Privacy Policy

The short version

• The website has no accounts, ads, analytics or tracking cookies, and it loads no scripts or fonts from other sites.
• We only process personal data in these cases: technical server logs, emails you send us, the “Tell us about your firm” questionnaire, and downloading Fiscoo with your firm’s personal code.
• We do not sell your data, share it for advertising, or use it to profile you.
• Client data and documents a firm processes in the Fiscoo app stay on the firm’s computers: they aren’t sent to our servers, and the optional AI model runs locally, without outside AI services.

Who is responsible for your data

The data controller is:

[TO BE COMPLETED] company name, [TO BE COMPLETED] legal form (e.g. S.r.l., an Italian limited liability company), registered office at [TO BE COMPLETED] registered office address, Italy, VAT number [TO BE COMPLETED] VAT number, PEC (certified email) [TO BE COMPLETED] PEC (certified email) address, email [email protected].

Data Protection Officer (DPO): none appointed, because our activities do not require one (GDPR Art. 37).

What data, why, and on what legal basis

1. Browsing data (server logs)

The website is hosted by Cloudflare (Cloudflare Pages). When you open a page, Cloudflare’s servers automatically receive your IP address, the date and time, the page requested, the result of the request and your browser type. We need this to show you the website, keep it running and protect it from abuse and attacks. Legal basis: our legitimate interest in keeping the website secure and working (GDPR Art. 6(1)(f)). We do not use it to profile you.

2. Emails you send us

Apart from the questionnaire, there are no contact forms on the website: email links open your own email app. If you write to us (for example to ask for a demo), we process your email address, name, firm and whatever you choose to tell us, to reply and arrange what you ask for. Legal basis: steps you ask us to take before a contract (Art. 6(1)(b)) or, for general questions, our legitimate interest in replying (Art. 6(1)(f)). Please do not send us data about your firm’s clients.

3. The “Tell us about your firm” questionnaire

In the questionnaire we collect your answers about how your firm works, to understand what firms need and improve Fiscoo. Legal basis: our legitimate interest in developing the product (Art. 6(1)(f)). If you do not leave contact details, your answers are not linked to your name; even so, please do not include personal data in your answers.

If you want us to get back to you, you also leave your firm’s name, your name, email, phone number (optional) and preferred time, and you check the privacy consent box. We use these details only to contact you about Fiscoo. Consent to be called at your phone number is separate and optional: if you don’t give it, we reply by email. Calls are made by a person: no automated calls and no text messages. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time by writing to us, without affecting what we did before.

To limit abuse, instead of your IP address we store a fingerprint of it: a keyed hash (HMAC-SHA-256) of your IP address combined with the date, which can’t be traced back to the address without the secret key [TO BE CHECKED] ASCOLTO_CHIAVE key set in production. We also use a hidden field that only automated programs fill in: if it is filled in, we store nothing. Legal basis: our legitimate interest in security (Art. 6(1)(f)). Answers are stored in a Cloudflare D1 database in the Western Europe region and can only be seen by authorized members of our team, through a password-protected staff area.

When you ask to be contacted, your contact details also reach our team in a notification email, sent through Resend or, if it is unavailable, through Gmail (see “Who receives your data”). We never sell these details or share them for anyone else’s purposes: only the providers listed below process them, on our behalf.

4. Downloading Fiscoo with your personal code

When you download Fiscoo with the code we gave your firm, we record the date and time, the file chosen, the result and a fingerprint of your IP address that changes every day (a keyed hash, HMAC-SHA-256, of the address and the date), linked to your firm’s code. This lets us limit attempts, count the downloads the code allows and help you if something goes wrong. The file isn’t on our servers: with a temporary signed link, our service redirects you to Fiscoo’s public release page on GitHub, which receives your IP address and your browser’s technical details (user agent) to deliver the file. Legal basis: steps you ask us to take before a contract (Art. 6(1)(b)) and our legitimate interest in security (Art. 6(1)(f)).

5. Browser storage

The website stores two small technical items in your browser. They are deleted when you close the tab and never reach us. Details are on the Cookie Notice.

Do you have to give us your data?

Browsing data is needed to show you the website. Everything else is optional: without contact details we cannot reply or call you back, and without a code you cannot download Fiscoo from the website.

How long we keep it

• Server logs: [TO BE COMPLETED] log retention set by Cloudflare for our plan, unless needed to investigate a crime or defend a legal claim.
• Emails: [TO BE COMPLETED] for example 24 months after our last contact; if your firm becomes a customer, for the length of the contract and then as long as Italian law requires (for example 10 years for accounting records, Italian Civil Code Art. 2220).
• Questionnaire, including contact details and the IP fingerprint: deleted automatically 12 months after you send it.
• Notification emails to our team with your contact details: [TO BE COMPLETED] for example 12 months.
• Database backups: Cloudflare D1 keeps a history of changes (Time Travel) for up to 30 days, so deleted data also disappears from it within 30 days.
• Download log: for as long as we work with your firm, and no more than 24 months.
• Browser storage: until you close the tab.

Who receives your data

We use these service providers, appointed as processors under GDPR Art. 28:

• Cloudflare, Inc. (United States): website hosting and content delivery network, server logs, the questionnaire and download databases.
• GitHub, Inc. (United States): hosts Fiscoo’s installer files and delivers them when you download with your code; it receives your IP address and your browser’s technical details (user agent).
• Resend, Inc. (United States): sends our team the notification email when you ask to be contacted.
• Google (Gmail, United States): sends the same notification if Resend is unavailable. To act as a processor, this needs a Google Workspace account covered by Google’s data processing agreement, not a personal Gmail account [TO BE CHECKED] fallback account and signed agreement.
• Our email provider, which receives the emails you send us: [TO BE COMPLETED] provider name and country.

