Privacy Policy

1. Data Controller

The data controller is:
DIDIWEB DI DONNA MICHAEL
P.IVA 12288510964 — C.F. DDNMHL92R09B300B
Registered office: Via Parma 48, 20025 Legnano (MI), Italy
Email: michael.didonna.92@gmail.com
Phone: +39 392 571 4291

The Data Controller has not appointed a Data Protection Officer (DPO), as there is no requirement under Art. 37 GDPR. This privacy policy applies to the website vela.ddweb.it and the mobile app "Vela".

2. Vela's dual role

Vela processes personal data in two distinct roles:

• As an independent Data Controller, for the data of its registered users (business owners using the service). This is the subject of this privacy policy.
• As Data Processor (art. 28 GDPR), per i dati dei visitors dei siti creati dagli utenti (es. chi compila un modulo di prenotazione). In quel caso il titolare è l'utente proprietario del sito e i rapporti sono regolati dall'Data Processing Agreement (DPA).

3. Data collected

Registration and account details: first name, last name, date of birth, email, phone number, password (stored encrypted with Argon2ID), language.

Business information (mostly meant to be published on the website you create): business name, description, address, contact details, opening hours, price list, FAQs, uploaded content and images.

Billing and tax details: name or company name, VAT number, tax code, SDI code, certified email (PEC), address, contact details. Upon payment, these are locked into a snapshot for each invoice issued.

Payment details: your card details are not stored on our systems: they are entered and handled directly by Stripe. We only receive non-identifying details (card network, last 4 digits, expiry date) and technical subscription IDs.

Mobile app: in addition, the app processes the push notification token (Firebase), minimal technical device information (model, platform, app version), any photos uploaded by the user, and an authentication token saved on the device. Camera and notification permissions are optional and can be turned off at any time in your device settings.

Technical and security data: IP address, user-agent, visited pages, application and error logs, AI service call logs, administrative action logs, cookie consent logs, anti-abuse data (rate-limiting, IP bans). In website visit statistics, IP addresses are recorded only in hashed form, never in plain text.

4. Purposes and legal bases

• Providing the service (account, site creation and publishing including via AI, bookings, notifications, support) — contract performance, Art. 6.1.b
• Billing and payments — contract performance (Art. 6.1.b) and legal tax/accounting obligations (Art. 6.1.c)
• Security and abuse prevention (logs, rate-limiting, bans) — legitimate interest, Art. 6.1.f
• Analytics and campaign tracking (Google Ads, Meta Pixel, Microsoft Clarity) — consent via cookie banner, Art. 6.1.a
• Marketing communications (if enabled) — revocable consent, Art. 6.1.a

Providing the data needed for the service is mandatory: without it, you cannot register or use the service.

5. Recipients and providers

To run the service, we rely on third-party providers who process data on our behalf:

Provider	Purpose	Location
Serverplan S.r.l.	Application and database hosting; transactional email	Italy (EU)
Stripe	Payments, subscriptions, customer portal (card details are entered directly on Stripe)	USA*
Google — Gemini AI	Text and image generation using artificial intelligence (prompts with business details)	USA*
Google — Firebase Cloud Messaging	App push notifications	USA*
Anthropic — Claude AI	Backup AI provider	USA*
Twilio	Sending the OTP code via SMS during sign-up	USA*
Telegram	Internal operational notifications to the Data Controller (e.g., payment alerts)	Non-EU*
GB Software / Sistema di Interscambio	Transmission of electronic invoices (legal requirement)	Italy (EU)

Platform data is stored on servers in Italy. We do not sell or share personal data with third parties for marketing purposes. Data may be shared with public authorities when required by law.

* Transfers to non-EU providers comply with Chapter V of the GDPR, based on adherence to the EU-U.S. Data Privacy Framework and/or the EU Commission's Standard Contractual Clauses. You can request a copy of these safeguards from the Data Controller.

6. Data retention

General rule: data is kept for the entire duration of the relationship. When an account is deleted, your business data is permanently removed (website, images, price list, bookings, support, chat, billing info) and the subscription is cancelled; the account identity is deactivated and pseudonymised. Specifically:

• Invoices and tax data: 10 years (legal obligation; the right to erasure does not apply to tax documents, Art. 17.3.b GDPR)
• Bookings received on websites: for the duration of the account; you can delete them at any time (permanent deletion); completely wiped when the account is closed
• Visitor statistics (hashed IP): for the duration of the relationship, as they are part of the service (analytics dashboard)
• Technical, security, and audit logs: for the time necessary for security, troubleshooting, and accountability
• AI call logs: for the time necessary to track usage and for accounting purposes
• OTP codes: deleted within 24 hours — Push tokens: deleted upon logout, uninstallation, or invalidation

7. Your Rights

Under Articles 15-22 GDPR, you have the right to: access, rectify, erase ("right to be forgotten"), restrict, and port your data, as well as object to processing based on legitimate interest and withdraw your consent at any time.

To exercise your rights, email us at michael.didonna.92@gmail.com: we will get back to you without undue delay and within one month at most. You can also submit an account deletion request directly from the app and dashboard, which we process within 48 business hours.

For your own safety, before completing the deletion we may call you (at the number linked to your account) or email you to verify your identity and confirm your request: account deletion cannot be undone, and this step prevents accidental requests or actions by unauthorized third parties. We will only contact you for this specific reason.

8. Vela as Data Processor

Per i dati dei visitatori raccolti tramite i moduli dei siti creati con Vela (prenotazioni, richieste di contatto), il titolare del trattamento è l'utente proprietario del sito e Vela agisce come responsabile ai sensi dell'art. 28 GDPR, secondo l'Data Processing Agreement (DPA). L'utente è tenuto a fornire ai propri visitatori una propria informativa.

9. Uploaded Content and Sensitive Data

Vela does not ask for special categories of data (Art. 9 GDPR). You are responsible for any content entered into free-text fields. If you choose to handle sensitive data (such as health-related details) through your website, you are responsible for ensuring an appropriate legal basis as the independent data controller.

10. Artificial Intelligence

The platform uses AI to generate content (texts, images, layouts) upon user request: these features are always clearly labeled as such ("Create with AI"). Based on the terms of the paid APIs used, Google and Anthropic do not use submitted data (prompts and content) to train their models. No automated decisions with legal or similarly significant effects on data subjects are made (art. 22 GDPR).

11. Security

• AES-256-GCM encryption for sensitive data and cache; mandatory HTTPS connections
• Passwords hashed with Argon2ID; secure sessions (HttpOnly, SameSite, Secure); CSRF tokens on POST operations
• Ability to log out from all devices ("Log out from all devices")
• Rate limiting and automatic ban of suspicious IPs; hashed IPs in analytics

12. Cookies

Per informazioni dettagliate sui cookie utilizzati, consulta la nostra Cookie Policy.

13. Changes to this policy

We reserve the right to modify this policy. Any changes will be posted on this page with the updated date; for major changes, we will notify you by email.

14. Supervisory Authority

If you believe the processing of your data violates the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it).