Privacy Policy

1. Data controller

The personal data controller is CreaPreventivi. To exercise your rights or ask about privacy, contact us through the Contact us.

2. Data collected

We collect the following types of data:

• Registration data: name and email address, required to create and manage your account.
• Usage data: quotes, clients, products, services and companies entered into the platform.
• Payment data: processed directly by Stripe; we do not store credit card details.
• Technical data: IP address, browser type and pages visited, for analytics and security purposes.
• Cookies: essential cookies and analytics cookies (with consent). See our Cookie Policy.

3. Purposes and legal basis of processing

4. Data sharing

Your data may be shared with:

• Stripe Inc. , for payment processing (Privacy Policy: stripe.com/privacy)
• Cloud infrastructure providers , for hosting and secure data storage
• Competent authorities , when required by law

We do not sell your personal data to third parties.

5. Data retention

Account data is retained throughout the contractual relationship and for 5 years after termination for tax compliance. Anonymized browsing data is retained for 13 months. If the account is deleted, data is removed within 30 days.

6. Your rights (GDPR)

Under EU Regulation 2016/679 (GDPR), you have the right to:

• Access , obtain confirmation of processing and a copy of your data
• Rectification , correct inaccurate or incomplete data
• Erasure , request deletion of your data ('right to be forgotten')
• Restriction , restrict processing in certain cases
• Portability , receive your data in a structured format
• Objection , object to processing for legitimate interests or marketing
• Withdrawal of consent , at any time without affecting the lawfulness of previous processing

To exercise these rights, contact us through the Contact us. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

7. International transfers

Some service providers (e.g. Stripe) may process data outside the European Economic Area. In such cases, we ensure transfers comply with GDPR safeguards, including adequacy decisions and Standard Contractual Clauses.

8. Security

We adopt appropriate technical and organizational measures to protect your data against unauthorized access, loss or disclosure, including SSL/TLS encryption and role-based access controls.

9. Changes to the Privacy Policy

We reserve the right to update this Privacy Policy. Changes will be communicated by email and published on this page with the update date.