← Back to Home

Privacy Policy

Last updated: February 19, 2026

Pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

1. Data Controller

The Data Controller is Italio ("we", "us", "our"), operating the website italio.app and the Italio mobile application.

  • Email: privacy@italio.app
  • Website: https://italio.app

For any questions regarding the processing of your personal data, you may contact us at the email address above.

2. Categories of Personal Data Collected

We collect and process the following categories of personal data:

2.1 Data Provided Voluntarily by the User

  • Registration data: name, email address, password (stored in hashed form)
  • Profile data: username, profile photo, biographical information
  • Partner registration data: company name, business email, phone number, VAT number
  • User-generated content: product reviews, posts, comments, photos
  • Communications: messages sent through the platform, support requests

2.2 Data Collected Automatically

  • Device data: device type, operating system, app version
  • Usage data: product scans, search queries, pages viewed, features used
  • Log data: IP address, access timestamps, browser type
  • Push notification tokens: device identifiers for delivering notifications (only with your consent)

2.3 Data from Third Parties

  • OAuth providers: if you register or log in via Google or Apple, we receive your name and email address as authorized by you
  • Product databases: product information from Open Food Facts and other public databases

3. Purposes and Legal Basis for Processing

We process your personal data for the following purposes:

Purpose Legal Basis (GDPR Art. 6)
Account creation and management Performance of a contract (Art. 6(1)(b))
Providing the scanning and verification service Performance of a contract (Art. 6(1)(b))
Processing partner subscriptions and payments Performance of a contract (Art. 6(1)(b))
Sending push notifications about scans, likes, comments Consent (Art. 6(1)(a))
Improving the service and analytics Legitimate interest (Art. 6(1)(f))
Preventing fraud and ensuring security Legitimate interest (Art. 6(1)(f))
Compliance with legal obligations Legal obligation (Art. 6(1)(c))

4. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described above:

  • Account data: retained for the duration of your account, plus 30 days after deletion request
  • Transaction and subscription data: retained for 10 years as required by Italian tax law (D.P.R. 600/1973, Art. 22 D.P.R. 600/1973)
  • Usage logs and analytics: retained for up to 26 months
  • Marketing consent data: retained until consent is withdrawn
  • Support communications: retained for 2 years after resolution

After the applicable retention period, data is securely deleted or anonymized.

5. Data Sharing and Recipients

We do not sell your personal data. We may share your data with the following categories of recipients:

  • Hosting and infrastructure providers: servers located within the EU
  • Payment processors: for processing partner subscription payments (RevenueCat, Apple, Google)
  • Push notification services: Expo Push Service for delivering notifications
  • Analytics services: anonymized and aggregated usage data only
  • Legal authorities: when required by applicable law or court order

All third-party processors are bound by data processing agreements in compliance with Art. 28 GDPR.

6. International Data Transfers

Your data is primarily stored on servers located within the European Union. In cases where data may be transferred to countries outside the EU/EEA (for example, when using Apple or Google services), such transfers are protected by:

  • European Commission adequacy decisions (Art. 45 GDPR), or
  • Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR), or
  • The EU-US Data Privacy Framework, where applicable

7. Your Rights

Under the GDPR (Articles 15–22) and Italian data protection law, you have the following rights:

  • Right of access (Art. 15): obtain confirmation of whether your data is being processed and access a copy
  • Right to rectification (Art. 16): correct inaccurate data or complete incomplete data
  • Right to erasure (Art. 17): request deletion of your data ("right to be forgotten")
  • Right to restriction (Art. 18): restrict processing in certain circumstances
  • Right to data portability (Art. 20): receive your data in a structured, machine-readable format
  • Right to object (Art. 21): object to processing based on legitimate interests
  • Right to withdraw consent (Art. 7(3)): withdraw consent at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@italio.app. We will respond within 30 days as required by law.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali):

8. Cookies and Tracking Technologies

Our website uses the following categories of cookies:

  • Essential cookies: required for the website to function (language preference, session management). These do not require consent.
  • Analytics cookies: used to understand how visitors interact with the site. Deployed only with your consent.

We do not use third-party advertising or profiling cookies.

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the website.

This cookie policy complies with the guidelines of the Italian Data Protection Authority (Provvedimento n. 229/2014) and Directive 2009/136/EC.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

  • SSL/TLS encryption for all data in transit
  • Password hashing using industry-standard algorithms
  • Access controls and authentication for administrative systems
  • Regular security updates and monitoring
  • Database encryption at rest

10. Children's Privacy

Our service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data, please contact us at privacy@italio.app and we will promptly delete such data. This age threshold is set in accordance with Art. 8 GDPR and Art. 2-quinquies of D.Lgs. 196/2003.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or an in-app notification. The "Last updated" date at the top of this page indicates when the policy was last revised.

Continued use of our service after changes constitutes acceptance of the updated policy.

12. Governing Law

This Privacy Policy is governed by Italian law and Regulation (EU) 2016/679. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the competent court in Italy.