Privacy Policy

1. Who processes your data

The data controller is Bussolari Alessio, Via del Prete 121, 47841 Cattolica (RN), Italia, VAT no. 02037590383, tax code BSSLSS89L17D548E.

For any request about your data you can write to hello@scontino.com or by certified email to alessio.bussolari@pec.it. We have not appointed a Data Protection Officer, because none of the cases set out in Article 37 of the GDPR applies.

2. What data we collect

We only collect the data needed to let you use the site and to reply to you. We do not buy contact lists and we do not enrich your data with information taken from other sources.

• Data you send us through the contact form: name, email address, subject (optional) and the text of your message.
• Browsing data logged automatically by the servers: IP address, date and time of the request, page requested, browser and operating system type, referring page.
• Account data, if you decide to sign up: registration happens on app.scontino.com and covers your email, encrypted password, billing details, and the Telegram channels and the Amazon Associates or AliExpress Affiliate accounts you connect. Signing up is optional; if you do, these data are needed to provide the service and without them we cannot activate it.
• Clicks on the links the service publishes on connected channels: date and time, device type, browser, referring page, any campaign tags (utm) and a pseudonymous code derived from the IP address with a secret key, which does not make it anonymous. They concern the people who read the channel and are used to show statistics to the channel owner.
• If you accept them in the banner: visit statistics and session recording, described further down this page.

3. Why we process it and on what legal basis

Every processing activity has a precise purpose and a legal basis that justifies it.

• Replying to the requests you send through the form or by email: pre-contractual steps and our legitimate interest in answering people who write to us (Art. 6.1.b and 6.1.f GDPR).
• Operate the website and protect it from abuse and attacks: our legitimate interest in providing a secure, functional service (GDPR art. 6.1.f).
• Providing the service to people who sign up, managing subscriptions and payments: performance of the contract (Art. 6.1.b GDPR).
• Showing service users how many clicks their published links receive: legitimate interest in offering statistics on how well the channel works, using pseudonymised click data (Art. 6(1)(f) GDPR).
• Issuing and keeping tax documents: legal obligation (Art. 6.1.c GDPR).
• Measuring visits and recording sessions to improve the site: your consent, which you can withdraw at any time (art. 6.1.a GDPR).

We do not profile you, we do not make automated decisions that produce legal effects on you, and we do not use your data for advertising.

4. Statistics and session recording

We always collect technical errors on the site: they help us fix faults, without cookies and without personal data. Statistics and session recording, instead, start only if you accept them in the banner, and they are two separate choices.

We run them with CloseYourIt (closeyour.it), our own monitoring service, on Hetzner servers in Germany. We do not use them for advertising and we do not hand them to anyone.

• Statistics: page visited (without the address parameters), referring page, any campaign tags (utm) and loading times. Visitors are counted with an anonymous code that the server computes and that changes every day. No cookies.
• Session recording: clicks, scrolling and movements on the page. All texts and all fields are masked before they leave your browser: the recording shows neither what you type nor what you read.
• The sign-in and sign-up pages are never measured or recorded.
• Legal basis: your consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code). If you say no, the site works just the same.

You can withdraw your consent at any time, even for just one of the two, with the “Change preferences” button on the Cookie page. Withdrawal stops collection at once and does not affect what was collected before.

5. Who we share data with

We do not sell your data and we do not pass it to third parties for marketing purposes. It is accessed only by the providers that help us run the service, appointed as data processors under Article 28 of the GDPR:

• Hetzner Online GmbH, Germany: hosting of the servers that run the site and the application, with data centres in the European Union.
• Stripe Payments Europe Ltd., Ireland: handling of payments and subscriptions in the application. Card details are processed directly by Stripe and never pass through our systems. Stripe may also process them in the United States through Stripe, LLC.
• Plus Five Five, Inc. (Resend), United States: sending the application's service emails, such as address confirmation and subscription notices.
• Cloudflare, Inc., United States: receives the emails you write to our addresses and forwards them to our mailbox.
• Google Ireland Limited, Ireland, with Google Workspace: our email provider, where we receive and store the messages you send us. Google may also process them in the United States through Google LLC.

We may also share data with public authorities or the courts where the law requires it.

6. Transfers outside the European Union

Our servers are in the European Union. Some providers also process data in the United States: Stripe, LLC, Plus Five Five, Inc. (Resend), Cloudflare, Inc. and Google LLC. All of them take part in the EU-U.S. Data Privacy Framework, which the European Commission found adequate in its decision of 10 July 2023 (Art. 45 GDPR). You can ask us for a copy of the safeguards in place by writing to hello@scontino.com.

7. How long we keep it

We keep data only for as long as we need it for the purpose we collected it for.

• Messages sent through the contact form: 24 months from our last reply, then deleted.
• Server access logs: 12 months at most.
• Account and subscription data: for the whole duration of the relationship and, for tax documents only, for the following 10 years required by law.
• Clicks on published links: as long as the short link or the product they refer to exists, then deleted with it. There is no automatic deletion after a fixed period.
• Visit statistics: 12 months. Session recordings: 30 days.

8. Your rights

You can ask us at any time to access your data, correct it, erase it, restrict its processing, receive it in a machine-readable format or transfer it to another controller. You can object to processing based on our legitimate interest and, where processing is based on consent, withdraw it at any time without affecting what was done before.

To exercise your rights write to hello@scontino.com: we reply within one month. If you believe the processing breaches the GDPR you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of the country where you live.

9. How we protect data

The site is served only over an encrypted connection (HTTPS). Access to the servers is limited to the people who need it and protected by personal keys; account passwords are stored encrypted and cannot be read, not even by us.

No measure is foolproof: if a data breach occurred with a high risk to your rights, we will tell you as required by Article 34 of the GDPR.

10. Minors

The service is not aimed at people under 18 and we do not knowingly collect their personal data. If you notice that a minor has sent us data, write to hello@scontino.com: we will delete it without delay.

11. Changes to this policy

We may update this policy when the service, our providers or legal obligations change. The version in force is always the one published on this page, with the last update date at the top. If the changes are significant we will flag them on the site or by email.