Privacy Policy

This Privacy Policy explains how Marco Magni, operating as a sole proprietor with VAT number (P.IVA) 13970760966 ("we," "us," or "our"), processes personal data through the website https://www.dilli.it (the "Website") and the services provided through Dilli (collectively, the "Services"). It applies to data processed through the Website and Services. This notice explains those practices; using the Services does not, by itself, constitute consent where consent is required by law. 1. Data Controller Marco Magni, sole proprietor, VAT (P.IVA) 13970760966, is the data controller for personal data processed to operate Dilli and manage your account. Contact: TheMMCompany@protonmail.com. If you use a Dilli widget embedded on a business's website or submit information to a campaign, that business may decide why and how it uses the campaign information it collects. The business may act as a separate controller for that processing. Contact the business for its privacy information. The respective roles should be assessed for each campaign. 2. Personal Data We Collect We collect personal data directly from you, automatically through your use of the Services, or from third parties. "Personal data" refers to any information relating to an identified or identifiable individual, as defined by the GDPR. 2.1 Data You Provide Account information: email address, password credential (stored as a password hash), account settings, and, if you use Google sign-in, identity information returned by Google such as your email address and stable account identifier. Campaign information: information you enter when creating or managing waitlists, referral campaigns, Community Rankings, and related settings. If you join a customer campaign, the information requested by its form, commonly your email address, is submitted to Dilli for that campaign. Survey and support information: responses to optional onboarding surveys and the contents of messages you send to us. Subscription information: subscription and payment event identifiers and entitlement status. Payment checkout is handled by Stripe. Dilli does not collect or store your full payment card number through its account forms. 2.2 Data Collected Automatically Technical and campaign data may include IP address, browser and device information, timestamps, requested pages, referrer, and campaign interaction details. When location features are used, an IP address may be sent to ipapi.co to estimate a visitor's country, region, or city for campaign reporting. Referral and campaign features may record referral codes, traffic-source fields, campaign actions, and, where enabled, location votes. These data support campaign operation, attribution, abuse prevention, and reporting. 2.3 Data from Third Parties Google: if you choose Google sign-in, Google processes your authentication request and provides the account information required to sign you in. Resend: account and campaign emails may be sent through Resend, which receives the delivery information and message content required to send those emails. Stripe: paid checkout and subscription events are processed through Stripe. A campaign owner may separately connect Stripe for campaign-specific features. ipapi.co: when a campaign location feature performs an IP-based location lookup, it sends the relevant visitor IP address to ipapi.co. Website or infrastructure providers may process data required to host and secure the Services. The specific provider, processing location, and applicable contractual safeguards depend on the live deployment and must be confirmed in the relevant provider terms. 2.4 Aggregated or Anonymized Data We may use aggregated data that does not identify an individual to understand service usage and improve Dilli. 3. How We Use Your Personal Data We process your personal data for the following purposes, based on the legal grounds outlined in Section 4: To provide and operate the Services, including account management, transaction processing, and interactive features. To respond to support requests and operate account, campaign, email, and subscription features. To process onboarding survey responses and improve the product. To secure accounts, prevent abuse, and protect the Services. To comply with legal obligations and establish or defend legal claims. Marketing messages, if offered, are sent only on a lawful basis and you can use the unsubscribe method provided. 4. Legal Basis for Processing (GDPR) Depending on the specific processing, the legal basis may be performance of a contract or steps requested before entering one, compliance with a legal obligation, our legitimate interests in protecting and improving the Services where those interests do not override your rights, or your consent where required. The applicable basis depends on the purpose and feature. You may withdraw consent at any time where processing relies on consent; withdrawal does not affect processing already carried out lawfully. 5. How We Share Your Personal Data We share data with service providers where needed to operate the Services, including Google for sign-in, Resend for email, Stripe for payments and subscriptions, ipapi.co for certain campaign location lookups, and infrastructure providers. We may disclose data when required by law, to protect rights and safety, or in connection with a business transfer subject to applicable law. Campaign information may be available to the business that operates the campaign and authorized campaign collaborators. This policy does not claim that analytics or advertising cookies are active; see Section 6 for Dilli's cookie practices. 6. Cookies and Tracking Technologies The Services use cookies and browser storage for essential functions, including authentication sessions, form security, language preference, and storing your privacy choice. The authentication session is stored server-side; the browser holds a session identifier, not your password. Optional referral tracking may store referral information only when tracking consent is present. If you decline optional tracking, referral attribution may not persist; essential account and security functions may still use necessary storage. You can manage or delete cookies through your browser and use the privacy controls provided on the Website. Blocking essential storage may prevent sign-in or other requested features. This section directly describes Dilli cookie practices. 7. Data Retention We retain personal data only for as long as reasonably necessary for the purposes described here and applicable legal obligations. Account deletion removes the local account, its campaigns and operational campaign records, usage and survey records, and invitation records. Payment records that must be retained for accounting, legal, or dispute purposes may be kept for the applicable period and detached from the deleted account. Service providers may retain data under their own legal obligations. Backups and technical records may remain until their ordinary retention cycles expire. Where retention depends on a legal requirement, the period depends on the applicable obligation; we do not promise a blanket ten-year period for every transaction record. 8. Data Security We use technical and organizational measures intended to protect personal data, including access controls and secure authentication. No system can be guaranteed to be completely secure. 9. International Data Transfers Some providers used by the Services may process data outside the European Economic Area. The locations and transfer safeguards depend on the provider and deployment. Where applicable, transfers must rely on an appropriate mechanism under data-protection law. You can contact us for information about safeguards relevant to a particular transfer. 10. Your Data Protection Rights (GDPR) Subject to the conditions and exceptions set by applicable law, you may have the following rights: Access: Request a copy of your personal data. Rectification: Correct inaccurate or incomplete data. Erasure: Request deletion of your data, subject to legal exceptions (e.g., tax obligations). Restriction: Limit how we process your data in certain cases. Portability: Receive your data in a structured, machine-readable format or have it transferred to another controller. Objection: Object to processing based on legitimate interests, including for marketing purposes. Withdraw Consent: Revoke consent at any time, without affecting prior processing. Lodge a Complaint: Contact your local data protection authority (in Italy, the Garante per la Protezione dei Dati Personali: https://www.garanteprivacy.it/). To exercise your rights, contact TheMMCompany@protonmail.com. We will respond within the period required by applicable law and may request information needed to verify your identity. 11. Children’s Privacy The Services are intended for people aged 18 and older. If you believe that a child has provided personal data through the Services, contact TheMMCompany@protonmail.com so we can review the request and take appropriate action. 12. Third-Party Links The Website or Services may link to third-party websites. Their operators' privacy practices are governed by their own notices. 13. Changes to This Privacy Policy We may update this Privacy Policy when our practices or legal requirements change. We will post the current version on the Website and provide any notice required by law. 14. Contact Us For questions, concerns, or to exercise your data protection rights, contact:
Marco Magni
Owner, VAT: 13970760966
Email: TheMMCompany@protonmail.com You may also contact the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) at https://www.garanteprivacy.it/ for complaints.