ControvistoVerified by a person

Privacy Notice

Version of 20 October 2026 · English translation of 30 October 2026

This English text is a translation of the Italian Informativa privacy. In the event of any discrepancy between the two versions, the Italian version prevails.

Information provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”).

1. Who processes the data

For account data, login security data, subscription data and invoicing data, the controller is Alessandro Richard, an Italian sole proprietorship (ditta individuale) — Via Roma 123, 15020 Villadeati (AL), Italy — VAT no. IT10689390010 — certified e-mail (PEC) [email protected] — e-mail [email protected] (the “Provider”).

For the data that a firm enters in its register (matters, uses of AI, checks, the firm’s people), the controller is the customer firm; the Provider processes those data as a processor, on behalf of the firm, under the Data Processing Agreement under Article 28 GDPR.

2. What data

  • Account: e-mail address, password (stored only in a non-reversible encrypted form), two-step verification key, name, qualification, professional body and registration number (if provided), the firm the user belongs to, role.
  • Login security: for each device, a random identifier, the type of browser and operating system (e.g. “Chrome on Windows”), the date and time of the first and last login and of the last activity, and the login session identifier; the list of devices already used with the account (needed for the new-device login alert); a log of logins, logouts and automatic logouts for inactivity.
  • Subscription and invoicing: plan, status, invoicing name, VAT number or tax code (for customers outside Italy, the VAT number or business identification number of their country), the declaration that the customer is acting for business purposes, address, certified e-mail (PEC) or recipient code for electronic invoicing; the customer and subscription identifiers held by Stripe. Card details are processed only by Stripe: the Provider never sees them.
  • Register and seals: the data entered by the firm; for each seal, the SHA-256 fingerprint of the file and the name and size of the file. The file itself is never transmitted, not even when the seal is printed inside the PDF.
  • History: who made each change and when. Service e-mails sent (renewal notices and new-login alerts).
  • Technical data: service logs (IP address, date and time of requests) kept by the infrastructure providers for security purposes.

3. Purposes and legal bases

  • Providing the service, managing the subscription and sending renewal notices: performance of the contract (Article 6(1)(b) GDPR).
  • Invoicing and tax obligations: compliance with a legal obligation (Article 6(1)(c) GDPR).
  • Checking that customers outside Italy who buy a paid plan are business customers (for example, checking the VAT number in the European Commission’s VIES system): performance of the contract and compliance with tax obligations (Article 6(1)(b) and (c) GDPR).
  • Login security (two-step verification, two-device limit, new-login alert, access log), prevention of abuse, checking the professional registration declared by the user, and the establishment, exercise or defence of legal claims: legitimate interests of the Provider, of the firms and of the recipients of sealed documents (Article 6(1)(f) GDPR).
  • Public verification page: it shows anyone who has the code the name and qualification of the person who carried out the check, any verified professional registration, the name of the firm, the type of document, the AI tool, the outcome, the checks carried out, the dates, the fingerprint of the file and any revocation with its reason. This is the very purpose of the seal, which the user chooses to issue: performance of the contract and legitimate interest of the firm and of the recipient of the document in verifying where it comes from. The page does not show the file name or the matter reference and is not indexed by search engines.
  • Daily proof of date: only one fingerprint per day, calculated from all seals, is sent to the public OpenTimestamps calendars; it contains no personal data and no personal data can be derived from it.

4. Recipients of the data

  • Supabase Inc. — database, logins and service functions, with servers in the European Union; processor.
  • Cloudflare Inc. — website hosting and network protection; processor.
  • Aruba S.p.A. — mailbox from which the service e-mails are sent; processor.
  • Stripe Payments Europe Ltd. — payments; independent controller for payment data.
  • Accountant and electronic invoicing service, for tax obligations.

Some providers are based in the United States: transfers take place on the basis of the EU-U.S. Data Privacy Framework or of the standard contractual clauses adopted by the European Commission.

5. How long

  • Account, register, device and login data: for as long as the firm uses the service, on a paid plan or on the Free plan (after the end of the last paid period the firm stays on the Free plan); the register data of a firm on the Free plan are deleted after 24 months without any access, never earlier than 30 days after an e-mail notice to the owner of the firm. The owner may ask for an export or the deletion of the data at any time. Accounts not linked to any firm and not accessed for 30 days are deleted 7 days after a notice sent by e-mail (see the Terms of Use, section 8).
  • Public data of seals already issued and proof of date: at least 10 years from issue (ordinary limitation period under Article 2946 of the Italian Civil Code), because other people rely on those seals.
  • Invoicing data: 10 years (Article 2220 of the Italian Civil Code). Service e-mails sent: 180 days.
  • Technical logs: according to the providers’ policies, normally no longer than 90 days. Backup copies: according to their rotation cycle.

6. Your rights

You have the right to request access to your data, their rectification or erasure, the restriction of processing and data portability, and to object to processing based on legitimate interests. You can exercise these rights by writing to [email protected] or to the certified e-mail address [email protected]. For register data, the point of contact is the firm, which is the controller: the Provider helps it to respond. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU Member State where you habitually reside or work or where the alleged infringement took place.

7. Cookies and browser storage

The website does not use profiling cookies or third-party analytics tools. The service stores in the browser only what it needs in order to work: the login session, the random device identifier, the time of the last activity (for automatic logout) and the readability preferences, the last e-mail address used to sign in (cv_email), the chosen language (cv_lingua; cv_lingua_auto for the current session only; cv_lingua_da_salvare until the choice has been saved in the service) and the currency chosen for international prices (cv_valuta). The language is also saved in the service so that e-mails are sent in that language: in the account data when you sign up (for the confirmation and password reset e-mails) and in the database when you choose it with the selector or, if your browser is not in Italian, at your first sign-in after signing up. The free AI disclosure statement generator works entirely in your browser: nothing you select or type in it is sent to the Provider or stored.