Privacy policy

Data controller

[owner details to be completed]

For any privacy request, write to [owner details to be completed].

What data we process

• Account data: name, email, password (stored only as a one-way hash), Google identifier if you sign in with Google, chosen language and currency.
• Research content: the niche, the notes you write and the generated reports.
• Payment data: collected by Stripe. We receive the plan, amounts, payment status and, if you enter them, company name, address and tax ID for the invoice. Your card number never touches our systems.
• Credit movements and invitations: who invited you and whom you invited.
• Technical data: to limit abuse we keep a non-reversible fingerprint (hash) of your IP address for up to one hour, never the address itself. We only use technical cookies (see the cookie policy).
• If you join the affiliate program: the data needed to pay your commissions.

Please don't put other people's personal data in your searches: the service doesn't need it.

Why we process it and on what basis

• To provide the service you asked for (account, research, credits, support): performance of a contract, art. 6(1)(b) GDPR.
• Payments, invoices and bookkeeping: legal obligation, art. 6(1)(c).
• Security and abuse prevention (e.g. multiple accounts to get free research): legitimate interest, art. 6(1)(f).
• Service emails (address confirmation, password recovery, receipts): performance of a contract.

We don't sell your data, we don't run targeted advertising and we don't send newsletters without your consent.

Artificial intelligence

To generate reports we send the text of your search (niche, market, notes) to Anthropic's model through its API. Under Anthropic's current commercial terms, this data is not used to train its models. Reports may contain errors: see the Terms of service.

Who we share it with

Data is processed on our behalf by these providers, appointed as data processors:

• Anthropic PBC (USA): report generation (the text of your searches).
• Stripe Payments Europe Ltd. (IE / USA): payments, subscriptions and invoices.
• Cloudflare, Inc. (USA / UE): website hosting.
• Supabase Inc. (UE): account and research database.

When data leaves the European Union (for example to the United States), the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

How long we keep it

• Account data and research: as long as your account is open. If you ask us to close it, we delete it within 30 days.
• Billing data: 10 years, as required by Italian law (art. 2220 Civil Code).
• Login sessions: 30 days. Email links: from 1 hour to 3 days.

Your rights

You can ask at any time to access, correct or delete your data, restrict its use, receive it in a portable format or object to processing based on legitimate interest. Write to [owner details to be completed]: we reply within 30 days.

If you believe the processing breaches the GDPR you can lodge a complaint with the Italian data protection authority (www.garanteprivacy.it) or with the authority of your country.

Minimum age

Findit is a tool for people working in online retail and is for adults only.

Changes

If we change this policy in a meaningful way we will tell you by email or with a notice on the site.