Privacy policy
This page explains how we handle the data of people who have an account on Preventivatoree. If you received a quote and want to know how your data as a reader is handled, read the notice for people who receive a quote.
Last updated: 14 October 2026
Data controller
Margherita Mariotti, based in Via Natale Tamburini 54, Lamporecchio (PT), Italy, VAT number 07070020487, email hello@preventivator.ee.
For the personal data of your clients that you enter into the service you are the controller, and we are the processor: the Data processing agreement applies.
What data we collect
- Account data: email address, name, chosen language, the name of the business, and the date and versions of the terms and of the data processing agreement you accepted.
- Google sign-in data: if you sign in with Google we receive from Google the Google account identifier, name, email address and profile picture. We do not receive your password.
- Passkey data: if you add a passkey we keep its public key, the name you give it, the type of authenticator and the dates. Your fingerprint, face or screen lock never leave your device.
- Session data: when you sign in we store the session, with the IP address and browser used and the dates of creation and expiry. It keeps you signed in and protects the account.
- Business data you enter: letterhead, logos and pictures, texts, price list, quotes, client cards and their notes. They also contain data of your clients, handled as described above.
- Billing data: name or company name, address, tax code or VAT number, SDI code or PEC, and details of payments and invoices. Card data is handled by Stripe and does not pass through us. A business based outside Italy buys through Link, LLC, Stripe's reseller, which handles its payment and billing data as an independent controller under its own privacy policy; we receive only the name, the country and the state of the subscription.
- Email data: we send sign-in links and messages about the service (for example about the end of the trial). The sending provider records the outcome of delivery.
- AI assistant data: if you connect an assistant we keep the authorised connection (with encrypted keys) and the date of last use.
Why we use it and on what basis
| Purpose | Legal basis (Regulation (EU) 2016/679) |
|---|---|
| Create the account, let you sign in and provide the service | Performance of the contract (art. 6(1)(b)) |
| Collect payment, issue invoices, meet tax and accounting duties | Performance of the contract and legal obligation (points b and c) |
| Security of the account and of the service, preventing abuse, defending legal claims | Legitimate interest of the controller (point f) |
| Messages about the service: trial ending, changes to the terms, support | Performance of the contract (point b) |
We do not advertise, we do not sell your data and we do not use it for automated decisions about you. We send no marketing messages without your consent.
Providing account and billing data is necessary to use the service: without it we cannot open it or invoice.
How long we keep it
- Account and business data: while the account is active, and then for 12 months after the end of the trial or of the subscription, so that you can pick up where you left off. Then we delete it.
- Sessions: until they expire or you sign out.
- Sign-in links by email: valid for 15 minutes.
- Passkeys: until you remove them from the dashboard, or until the account is deleted.
- Billing data and invoices: for the time the law requires for tax and accounting records, usually ten years.
- Reading statistics of quotes: 13 months, as explained in the notice for people who receive a quote.
Who else handles the data
We rely on these providers, who process data on our behalf. The list is also kept in the Data processing agreement.
| Provider | What it is for | Where and safeguards |
|---|---|---|
| Cloudflare, Inc. | Hosting, database (D1) and image storage (R2) | Database in Western Europe. US company: EU-U.S. Data Privacy Framework and standard contractual clauses |
| Google LLC (Google Ireland Limited) | Sign-in with Google | Ireland and USA. Data Privacy Framework and standard contractual clauses |
| Resend, Inc. | Sending emails | European Union (Ireland); Resend is a US company. Data Privacy Framework and standard contractual clauses |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Payments and subscription | Ireland and USA. Data Privacy Framework and standard contractual clauses |
| TeamSystem (Fatture in Cloud) | Issuing and sending electronic invoices | Italy |
| Umami Software, Inc. (Umami Cloud) | Visit statistics of the presentation page | European Union (Germany) |
If you connect an AI assistant such as Claude, ChatGPT or Gemini, it is your provider and not ours: it acts on your instruction and you choose it. We send it only what your assistant asks for through the connection; from then on the terms of its provider apply.
We also disclose data to whoever the law requires (for example tax and judicial authorities) and to advisers bound by confidentiality, such as the accountant. For transfers to the United States we rely on the Data Privacy Framework where the provider takes part in it, and otherwise on the European Commission's standard contractual clauses.
Visits to the presentation page
This part also concerns people without an account. On the presentation page of Preventivatoree (/it/ and /en/), and on no other page, we count visits with Umami Cloud, to know how many people arrive, from which site and with which device.
Umami writes no cookies and nothing else in the browser, and does not follow people from one site to another. It receives the address of the page, the referring site, browser, operating system, kind of device, screen size, language and country. It does not store the IP address: it uses it, together with the browser, to tell apart visits of the same day, and from that only an anonymous identifier remains.
The legal basis is our legitimate interest in knowing how the page is used (art. 6(1)(f)). The data is kept for 6 months. You can object by writing to hello@preventivator.ee.
Cookies
We use only technical cookies, needed to make the service work:
pv.session_token: keeps your session open after you sign in;pv.session_data: a signed, short-lived copy of the session data, so the database is not queried on every request;pv_signed_in: holds no personal data and only tells the presentation page to show "Open dashboard" instead of "Sign in".
We use no profiling, advertising or analytics cookies. Technical cookies need no consent (art. 122 of the Italian Privacy Code and the Garante's guidelines of 10 June 2021), which is why there is no banner. The visit statistics of the presentation page use no cookies at all. You can delete them in your browser: you will just have to sign in again.
Your rights
You can ask us to access your data, correct it, delete it, restrict its processing, receive it in a machine-readable format, and object to processing based on legitimate interest (articles 15 to 22 of the Regulation). Write to hello@preventivator.ee; we answer within one month.
If you believe your data is being processed incorrectly, you can lodge a complaint with the Garante per la protezione dei dati personali, the Italian data protection authority, or with the supervisory authority of the EU country where you live or work.