Privacy policy for users
Draft, to be reviewed by a lawyer. This text is a first draft and is not in force yet. The parts [IN SQUARE BRACKETS] are details still to be filled in. The Italian version is the reference.
This page explains how we handle the data of people who have an account on Preventivatoree. If you received a quote and want to know how your data as a reader is handled, read the notice for people who receive a quote.
Draft of 13 October 2026
Data controller
[OWNER NAME], based at [ADDRESS], VAT number [VAT NUMBER], certified email (PEC) [PEC], privacy email [CONTACT EMAIL].
For the personal data of your clients that you enter into the service you are the controller, and we are the processor: the Data processing agreement applies.
What data we collect
- Account data: email address, name, chosen language and the name of the business.
- Google sign-in data: if you sign in with Google we receive from Google the Google account identifier, name, email address and profile picture. We do not receive your password.
- Passkey data: if you add a passkey we keep its public key, the name you give it, the type of authenticator and the dates. Your fingerprint, face or screen lock never leave your device.
- Session data: when you sign in we store the session, with the IP address and browser used and the dates of creation and expiry. It keeps you signed in and protects the account.
- Business data you enter: letterhead, logos and pictures, texts, price list, quotes, client cards and their notes. They also contain data of your clients, handled as described above.
- Billing data: name or company name, address, tax code or VAT number, SDI code or PEC, and details of payments and invoices. Card data is handled by Stripe and does not pass through us.
- Email data: we send sign-in links and messages about the service (for example about the end of the trial). The sending provider records the outcome of delivery.
- AI assistant data: if you connect an assistant we keep the authorised connection (with encrypted keys) and the date of last use.
Why we use it and on what basis
| Purpose | Legal basis (Regulation (EU) 2016/679) |
|---|---|
| Create the account, let you sign in and provide the service | Performance of the contract (art. 6(1)(b)) |
| Collect payment, issue invoices, meet tax and accounting duties | Performance of the contract and legal obligation (points b and c) |
| Security of the account and of the service, preventing abuse, defending legal claims | Legitimate interest of the controller (point f) |
| Messages about the service: trial ending, changes to the terms, support | Performance of the contract (point b) |
We do not advertise, we do not sell your data and we do not use it for automated decisions about you. We send no marketing messages without your consent.
Providing account and billing data is necessary to use the service: without it we cannot open it or invoice.
How long we keep it
- Account and business data: while the account is active, and then for [RETENTION PERIOD] after the end of the trial or of the subscription (suggested: 12 months), so that you can pick up where you left off. Then we delete it.
- Sessions: until they expire or you sign out.
- Sign-in links by email: valid for 15 minutes.
- Passkeys: until you remove them from the dashboard, or until the account is deleted.
- Billing data and invoices: for the time the law requires for tax and accounting records, usually ten years.
- Reading statistics of quotes: 13 months, as explained in the notice for people who receive a quote.
Who else handles the data
We rely on these providers, who process data on our behalf. The list is also kept in the Data processing agreement.
| Provider | What it is for | Where and safeguards |
|---|---|---|
| Cloudflare, Inc. | Hosting, database (D1) and image storage (R2) | Database in Western Europe. US company: EU-U.S. Data Privacy Framework and standard contractual clauses |
| Google LLC (Google Ireland Limited) | Sign-in with Google | Ireland and USA. Data Privacy Framework and standard contractual clauses |
| Resend, Inc. | Sending emails | USA [CHECK THE SENDING REGION]. Standard contractual clauses [CHECK] |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Payments and subscription | Ireland and USA. Data Privacy Framework and standard contractual clauses |
| TeamSystem (Fatture in Cloud) | Issuing and sending electronic invoices | Italy |
If you connect an AI assistant such as Claude, ChatGPT or Gemini, it is your provider and not ours: it acts on your instruction and you choose it. We send it only what your assistant asks for through the connection; from then on the terms of its provider apply.
We also disclose data to whoever the law requires (for example tax and judicial authorities) and to advisers bound by confidentiality, such as the accountant. For transfers to the United States we rely on the Data Privacy Framework where the provider takes part in it, and otherwise on the European Commission's standard contractual clauses.
Note for the lawyer: check the list of providers and each one's transfer safeguards, and Resend's sending region, before publication.
Cookies
We use only technical cookies, needed to make the service work:
pv.session_token: keeps your session open after you sign in;pv.session_data: a signed, short-lived copy of the session data, so the database is not queried on every request;pv_signed_in: holds no personal data and only tells the presentation page to show "Open dashboard" instead of "Sign in".
We use no profiling, advertising or analytics cookies. Technical cookies need no consent (art. 122 of the Italian Privacy Code and the Garante's guidelines of 10 June 2021), which is why there is no banner. You can delete them in your browser: you will just have to sign in again.
Your rights
You can ask us to access your data, correct it, delete it, restrict its processing, receive it in a machine-readable format, and object to processing based on legitimate interest (articles 15 to 22 of the Regulation). Write to [CONTACT EMAIL]; we answer within one month.
If you think your data is handled improperly you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).