Privacy notice

What we process

Only what the product needs in order to work and to charge you. Nothing is collected “for later”.

• Your email address and sign-in credentials, handled by the authentication provider.
• The days you record: date, client, engagement, activity type, the place you type, notes, and the resulting pay.
• The documents you upload, where your subscription includes them.
• Minimal technical data for syncing: device identifier, app version, outcome of each operation.

What we do NOT process

Giornata operates no cloud timeline of your location. Place-memory features, when they exist, live only in the device’s private storage: they are stored in no Giornata table, in any environment, and never appear in analytics, logs, crash reports, backups, exports or support tooling.

We do not profile, advertise, sell your data, or hand it to anyone for their own purposes.

Who processes it for us

Only these providers, each under contract and with a defined role. No others.

• Supabase — database, authentication and document storage.
• Vercel — hosting for the site and the web application.
• Resend — service email delivery.
• Backblaze B2 (EU Central, Amsterdam) — database backups and the deletion journal.
• Stripe — payments on the web.
• RevenueCat, Apple, Google — purchases made inside the apps.
• Google Calendar — only if you connect it, and outbound only.

For how long

Your work data stays as long as your workspace exists: it is your record, and deleting it on our own would destroy your economic history.

Technical diagnostics have a short, fixed life: 35 days when tied to a workspace, 90 days for anonymous aggregates. No content from your days goes there.

When you ask for your account to be deleted, the deletion is recorded in a journal that lives outside the database, so restoring a backup cannot bring back what you deleted.

Where it lives

The database and your documents are in the European Union. Backups are in Amsterdam with a United States provider, so US law may reach that provider — a deliberate choice we would rather state than bury.

Your rights

You can ask to see your data, correct it, export it, restrict or object to its processing, and delete your account. Write to the address above: we answer within one month.

You may lodge a complaint with your national supervisory authority.

Security

Every row is protected at row level: another workspace cannot read yours even knowing the right identifiers. Uploaded documents are never public and never have a shareable link: every access is authorised at the moment it happens.