Privacy policy

This notice is given under articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Italian Privacy Code) to visitors of the www.prynt.it website, to people who write to us through the contact form or support, and to users of the Prynt application (app.prynt.it, api.prynt.it).

1. Controller

The controller is [RAGIONE SOCIALE], with registered office at [SEDE LEGALE], VAT number [P.IVA] (Prynt, we). For any question about personal data you can write to [EMAIL PRIVACY].

Data protection officer (DPO): [DPO — name and contact details, or: "not appointed, as not required under article 37 GDPR"].

2. When Prynt is controller and when it is processor

Prynt is a service that customers (businesses) use to generate documents from their own data. Two situations must be distinguished:

• Customer data processed in the service: the data a customer uploads or makes accessible to Prynt (templates, assets, data read from its databases at generation time, generated documents, run logs). For this data the customer is the controller and Prynt acts as processor (article 28 GDPR) under the Data Processing Agreement. If your data appears in documents generated by one of our customers (for example you are their customer or supplier), please contact them for information and to exercise your rights.
• Data Prynt processes for its own purposes: website browsing data, contact requests, user accounts, platform security, support, licenses and billing. For these Prynt is the controller, and this notice refers to them.

3. Data processed, purposes, legal bases and retention

3.1 Browsing the website and the application

When you visit www.prynt.it, app.prynt.it or api.prynt.it, the server that receives requests (reverse proxy) records technical data such as IP address, date and time, requested address, response code, browser and operating system (user agent) and referring page.

• Purpose: serving pages, ensuring security and preventing abuse (for example limiting repeated sign-in attempts), diagnosing faults.
• Legal basis: Prynt's legitimate interest in the security and operation of the service (article 6(1)(f) GDPR).
• Retention: [PERIODO CONSERVAZIONE LOG — e.g. 30 days], unless needed to establish unlawful acts. The counters used to limit repeated attempts are kept only in memory for a few minutes.

The www.prynt.it website is static: it uses no analytics, tracking pixels, advertising or external services (fonts, scripts and images are served by our own servers).

3.2 Language of the website and IP geolocation

When you open www.prynt.it without having chosen a language, the site shows Italian to visitors in Italy, San Marino and Vatican City and English to everyone else. To know the country, the server looks up the IP address of your request in a geolocation database kept on our own server (DB-IP "IP to Country Lite"): no external service is contacted.

Your IP address is used only for this lookup, in memory, while the page is being served: language detection does not save, log or share it, and it keeps only the resulting language. When the country cannot be determined, the language preferred by your browser is used instead.

If you choose a language with the switcher in the header or the footer, the site stores your choice in a technical cookie named prynt_locale (value "en" or "it", valid for one year), which takes precedence over the automatic detection. The site uses no analytics or advertising cookies. Details in the cookie policy.

• Legal basis: legitimate interest in showing the site in the most suitable language (article 6(1)(f) GDPR).

IP geolocation data: IP Geolocation by DB-IP, licensed under CC BY 4.0.

3.3 Contact form and sales requests

If you write to us through the form on the Contact page (license, demo, partnership or other request), we process: first and last name, company, email, phone (optional), country, role, topic and text of the message, language, referring page, and the date and time you acknowledged this notice. We do not keep the IP address or the browser of whoever sends the form. We also keep the replies we send you, as the history of the conversation.

• Purpose: answering the request, preparing a quote or a license, following up on the sales contacts you asked for.
• Legal basis: steps taken at your request prior to entering into a contract (article 6(1)(b) GDPR) and legitimate interest in managing business relationships with companies (article 6(1)(f) GDPR).
• Retention: [PERIODO CONSERVAZIONE CONTATTI — e.g. 24 months from the last contact], after which the data is deleted, unless the request leads to a contract (in which case section 3.6 applies).
• We do not subscribe you to newsletters or send you promotional communications without separate consent.

3.4 Application accounts

To register and use the application we process: email, display name, language, password (stored only as a non-reversible cryptographic hash), two-factor authentication data (the secret is encrypted, recovery codes are stored only as hashes), active sessions (IP address, browser, creation and last-use dates), devices remembered after two-factor verification, membership of organizations and workspaces with the related roles, invitations received and sent.

• Purpose: creating and managing the account, authenticating you, letting you use the organizations you belong to, sending service emails (address verification, password reset, invitations, security notices).
• Legal basis: performance of a contract or pre-contractual steps (article 6(1)(b) GDPR); for users invited by a customer, the legitimate interest of Prynt and of the customer in providing the service to authorized users (article 6(1)(f) GDPR).
• Retention: as long as the account exists. Sessions expire after 12 hours of inactivity or 24 hours (30 days if you choose "remember me") and their data is deleted 7 days after expiry; remembered devices are valid for 30 days. When you delete the account its data is erased; audit entries keep the events without your identifying data.

3.5 Security, audit logs and abuse prevention

We record operations that matter for security and for customers (sign-ins, changes to roles and settings, creation and revocation of API keys, template publishing, exports and deletions, data access by queries) with the user or API key that performed them, the IP address and the date. Data access is recorded without the values read.

