Privacy Policy
Tento dokument je k dispozícii v taliančine a angličtine: anglická verzia je uvedená nižšie.
1. Controller
The controller is Erik Piccinini, registered office at Via Beniamino Gigli 15, 62011 Cingoli (MC), VAT number 02020330433. For any privacy request write to [email protected].
This policy covers visitors to the website and people who use the app with their own account (Article 13 of Regulation (EU) 2016/679, "GDPR").
2. Data we process
- Website visits. The public website uses no analytics and no cookies other than the technical language cookie. Servers log technical request data (IP address, date and time, requested page) for security and troubleshooting.
- Account. Name, email, password (stored only as a non-reversible hash), language, theme, two-step verification if enabled.
- Organisation. Company name, VAT number, address, logo, members and roles.
- Content. Recipes, ingredients, suppliers, specification sheets, labels and files you upload. They may contain third parties' personal data (for example a supplier's name): for that data we act on behalf of your organisation, as described in the Terms of Service (section 9).
- Use and security. Activity log with date, person, action and IP address; sign-in attempts.
- Payments. Plan, subscription status and invoices. Card details are handled directly by Stripe and never reach us.
- Support. Requests you send us from the app and related correspondence.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage the account, provide the service, send service emails (verification, invitations, notifications, plan notices) | Performance of the contract (Art. 6(1)(b) GDPR) |
| Service security, activity log, abuse prevention | Legitimate interest in protecting the service and customers' data (Art. 6(1)(f)) |
| Invoicing and tax obligations | Legal obligation (Art. 6(1)(c)) |
| Answering support requests | Performance of the contract or pre-contractual steps (Art. 6(1)(b)) |
We do not use data for advertising, we do not sell it and we do not profile you.
4. Who receives it
Data is processed by us and by the providers that help us run the service, appointed as processors:
| Service | Provider | Country |
|---|---|---|
| Application servers and database | Hetzner Online GmbH | Germany |
| Storage of uploaded files and exports | Hetzner Online GmbH | Germany |
| Network, DNS and certificates | Cloudflare, Inc. | United States |
| Email: sending and @etichettalo.it mailboxes | Register S.p.A. | Italy |
| Payments and invoices | Stripe Payments Europe Ltd. | Ireland |
| Machine translation, only for texts you send with "Suggest translation" | DeepL SE | Germany |
| Internal staff alerts (name, email, organization, plan) | Discord Inc. | United States |
If a provider processes data outside the European Economic Area, the transfer relies on GDPR safeguards (adequacy decision or standard contractual clauses).
Content you choose to publish, such as a catalogue with a public link, is visible to anyone who has the link.
5. How long we keep it
- Account and content: while the account or organisation is active. After a request to delete the organisation it can be recovered for 30 days, then it is erased; backups roll over within another 30 days.
- Activity log: for the life of the organisation.
- Technical server request data: up to 30 days, unless needed to investigate an incident.
- Invoices and tax data: 10 years, as required by law.
6. Your rights
You may ask to access, correct or erase your data, restrict its processing, receive it in a machine-readable format (portability) and object to processing based on legitimate interest (Articles 15–22 GDPR). Many of these you can do yourself in the app: edit your profile, export or delete the organisation.
For anything else write to [email protected]: we answer within one month. If you believe the processing breaches the GDPR you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the authority of your country.
7. Security
Connections are encrypted; each organisation's data is isolated at database level; passwords are never stored in clear text; two-step verification is available; we take daily backups.
8. Changes
If we change this policy materially we will tell registered users by email. The date of the last update is at the top of the page.