affects you significantly, notify you by email. The current version always applies.

Questions? Write to academy@portraitrealismacademy.com — a real person reads it.