Privacy notice · Data portal (TPD)
This notice covers the data we process about you and your organisation when you use the data portal and the TPD API. It is separate from the fake or fate app notice, which covers the people who play. The TPD dataset you buy is anonymous: it contains no personal data of the app's users.
1. Data controller
Carlo Di Silvestro, Via Dione 71, 96100 Siracusa (SR), Italy. Contact: privacy@fakeorfate.app. A data protection officer has not been formally appointed under Art. 37 GDPR.
2. What we process
Organisation details (company name, VAT number), contact and sign-in data of portal users (email, password stored only as a hash, optional second factor), technical session data (refresh tokens stored as hashes), the activity log (action, author, IP address, time), the log of exports made through the API (key used, filters, rows delivered), and billing data handled by our payment provider.
3. Why, and on what legal basis
To provide the service and perform the licence agreement (Art. 6(1)(b) GDPR): authentication, key issuance and revocation, quotas and usage limits, billing. For our legitimate interest in service security (Art. 6(1)(f)): activity log, IP addresses, protection against abuse and unauthorised access. To comply with legal obligations (Art. 6(1)(c)): tax and accounting records.
4. How long we keep it
Account and organisation data: for the duration of the relationship and 12 months after it ends. Activity log: 12 months. Export log: 24 months. Tax records: 10 years, as required by law.
5. Who we share it with
With the providers that let us run the service, all appointed as processors: Railway (application and database hosting), Cloudflare (network and object storage), Amazon SES and Resend (email delivery), Stripe (payments and invoicing). We do not sell or share this data with third parties for their own purposes.
6. Transfers outside the European Economic Area
Some providers are US-based: transfers rely on the EU-US adequacy decision (Data Privacy Framework) or on standard contractual clauses, with the supplementary measures described in our transfer impact assessment, available on request.
7. Your rights
You may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interest, by writing to privacy@fakeorfate.app. You also have the right to lodge a complaint with the Italian data protection authority.
8. Security
Passwords and recovery codes are stored only in non-reversible form; second-factor secrets are encrypted; API keys are stored as hashes and shown once; portal access is logged. Transport is always encrypted (HTTPS).
9. Data processing agreement (DPA)
Because the TPD dataset is anonymous, a controller-processor relationship for the app users' data normally does not arise. If your compliance team still requires an agreement, write to us: we will provide it signed.