• Purpose: protecting accounts and data, reconstructing incidents, providing customers with the audit log of their organization, defending Prynt's rights.
• Legal basis: legitimate interest in security (article 6(1)(f) GDPR) and the security obligations of article 32 GDPR.
• Retention: for the whole life of the organization they refer to (they are erased with the organization); when an account is deleted, name, email and IP are removed from audit entries. Logs of the platform operators' actions are kept for [PERIODO CONSERVAZIONE AUDIT PIATTAFORMA].

3.6 Licenses, billing and the contractual relationship

For customers we process the data of the contact person and of the company: name or company name, contact email, billing data (VAT number, tax code, SDI recipient code or certified email, address, billing email), license terms and service usage data (number of documents and resources), communications about the contract. The license key is stored only as a cryptographic hash.

• Purpose: managing licenses, orders, invoices, payments and tax obligations.
• Legal basis: performance of the contract (article 6(1)(b) GDPR) and legal obligations (article 6(1)(c) GDPR).
• Retention: for the duration of the contract and, for accounting and tax records, 10 years (article 2220 of the Italian Civil Code).

If in the future the service can be purchased online with electronic payment, payment data will be processed directly by the payment provider (for example Stripe) and Prynt will not see full card details; this notice will be updated before activation.

3.7 Support requests

If you use the "Contact support" feature of the application or write to [EMAIL SUPPORTO], we process your name and email, the organization and workspace you write from, the topic and the message, the application page, the application version and the browser, and the replies we send you.

• Purpose: answering and solving the reported problem.
• Legal basis: performance of the contract (article 6(1)(b) GDPR) and legitimate interest in improving the service (article 6(1)(f) GDPR).
• Retention: [PERIODO CONSERVAZIONE ASSISTENZA — e.g. 24 months from the closing of the request].

3.8 Service emails

Emails (address verification, invitations, password reset, license and usage notices, replies to contacts) are placed in an internal queue and sent through the email provider listed in the list of sub-processors. The content of the message is deleted from the queue as soon as it is sent; the recipient and the type of email are kept for 14 days to diagnose delivery failures.

3.9 AI assistant of the Designer

The AI assistant is optional and works only with the user's own OpenAI API key. If you enable it we process the key (stored encrypted and never shown again: we only see its last four characters), the chosen model, your choice about sharing sample rows and aggregated usage counters (number of requests, model calls and tokens per user and day). We do not store the content of requests or answers.

When you use the assistant, your requests, the structure of the open template and the names of tables and columns of the data sources (and, only if you allow it in your profile, a few sample rows of the results of test queries) are sent to OpenAI with your key, under your contractual relationship with OpenAI and its terms (including those on retention and transfers outside the EEA). For this data OpenAI is not our provider: Prynt transmits it on your instruction. For your organization's data contained in templates and data sources, section 2 and the DPA apply.

• Purpose: providing the feature at your request; the counters serve to prevent abuse and size the service.
• Legal basis: performance of the contract (article 6(1)(b) GDPR); legitimate interest in the security of the service for the counters (article 6(1)(f) GDPR).
• Retention: the key and the preferences until you remove them or delete your account; the aggregated counters [PERIODO CONSERVAZIONE CONTATORI AI — e.g. 24 months].

4. Whether providing data is mandatory

The data required for the account, the contract and support is necessary: without it we cannot provide the service or reply. In the contact form, fields marked as optional (for example the phone number) are optional. Browsing data is collected automatically by the operation of the site.

5. Recipients

Data is processed by Prynt staff who are authorized and instructed, within the limits of their tasks. It may be disclosed to:

• providers processing data on our behalf as processors (hosting, email delivery, storage of encrypted backups), listed in the list of sub-processors;
• advisers (for example accountant, lawyer) bound by confidentiality, for legal obligations and to protect our rights;
• authorities, when required by law.

Within a customer organization, owners and administrators see members' data (name, email, role, activity recorded in the organization's audit log).

Data is not published or sold.

6. Transfers outside the European Economic Area

The service is hosted in the European Union and our main providers process data in the European Economic Area. If a provider were to process data outside the EEA, the transfer will take place only on the basis of an adequacy decision of the European Commission (for example the EU-U.S. Data Privacy Framework) or of the standard contractual clauses approved by the Commission, and the list of sub-processors will say so.

7. Security

We apply appropriate technical and organizational measures: encrypted connections (HTTPS), passwords stored with hash functions, two-factor authentication, encryption of customers' database credentials, data isolation per workspace in the database, access controls and audit logs, encrypted daily backups stored off the server. Details are in Annex 2 of the Data Processing Agreement.

8. Your rights

You have the right to request access to your data, rectification, erasure, restriction of processing and portability, and to object to processing based on legitimate interest (articles 15-22 GDPR). We do not take decisions based solely on automated processing that produce legal effects concerning you.

In the application you can exercise many rights yourself: Account → Privacy to download your data as JSON or delete your account; owners can export or delete their organization from Settings → Data and privacy. For everything else write to [EMAIL PRIVACY]: we reply within one month (extendable in the cases provided by article 12 GDPR).

You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where you live or work.

9. Minors

The service is intended for businesses and professionals and is not directed at people under 18.

10. Changes

We may update this notice. The version in force is always published on this page with the date of the last update; in case of significant changes we notify registered users by email or in the application.