Privacy policy

1. Data controller

The data controller for the data collected through the Raduno website and app is Alessandro Vettor, sole proprietorship, VAT number 05586730268. For any request related to this notice or to exercise your rights, please write to [email protected].

2. Data we collect and purposes

Raduno processes the following categories of personal data, for the purposes described below.

2.1 Account and authentication

To create and manage an account we process your email address, password (stored in encrypted form, never in plain text) and any profile data you provide (name, profile photo). The legal basis is performance of the contract (the service terms) and legitimate interest in account security (e.g. multi-factor authentication).

2.2 Orders and payments

To purchase event tickets we process the data necessary for the order (event, ticket type, amount). Payments are processed entirely by Stripe, which acts as a data processor on behalf of the controller: Raduno never sees or stores credit card numbers or other sensitive payment data, which are handled directly by Stripe in compliance with PCI-DSS standards. The legal basis is performance of the purchase contract.

2.3 Location

Location data is used only within the mobile app, to search for nearby events and clubs, subject to the device operating system's consent. The website does not collect or request location data. The legal basis is the user's consent, which can be withdrawn at any time from the app or device settings.

2.4 Photos

Photos uploaded by users (e.g. images of their own garage/vehicles and social content within the app) are processed for the purpose for which they were uploaded. Before publication or storage, EXIF metadata — including any GPS coordinates of the shot — is stripped. The legal basis is performance of the contract and, where applicable, the user's consent.

2.5 Waitlist

Anyone who signs up for the app-launch waiting list provides their email address after giving explicit consent (an unticked checkbox). Sign-up is confirmed through a double opt-in process: a confirmation email with a link is sent to the address provided. Sign-up can be withdrawn at any time via the unsubscribe link included in every waitlist communication. The legal basis is consent (Art. 6(1)(a) GDPR).

2.6 Partner invoicing

For clubs and organizers who become official partners, we process the tax data required to issue electronic invoices (business name, VAT/tax code, address, recipient code/PEC) through the third-party provider fattura-elettronica-api.it, which acts as a data processor for transmitting documents to the Italian Interchange System (SDI). The legal basis is performance of the partnership contract and compliance with legal tax obligations.

2.7 Messaging

The app lets you exchange messages in one-to-one, group, club and event chats. We process the text content of messages and any shared media (photos): as with the photos described in section 2.4, EXIF metadata — including GPS coordinates — is stripped from these images too. You can block another user, preventing further messages between you. Messages may also be removed by platform moderation: when this happens they are hidden (not immediately deleted) to allow for review and to prevent abuse. To report abuse, you can write to the address indicated in section 1. The legal basis is performance of the contract (the messaging feature of the service) and legitimate interest in community safety and moderation (user blocking, removal of content in violation).

To send push notifications (e.g. new chat messages) the app registers a device token (a technical identifier tied to the app installation on Android/iOS), collected when the user grants the notification permission explicitly requested by the app. This permission — and therefore delivery of notifications — can be revoked at any time from the device's system settings; the token is also automatically removed on logout and on account deletion (see section 4). Delivery is handled by Google Firebase Cloud Messaging, which for iOS devices relies on Apple Push Notification service as a further processor for final delivery. The legal basis is performance of the contract (delivery of service notifications) and the specific consent requested by the operating system for activation.

3. Recipients and processors

For the purposes above, data may be shared with the following processors acting on behalf of the controller:

• Stripe — payment processing (may process data outside the European Economic Area, with adequate safeguards such as standard contractual clauses).
• fattura-elettronica-api.it — issuing and transmitting partner electronic invoices.
• Infrastructure/hosting provider (VPS server) hosting the platform.
• Transactional email provider, for sending waitlist confirmation emails and service notifications.
• Google Firebase Cloud Messaging — delivery of push notifications for Android and iOS; for iOS devices it relies on Apple Push Notification service for final delivery (see section 2.7).

4. Data retention

Account data is kept until the user requests deletion. Partner tax data is kept for the period required by applicable tax law (currently 10 years). Waitlist data is kept until consent is withdrawn or, in any case, until the end of the app launch phase.

Users can request deletion of their own account fully self-service from the app, under Settings → "Delete account", subject to confirmation. This anonymizes the profile data (username, display name, email, bio, location, profile photo) and deactivates the account: public content linked to it (profile, posts, garage) is no longer accessible after deletion. Orders, tickets and invoices are instead kept, as required to fulfil legal tax obligations (see section 2.6). Messages already exchanged in chats with other users are not rewritten retroactively: they remain visible in the other participants' conversation history, but are attributed to an anonymized profile.

5. Your rights

At any time you can exercise the rights provided for by Articles 15-22 GDPR: access, rectification, erasure, restriction of processing, data portability and objection, by writing to the address indicated in section 1. The right to erasure (Art. 17 GDPR, the "right to be forgotten") can also be exercised directly from the app, as described in section 4. You may also lodge a complaint with the competent data protection authority.

6. Security

We adopt appropriate technical and organizational measures to protect personal data, including encrypted storage of credentials, encryption of data in transit (TLS) and access controls limited to authorized personnel. We also process client IP addresses solely for security and abuse-prevention purposes (rate-limiting): for example limiting waitlist sign-ups to 5 requests per minute per IP and throttling calls to the public APIs. These counters are kept in Redis for a short time window (a few minutes), after which they are automatically deleted.

7. Minors

The service is not directed at children under 16 and we do not knowingly collect data about children of that age.

8. Changes to this notice

This notice may be updated over time; any material changes will be communicated via the site or app.