MALQMALQ FACE VAULT · MALQ LEARN
Privacy.
Last updated: 26 September 2026
Controller: Alessandro Malquori, operating the MALQ Face Vault and MALQ Learn projects. For privacy requests or questions, email info@malqvault.com.
What this notice covers
This notice explains the information handled when you browse the free Face Vault, use MALQ Learn, send a request, or purchase a digital guide. The Vault remains free. Paid guides are separate digital products. No account is required.
Information and why it is used
- Site operation and security. Cloudflare delivers the site and provides its database and private file storage. Its network may process technical connection details, such as an IP address, browser and request data, to deliver, secure and troubleshoot the service. MALQ’s analytics tables do not store full IP addresses.
- Saved build progress. The Vault stores your current build position in local storage on your device so you can resume it. This is not sent to MALQ. It remains until you clear the site’s browser data.
- Vault and Learn measurement. MALQ counts page and creation views, searches, filters, build steps, Learn page views, checkout starts, completed purchases and expired Checkout Sessions. Reports use daily totals, product or creation, a broad source category (direct, Google, YouTube, Instagram or other) and a broad device category (mobile or desktop). For a tagged YouTube link, the public video ID may also be included as a campaign dimension in aggregate event totals. Search terms are retained only when they contain 48 characters or fewer of letters, spaces, apostrophes or hyphens; other terms are replaced with “[redacted]”. MALQ does not use a persistent visitor ID, build a cross-site profile, or use advertising pixels or third-party analytics services. Measurement requests are not sent when the browser signals Do Not Track or Global Privacy Control.
- Checkout and orders. Stripe hosts the payment page and handles card details. MALQ does not receive or store your full card number or security code. To create a Checkout Session, the selected product and broad source/device categories are sent to Stripe as session metadata; for a tagged YouTube link, the public video ID is also included. To confirm payment, grant product-specific access, deliver the private file, answer support requests and handle refunds or disputes, MALQ receives and stores the Stripe Checkout Session and order identifiers, customer email, product, amount and currency, payment/refund status and relevant timestamps. A signed, essential browser cookie refers to the confirmed product and Checkout Session for up to 30 days so the secure download can be authorized. Download counts and their most recent time are recorded against the order.
- Requests and support. If you submit a Vault request or issue report, MALQ stores its category, subject, message, submission time and random request reference. The form does not ask for your email or account. If you contact support by email, your email address and message are used to reply and resolve the matter.
Learn purchase funnel
The first-party funnel records daily aggregate counts for Learn visits, product-page visits, checkout-page views, Checkout Sessions created, paid orders confirmed by a signed Stripe webhook, and Checkout Sessions that Stripe reports as expired. It stores product, source and device categories with the counts, plus the public video ID for tagged YouTube events; it does not put a visitor identifier or customer email in the funnel table. An expired session is a Checkout Session that was not completed before its Stripe expiry, not a judgment about why a visitor left. Stripe event identifiers needed to reject duplicate webhook processing are kept separately from the aggregate report. Expiry counts are available only when Stripe sends the signed checkout.session.expired event to MALQ’s configured webhook.
Legal bases
Information needed to take and fulfil an order is processed to perform the purchase contract. Transaction records may also be retained to comply with applicable legal, tax and accounting duties and to establish or defend legal claims. Site security and the operation and improvement of the free Vault and Learn are based on the controller’s legitimate interests, using minimised first-party statistics. Request messages are used to review and respond to the request. Where a legal basis permits an objection, you may contact MALQ at the address above.
Storage and retention
Saved build progress stays in your browser until you clear it. Aggregate Vault event counts are kept for up to 90 days. Aggregate Learn funnel totals are kept for up to 24 months. Vault request messages are automatically removed after 180 days; support emails are kept only while needed to resolve the matter. Order, payment, refund and entitlement records are retained for as long as needed to provide the purchased product, handle customer-service matters and comply with applicable tax/accounting obligations or resolve claims. Stripe retains payment data under its own retention rules. Cloudflare may keep technical logs under its service terms.
Service providers and international processing
Cloudflare provides hosting, database and private file-storage services. Stripe provides hosted checkout and payment processing. They process information under their own service terms and privacy documentation and may use infrastructure in countries outside the European Economic Area. Where a transfer requires safeguards, the providers describe the mechanisms they rely on in their privacy and data-transfer terms. Read Cloudflare’s Privacy Policy, Stripe’s Privacy Policy and Stripe’s Data Transfers Addendum.
Your choices and rights
You may request access, correction, erasure or restriction of your personal data, and object to processing based on legitimate interests, subject to applicable legal exceptions. You may also lodge a complaint with the Italian Data Protection Authority (Garante). Contact info@malqvault.com. A request to erase transaction information may be limited where the information must be retained by law or to establish or defend a claim.
Browser storage
The site uses local storage for the optional saved build position and, after a verified purchase, a strictly necessary HttpOnly cookie for secure product access. It does not use advertising cookies or third-party analytics cookies. You can clear browser storage in your browser settings; clearing the purchase cookie may require you to revisit the Stripe confirmation link or contact support to restore access.
This notice describes the current implementation. Legal retention requirements may require some order records to be kept after access to a product ends. Contact MALQ if you have a privacy question.