Privacy Policy

1. Data controller

The controller of personal data is CartIrya, reachable at the email address [email protected].

2. Data collected

We collect the following types of data:

• Account data: email address, display name, authentication provider (email/password or Google OAuth).
• Letter content: text, graphic elements, and materials entered in the editor. The data is protected by encryption at rest provided by the infrastructure provider (Supabase / AWS RDS, AES-256) and by encryption in transit (TLS 1.2+). The encryption keys are managed by the provider; CartIrya does not implement end-to-end encryption with a user key: this means that, in theory, CartIrya's and the provider's authorized technical staff could read the content for maintenance/support activities. Access is governed by the data access policy (see the "Internal access" section).
• Payment data: we do not store credit card data. Payments are handled by Lemon Squeezy, which acts as Merchant of Record. See their Privacy Policy.
• Usage data: access logs, anonymized aggregate statistics.
• Uploaded images and textures: the custom images inserted into letters and materials (envelope, parchment) are stored on Supabase Storage in folders isolated for each user (path based on auth.uid()).
• Local data (browser): for non-authenticated users, temporary letter drafts are saved locally on your device (localStorage / IndexedDB) and not transmitted to our servers. You can delete them at any time by clearing the site data from your browser.
• Technical cookies: necessary for the operation of the service (authentication session). We do not use profiling cookies.
• Recipient and third-party data: when a sender enters other people's data (e.g. the recipient's name, an event guest list) or a recipient replies to an RSVP with their own name, we process this data solely to deliver the letter and manage responses. Anyone entering third-party data warrants that they are entitled to do so (see Terms of Service, "Acceptable use" section).

3. Purposes of processing

• Provision of the service (authentication, saving and sending letters).
• Management of subscriptions and one-time purchases.
• Service communications (purchase confirmation, letter-sending notifications).
• Product improvement through aggregate and anonymized statistics.

We do not use your data for marketing purposes without explicit consent.

4. Legal basis

Processing is based on:

• Performance of the contract (Art. 6(1)(b) GDPR): to provide the service.
• Legitimate interest (Art. 6(1)(f) GDPR): for platform security and service improvement.
• Legal obligation (Art. 6(1)(c) GDPR): to comply with tax and accounting obligations.

5. Data retention

Account data is kept as long as the account is active. Sent letters and their content remain available according to the expiry settings chosen by the user (time capsules, self-destruction, etc.).

After account deletion:

• Letters sent by you: are kept accessible to recipients until the natural expiry date (if set) or for at most 12 months from deletion, then permanently deleted.
• Letters received by you: are the sender's property and remain available only to them; your reference as recipient is anonymized.
• Account data: profile, session, preferences — deleted within 30 days.
• Tax data (orders, receipts): kept for 10 years as required by law, in minimal form (amount, date, Lemon Squeezy order ID).

6. Sub-processors and data transfer

Data is processed through the following providers (sub-processors), chosen for compliance with European regulations. Each is bound by a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR:

• Supabase, Inc. — PostgreSQL database, image storage, authentication, edge functions.
  Region: Frankfurt, Germany (EU). No extra-EU transfer for application data.
  DPA: supabase.com/legal/dpa (signed when the project was activated).
• Cloudflare, Inc. — CDN, DDoS mitigation, TLS termination for the static front-end.
  Role: network infrastructure. Cloudflare routes requests and protects against attacks, but has no application access to letter content (which remains encrypted in transit to Supabase) nor does it store it. Cache only for public static assets (marketing images, fonts, JS bundle).
  Global network (including US PoPs). DPA: cloudflare.com/cloudflare-customer-dpa + Standard Contractual Clauses.
• Lemon Squeezy LLC — checkout management, payments, invoicing (Merchant of Record).
  Location: United States. Receives: name, email, billing address, payment data.
  DPA: lemonsqueezy.com/dpa + EU/US Standard Contractual Clauses (accepted when the merchant account was activated).
• Resend, Inc. — sending transactional emails (registration confirmation, RSVP notification, receipt, password reset).
  Location: United States. Receives: recipient email address, email content (template + variables: name, link).
  DPA: resend.com/legal/dpa + Standard Contractual Clauses.
• Functional Software, Inc. (Sentry) — technical error monitoring in production.
  Location: United States. Receives: error reports (error type, stack trace, page URL, browser/operating system). Configured privacy-first: no full IP addresses, no cookies, no session replay; letter content is never sent.
  DPA: sentry.io/legal/dpa + Standard Contractual Clauses.
• Google Fonts (Google LLC) — loading of the site's and editor's typefaces from Google servers.
  When you visit the site, your browser requests font files from Google: the request transmits your IP address and user agent to Google. According to Google's notice, these requests do not use cookies, are not associated with Google accounts, and are not used for profiling.
  Notice: developers.google.com/fonts/faq/privacy.
• Google LLC (optional, only for users who choose Google OAuth) — "Sign in with Google" authentication. Google sees: your Google identity and the fact that you are authenticating on CartIrya. We do not pass letter content to Google.

