Privacy policy

Who is responsible for your data

The data controller is Matteo Gavin, an Italian sole proprietorship trading as Developpy, VAT number (P.IVA) 05367990289.

Registered office: Via D.M. Turoldo 6, 35020 Sant'Angelo di Piove di Sacco (PD), Italy.

For any privacy question or request, write to hello@developpy.io.

What this policy covers

This is the information notice required by Articles 13 and 14 of the GDPR (EU Regulation 2016/679). It covers developpy.io in every language version. It does not cover the Developpy Partners portal at partners.developpy.io, which has its own privacy policy (opens in a new tab), the websites we link to, or the Shopify stores we build for clients, where the store owner is responsible for its customers' data.

The Checkout Upsell Builder app has its own privacy policy, linked from its Shopify App Store listing.

The Universe waitlist

When you join the waitlist we collect your email address, the only field of the form. We use it only to tell you when the Universe theme by Developpy is on the Shopify Theme Store and to send you news about Universe. Giving it is up to you; without it you cannot join the list.

Legal basis: your consent (Article 6(1)(a) GDPR). Your address is stored in a list hosted on Cloudflare; we send no confirmation email, and the first email you receive is the launch news.

You can withdraw your consent at any time through the unsubscribe link in every email or by writing to us. Withdrawing does not affect the emails sent before.

Your address is stored in Cloudflare KV, a key-value store of our hosting provider Cloudflare, which processes it on our behalf. The form does not keep a copy of it, and our server never writes it to its logs.

We keep your address until you unsubscribe or until we stop sending news about Universe, whichever comes first.

Emails and call bookings

When you write to hello@developpy.io, we use your message and the identification and contact details it contains to answer you and, if you ask for it, to prepare a quote. Legal basis: steps taken at your request before a contract, and our legitimate interest in answering business inquiries (Article 6(1)(b) and (f) GDPR). Our email runs on Google Workspace. Giving us your details is up to you, but without them we cannot answer you or prepare and carry out a contract.

The Book a call links open Calendly, a scheduling service. The details you enter there, such as your name, email address and notes, reach us through Calendly, which processes them on our behalf. Calendly's own privacy notice also applies on its site.

We keep business correspondence as long as we need it to handle your request. When a contract follows, we keep the related data for the periods Italian tax and civil law require, up to a maximum of ten years after the relationship ends, and longer only when we need it to establish, exercise or defend a legal claim. Legal basis: compliance with our legal obligations (Article 6(1)(c) GDPR) and our legitimate interest in defending legal claims (Article 6(1)(f) GDPR).

Hosting, security and logs

developpy.io is hosted on Cloudflare. To deliver pages and protect the site from abuse, Cloudflare processes technical data about every request, such as your IP address, the time, the page requested and your browser's user agent. This data is deleted once it has served its purpose, but it may be kept longer when needed to investigate a suspected attack on the site. Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).

Our own code on Cloudflare keeps your IP address in memory only, for a short time, to limit repeated waitlist submissions. It never writes it to storage. More generally, we process personal data by hand and electronically, with organizational, physical and technical measures that keep it secure and confidential.

Visit statistics

We count visits with Cloudflare Web Analytics. It sets no cookies, stores nothing in your browser and does not build a profile of you: it records page views with the page address, the referring site, the browser type and the country, and shows us totals. Legal basis: our legitimate interest in knowing which pages people read (Article 6(1)(f) GDPR).

Cookies

We set one cookie of our own, which remembers the language you chose. The cookie policy explains it.

Fonts and other sites

Our fonts are served from developpy.io itself, so your browser does not contact Google Fonts or any other font service. Pages load no third-party script other than the visit statistics described above, and no social media plugins.

Links to other sites, such as the Shopify App Store, the Shopify Partner Directory, LinkedIn, Calendly and the Partners portal, take you to services with their own privacy policies.

Who receives your data

• Cloudflare, Inc.: hosting, security and visit statistics.
• Cloudflare, Inc.: the Universe waitlist, stored in Cloudflare KV.
• Calendly LLC: call bookings.
• Google, through Google Workspace: our email.

Inside our business, only the people who need your data to handle your request can see it. We may also share it with independent controllers when one of the purposes above requires it. We do not sell your data, share it with advertisers or publish it, and we disclose it to public authorities only when the law requires it.

Transfers outside the European Union

These providers are based in the United States or process data there. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

Your rights

Under the GDPR you can ask us at any time to:

• tell you whether we hold data about you, which data and where it came from, and give you a copy;
• correct data that is wrong or incomplete;
• delete your data;
• limit how we use it;
• send it to you or to another provider in a common format;
• stop using it where we rely on our legitimate interest;
• stop using it where we rely on your consent, without affecting what happened before.

Write to hello@developpy.io. We answer within one month, as the GDPR requires.

You can also lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali (the Italian data protection authority) (opens in a new tab), or the authority of the country where you live or work.

Automated decisions and children

We make no automated decisions about you and do not profile you.

The site is meant for businesses and is not directed at children.

Changes to this policy

We update this page when what we collect changes, and change the date at the top.