Privacy notice

Who processes the data

The data controller is the owner of the Fribbynetwork network: their details (business name, VAT number, tax code and REA number) are in the image below.

For privacy questions the quickest way is a support request, choosing “Privacy and data”. If you can no longer sign in to your account, write to the address in the image below.

The details and the address are images to keep them away from programs that harvest addresses: if you use a screen reader and cannot read them, open a support request and we will send them to you as text.

Your account

When you sign up you give us:

• your email address, which is also the name you sign in with;
• your display name, the one you choose;
• the language you want for pages and emails;
• the confirmation that you are old enough to use online services on your own (minimum age: 14 in Italy);
• if you like, the choice to get the Fribbynetwork news: only messages about our services and products, no ads from others;
• your password, which we store transformed so that nobody, not even us, can read it.

If you turn on two-step verification (2FA) we also keep what we need to check it: the secret of the app that generates the codes or the public key of your passkey. We keep the date you signed up and the rights of your account, for example a PRO subscription or test mode.

Legal basis: the service you ask for by signing up (Art. 6(1)(b)).

Sign-ins and security

To protect your account we record sign-ins and important changes: successful and failed sign-ins, sign-outs, changes of password, email and 2FA. For each of them we keep the date and time, the site where you signed in and the IP address. They help us find out if someone is trying to get in instead of you and stop abuse.

• Sign-ins are deleted after 90 days.
• We keep the date and IP address of your sign-up as long as the account exists, because they prove when and where it was created.

The sign-up page and “Forgot Password?” have the “I’m not a robot” box (ALTCHA): your browser solves a small calculation, with no pictures to recognise. It all runs on our server: we use no services from others and none of your data reaches anyone.

Legal basis: our legitimate interest in the security of accounts and of the service (Art. 6(1)(f)).

Support requests and history

If you write to support we keep the subject, the messages, the images you attach and our replies, to follow up your request.

• The text and images of the messages are deleted 90 days after the request is closed.
• After that only a trace remains: number, subject, dates, status and who wrote when. We keep it as long as the account exists, so we know what already happened if you write again.

We also keep a history of what we do on your account: rights changed, suspensions, replies, decisions on requests made to the sites (for example a gat.to prefix), messages we send you. It stays as long as the account exists; if you delete your profile the entries remain only as an internal record of our work, without your email and without any link to you.

Legal basis: answering your request and the service (Art. 6(1)(b)), our legitimate interest in keeping track of the work done on accounts (Art. 6(1)(f)).

The emails we send you

We write to you for the service: address confirmation, password recovery, support replies, decisions on requests made to the sites, messages about your account on the sites (for example a blocked gat.to link), messages about the suspension or closure of the account and the confirmation that your profile has been deleted. Everyone gets these, because they are needed to use the account.

Fribbynetwork news

If you choose to, we also write to you when there is something new in our services: a new service or feature, the opening of subscriptions. Only our own news, never ads from others. There is no fixed schedule: months can go by without any email and then two can arrive in a month, when we launch something.

You get them only if you tick the box, at sign-up or later from your personal page. You can stop them whenever you like: from your personal page, from the account settings or with the link at the bottom of every email, without signing in. We save each of your choices with its date, so we can prove you made it.

All emails are sent from our mail server, from an address that does not read replies.

The mail server records who each email was sent to and when, to understand delivery problems: these logs are deleted after about 5 weeks.

Legal basis: the service (Art. 6(1)(b)); for the news your consent (Art. 6(1)(a)), which you can withdraw at any time.

The sites of the network

With the account you sign in to all the sites of the network without signing in again: when you enter a site, the site receives from us your email, display name, language and the rights of your account. What you do on a site (for example the links you create on gat.to) is kept by that site, under its own privacy notice.

To follow up your requests and the history of your account the portal reads from the sites what concerns you, for example your gat.to prefix or short addresses; on behalf of the sites it also sends their messages by email.

Subscriptions and payments

When they arrive:

• payments are handled by Stripe: you enter your card details on Stripe and they never reach us;
• from Stripe we receive the payment and subscription codes, amounts, dates and status, the country of the card, its brand and last 4 digits (these only to show them to you);
• at each purchase we ask for the country where you live, even without an invoice: VAT rules for online services depend on where the buyer is and the law requires us to be able to prove it, with the declared country and the card country;
• we keep what you bought, when it starts and when it expires, which version of the terms of sale you accepted and when, and the discounts and compensation you receive;
• if you ask for an invoice: first name and surname or company name, tax code or VAT number, address and, for Italian businesses, SDI recipient code or PEC (certified email). You enter them on the portal, not on Stripe, and they stay saved on your personal page together with your country, for renewals and future purchases, until you remove them or delete your profile. Without an invoice we do not need these details.

Payments and invoices are kept for 10 years, as the law requires, even if you delete your profile. The terms of sale are on the subscriptions and purchases page.

Legal basis: the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)).

Cookies

We only use technical cookies, which are needed to sign you in and remember your language: the law does not require consent for these.

• The portal session, as long as you stay signed in.
• The language you chose, for one year.
• Those of the sign-in pages (Keycloak), which keep the single session for all the sites open.

No profiling cookies, no statistics from others, no social network pixels.

Who sees the data besides us

• The server provider (OVH: the company is French, the server is in Germany), which hosts the machines.
• The sites of the network you enter, for what is needed to sign you in (see above).
• Your email provider, which receives the emails we send you.
• When subscriptions arrive: Stripe (Stripe Payments Europe, Ireland), for payments, which has its own privacy notice for card details and fraud prevention; Aruba (Italy), for electronic invoices, which go through the Exchange System (SDI) of the Italian Revenue Agency.
• Nobody else: we do not sell or give data to anyone.

Where the data is

On our servers in Germany: no data leaves the European Union.

Every night we make a backup copy of the database and keep the last 14 (two weeks). The whole machines are copied at least once a day to our backup server in Italy and each copy is kept for at most 90 days. Deleted data also disappears from the copies when they are replaced by new ones.

The server also records the requests it receives, for security and to understand faults: these logs are deleted after at most 90 days.

Your rights

You can ask us for access to your data, rectification, erasure, restriction of processing, portability and you can object to processing based on legitimate interest (Arts. 15-22 GDPR). You can do many of these things yourself, from your personal page:

• see and download your data: “Download my data” gives you everything we know about you, as a page to read and as a file;
• correct it: name, email, language and password are changed from “Password, 2FA and passkeys”;
• withdraw your consent to the news: with the switch on your personal page or with the link at the bottom of every email;
• erase it: “Delete my profile” deletes the account and what the portal knows about you. gat.to also deletes your account, prefix, short addresses, requests and notes on links; for the links you choose whether to keep them working without your name or delete them. The addresses of deleted links stay blocked for a while (currently 90 days) before becoming available again: of these gat.to keeps only the word and the date.

For anything else write to us: we reply within one month. If you think the processing breaches the Regulation, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Minimum age and changes

The account is for people who are at least 14 years old, the age required in Italy to use online services on your own; it may be different in other countries. If we notice that an account belongs to a younger person, we delete it.

If we change anything in this privacy notice, the date at the top of the page changes; for important changes we write to you first.