For sub-processors based outside the EU (Lemon Squeezy, Resend, Sentry, Cloudflare for the global network, Google), the transfer takes place on the basis of the Standard Contractual Clauses approved by the European Commission (Decision 2021/914) supplemented by additional measures (encryption in transit, data minimization). We are monitoring the evolution of the EU-US Data Privacy Framework and will adjust the transfer bases accordingly.

7. Your rights

You have the right to:

• Access (Art. 15 GDPR): obtain confirmation that processing is taking place and a copy of the data concerning you.
• Rectification (Art. 16): correct inaccurate or incomplete data.
• Erasure (Art. 17, "right to be forgotten"): request the deletion of your data except for overriding legal obligations (e.g. tax data).
• Restriction of processing (Art. 18): request that data only be stored and not actively used.
• Portability (Art. 20): receive your data in a structured, readable format (JSON) and transmit it to another controller.
• Objection (Art. 21): object to processing based on legitimate interest.
• Withdrawal of consent (Art. 7): withdraw at any time the consent given (e.g. analytics cookies), without affecting the lawfulness of prior processing.
• Complaint (Art. 77): lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

How to exercise your rights: send a request from the email associated with your account to [email protected] specifying the right you wish to exercise. We will respond within 30 days (extendable to 60 days for complex requests, with a reasoned notice). Exercising your rights is free, except for manifestly unfounded or excessive requests (in which case we may charge a fee or refuse the request).

For deletion requests: see also section 5 "Data retention" on the handling of sent vs received letters after account deletion.

8. Internal data access

Access to user data by CartIrya staff is limited and logged:

• Only authorized technical staff (minimal number, today limited to the founder) can access the database and storage via administrative credentials.
• Access is permitted only for: user support (at the explicit request of the data subject), moderation of reported content (see Terms of Service), maintenance (debugging, incident recovery), and legal obligations.
• Admin credentials are protected by multi-factor authentication and rotated periodically.
• Database RPCs with elevated privilege (`SECURITY DEFINER`) verify the administrator role within their body, preventing access by unauthorized users even if the front-end is compromised.
• We do not sell, rent, or transfer personal data to third parties for marketing purposes.

9. Cookies

CartIrya uses exclusively technical cookies necessary for the operation of the service (authentication session management, language preferences, local draft saving). Pursuant to the Italian Data Protection Authority's measure of 10 June 2021, technical cookies do not require prior consent.

On the first visit, a cookie banner ("Pact of Confidentiality") is shown, allowing you to express preferences on optional categories (e.g. analytics). The banner is precautionary: to date we do not use profiling, tracking, or marketing cookies, and the "analytics" category is technically disabled. The banner records your consent so that it is ready in case we decide in the future to enable aggregate analytics tools. For traffic statistics we may use cookieless aggregate analytics tools (e.g. Cloudflare Web Analytics): they use no cookies or personal identifiers, do not track individual visitors, and therefore do not require consent.

You can change your preferences at any time by clicking the "Cookies" item in the site footer, or by clearing the site data from your browser.

10. Data breach notification

In the event of a personal data breach that poses a risk to users' rights and freedoms, we undertake to:

• Notify the Italian Data Protection Authority within 72 hours of becoming aware of the event, as required by Art. 33 GDPR.
• Inform the affected users without undue delay, pursuant to Art. 34 GDPR, where the breach poses a high risk to their rights.
• Document the event, its causes, effects, and the measures taken.
• Adopt the technical and organizational measures necessary to contain the damage and prevent recurrence.

11. Requests from legal authorities

CartIrya may be required to disclose personal data to judicial authorities, law enforcement, or public bodies in the presence of a valid order (for example a court order, a reasoned request from a competent authority, a legal obligation).

In these cases:

• We assess the request to verify its legitimacy and proportionality.
• We provide only the data strictly necessary to respond to the request.
• Where the law allows, we notify the affected user before releasing the data, unless expressly prohibited by the requesting authority or where it would endanger an ongoing investigation.
• We keep a register of the requests received, fulfilled, or rejected.

12. Controller identification and DPO

Data controller: CartIrya

• Controller email: [email protected]

Data Protection Officer (DPO): pursuant to Art. 37 GDPR, the appointment of a DPO is mandatory only for: (a) public authorities or bodies, (b) core activity consisting of large-scale systematic monitoring, (c) large-scale processing of special categories of data. CartIrya, as of today, does not fall within these categories and has not appointed a DPO. Requests regarding data protection should be addressed directly to the controller via [email protected]. Should the thresholds be exceeded (e.g. significant growth of the user base), we will consider appointing a DPO and will update this policy.

13. Changes

We reserve the right to update this policy. In case of substantial changes, we will notify you by email or through a notice on the platform. Minor changes (formal corrections, clarifications) will be published here without prior notice, with an update of the version number at the top of the page.