Privacy Policy

1. Data Controller

2. Data We Collect

We collect the following categories of personal data:

• —Account data: name, email address, encrypted password, optional profile photo.
• —Builder subscription billing: Stripe customer and subscription identifiers, billing status and related subscription records.
• —Historical Product Purchase data: order history and associated payment, refund and legacy payout records.
• —Direct collaboration data: accepted terms, agreed GBP prices, progress and delivery records. An agreed price is not proof of a payment.
• —Usage data: pages visited, products viewed, search queries, session duration, IP address, browser and device type.
• —User-generated content: product listings, Demand requests, messages, attachments, versioned proposals, reviews and other content you submit.
• —Cookie and tracking data: session tokens, preference identifiers, and analytics signals (see Section 8).

3. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your data on the following legal bases:

• —Contract performance: to provide marketplace and direct collaboration features, manage your account and Builder subscription, and maintain historical purchase records.
• —Legal obligation: to comply with applicable EU and Italian laws (e.g. invoicing, anti-fraud).
• —Legitimate interest: to improve platform performance, detect abuse, and ensure security.
• —Consent: for non-essential cookies and marketing communications. You may withdraw consent at any time.

4. How We Use Your Data

• —To create and manage your account and authenticate your sessions.
• —To manage recurring Builder subscription billing and retain historical Platform purchase/payment records. Direct collaboration payments are arranged by participants and are not processed or verified by the Platform.
• —To display your public profile and product listings to other users.
• —To support account verification and password reset, and provide in-app notifications about your activity.
• —To analyse usage patterns and improve the platform.
• —To detect and prevent fraud, abuse, and violations of our Terms.

5. Third-Party Processors

We share your data with the following sub-processors:

• —Supabase Inc. (USA) — database, authentication, and file storage. Data stored in EU regions where available.
• —Stripe Inc. (USA) — recurring Builder subscription billing and historical Platform purchase/payment records. Direct collaboration payments are arranged between participants.
• —Vercel Inc. (USA) — hosting, edge network, and anonymous analytics.

All transfers to third countries are governed by Standard Contractual Clauses (SCCs) approved by the European Commission.

6. Data Retention

Account data is retained for the duration of your account plus 2 years after deletion, unless a longer period is required by law (e.g. fiscal obligations require 10 years for invoices). Usage logs are anonymised after 90 days. You may request earlier deletion subject to legal retention obligations.

7. Your Rights

Under the GDPR, you have the right to:

• —Access: obtain a copy of the personal data we hold about you.
• —Rectification: correct inaccurate or incomplete data.
• —Erasure ("right to be forgotten"): request deletion of your data where no legal basis for retention exists.
• —Data portability: receive your data in a structured, machine-readable format.
• —Object: to processing based on legitimate interests or for direct marketing.
• —Restriction: limit how we process your data while a dispute is resolved.
• —Withdraw consent at any time for processing based on consent.

To exercise any of these rights, email us at giuseppe.gargiulo@innovaconsulting.ai. We will respond within 30 days. You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali) at garanteprivacy.it.

8. Cookies

We use the following categories of cookies:

• —Necessary: session tokens and authentication cookies. These cannot be disabled as they are required for the service to function.
• —Analytics: the application includes Vercel Analytics for aggregate site-use information.
• —Marketing preference: the cookie banner records your selected preference.

The cookie banner records your preferences. You can also manage cookies and local storage through your browser settings.

9. Security

We apply industry-standard technical and organisational measures to protect your data: encryption in transit (TLS 1.3), encryption at rest, row-level security on the database, and regular security reviews. However, no system is 100% secure. In the event of a breach that poses a high risk to your rights, we will notify you and the relevant supervisory authority within 72 hours as required by the GDPR.

10. Changes to This Policy

11. Contact