Authorized people in our company, bound by confidentiality, also see the data, as do public authorities when the law requires it. We do not sell data or give it to anyone for their own marketing or advertising.

Transfers outside the European Union

• Cloudflare is a US company with a global network: your request may be served by the data center nearest to you, including outside the EU. Cloudflare participates in the EU-U.S. Data Privacy Framework, so transfers rely on the European Commission’s adequacy decision of July 10, 2023 (GDPR Art. 45). The questionnaire database is in the Western Europe region.
• GitHub, Inc. (United States), for download requests: [TO BE COMPLETED] safeguard used: Data Privacy Framework participation or Standard Contractual Clauses (GDPR Art. 46).
• Resend, Inc. (United States): [TO BE COMPLETED] safeguard used: Data Privacy Framework participation or Standard Contractual Clauses (GDPR Art. 46).
• Google (United States): [TO BE COMPLETED] safeguard used: Data Privacy Framework participation or Standard Contractual Clauses (GDPR Art. 46).

You can ask us for a copy of these safeguards at our privacy address.

Automated decisions

We make no decisions based solely on automated processing, and we do no profiling (GDPR Art. 22).

Your rights under the GDPR

Wherever you live, you can ask at any time to access, correct or delete your data, to restrict its use or to receive it in a portable format, and you can object to processing based on our legitimate interest (GDPR Arts. 15–22). Where we rely on your consent, you can withdraw it at any time (Art. 7). Write to [email protected]: we reply within one month (extendable by two months for complex requests), and we may first ask you to confirm your identity.

If you believe we are breaking the GDPR, you can complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it), Piazza Venezia 11, 00187 Rome, Italy, or to the authority of the EU country where you live or work (Art. 77).

Children

The website is meant for professionals and firms. It is not directed to children under 16, and we do not knowingly collect personal information from them, including from children under 13 as covered by the Children’s Online Privacy Protection Act (COPPA). If you believe a child has given us information, contact us and we will delete it.

What about data in the Fiscoo app?

This policy covers the website. In the app, client data and documents the firm processes stay on the firm’s own computers or server, and the firm is their controller: they aren’t sent to our servers or to outside AI services. The optional AI model runs on the firm’s computer. In its current version, the app connects to the internet only for these functions:

• Updates: the app checks for and downloads new versions from Fiscoo’s public release page on GitHub (GitHub, Inc., United States), which receives the IP address and the app’s technical details, no firm data [TO BE CHECKED] update channel active in the distributed versions.
• Account recovery: if you ask for a code by email, the app sends the account email address and a random installation identifier to our recovery service on Cloudflare, which sends the email through Resend (or Gmail as a fallback).
• AI and voice models: when you choose to install them, the app downloads them from Hugging Face (Hugging Face, Inc., United States); only the file requests are sent, with the IP address. Questions, audio and documents stay on the computer.
• Weather and news on the home screen: the app sends the firm’s city to OpenStreetMap (Nominatim) to look up its coordinates, sends the approximate coordinates to the Norwegian Meteorological Institute (MET Norway), and reads the news feed of the Italian Revenue Agency (Agenzia delle Entrate). The firm can turn these off in the settings.
• Legal texts you choose to download from official sites (for example Normattiva, Gazzetta Ufficiale, the Revenue Agency, INPS, EUR-Lex), and links or emails you open yourself in your browser or email app.

The app sends no usage analytics or crash reports [TO BE CHECKED] list to be rechecked with every app version. Any processing linked to licensing, updates and support is governed by the contract with the firm: [TO BE COMPLETED] any GDPR Art. 28 agreement with the firm.

US State Privacy Notice

This section supplements the policy above for residents of US states with comprehensive privacy laws (for example California, under the CCPA as amended by the CPRA), to the extent those laws apply to us. [TO BE CHECKED with a lawyer]: which state laws actually apply to the company (revenue and volume thresholds)

Categories of personal information collected in the last 12 months

• Identifiers: name, email address, phone number, IP address (in server logs) and a fingerprint of the IP address.
• Professional information: your firm’s name and your answers about how it works.
• Internet activity: pages requested, date and time, browser type (server logs).
• Commercial information: the log of Fiscoo downloads linked to your firm’s code.
• We collect no sensitive personal information, no precise geolocation and no inferences to build a profile about you.

Sources and purposes

We get this information from you (emails, the questionnaire, the download code) and automatically from your browser (logs). We use it for the purposes described above: replying to you, calling you back if you ask, understanding what firms need, running and securing the website, and complying with the law. We disclose it only to the service providers listed above, for these purposes. How long we keep each category is listed above.

No sale, no sharing, no targeted advertising

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. We have not done so in the last 12 months, including for consumers under 16. We honor Global Privacy Control (GPC) signals: there is nothing to opt out of, because we neither sell nor share personal information, but we still treat a GPC signal as a request not to. We do not track you across websites, so a “Do Not Track” signal does not change anything either. We do not disclose personal information to third parties for their direct marketing purposes.

Your rights and how to use them

You can ask to know what personal information we have and how we use it, to get a copy, to correct it and to delete it. Email [email protected]: we operate online only, so email is how to submit a request. We confirm receipt within 10 business days and respond within 45 days (we may extend this once by another 45 days, and we’ll tell you if we do). To protect you, we verify your identity by matching the details you give us with those we hold. If we decline your request, we’ll explain why and you can appeal by replying to our email.

You can use an authorized agent: we’ll need your signed written permission (or a power of attorney), and we may ask you to confirm your identity directly with us. We will not discriminate against you for exercising any of these rights.

Changes

If we change how we handle data, we’ll update this page and the date at the top. If the changes are significant and we have your contact details, we’ll tell you in advance.