This notice explains how Tardigrado handles the personal data of visitors to tardigrado.ai and users of the suite’s tools, under Regulation (EU) 2016/679 ("GDPR") and Legislative Decree 196/2003 as amended. Each tool has its own section (section 8).
1. Controller
Tardigrado Srl, VAT IT02041110475, Piazza XX Settembre 13, 51017 Pescia (PT), Italy.
Email: info@tardigrado.it
2. What data we process
- Account data: name, email address, password (stored only in encrypted form), chosen language and, if you sign in with Google, the identifier Google sends us.
- Workspaces: your personal workspace, the shared workspaces you take part in, and each member’s role.
- Tool content: what you create and save, described in the section for each tool.
- Subscription and billing data: plan, dates, name and billing address, any VAT number. Card details are entered directly on Stripe’s payment page: we never see or store them.
- Technical data: IP address, browser type, date and time of access and security logs, kept for the period stated in section 5.
- Aggregated site statistics: see section 6.
3. Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Create and manage your account, sign in, send service emails (confirmation, password reset, notices) | Performance of a contract (art. 6.1.b) | As long as the account exists |
| Provide the tools: saving, sync, versions, sharing, export | Performance of a contract (art. 6.1.b) | As long as the account or workspace exists |
| Subscriptions, payments, invoicing, free trials, promotional codes | Performance of a contract (art. 6.1.b); legal obligation for invoicing (art. 6.1.c) | Invoices and tax records: 10 years, as the law requires |
| Reminders for a discount or trial that is about to end | Performance of a contract (art. 6.1.b) | Until the discount or trial ends |
| Preventing abuse: one free trial per person, creation limits, blocking harmful accounts | Legitimate interest (art. 6.1.f) | A non-reversible fingerprint of the email address (SHA-256) is kept even after the account is deleted |
| Security, technical logs, backup copies | Legitimate interest (art. 6.1.f) | Logs: 30 days at most, unless a documented security need requires longer |
| Aggregated site statistics | Legitimate interest (art. 6.1.f), without cookies and without identification | Aggregated data, not linked to a person |
| Legal obligations and requests from authorities | Legal obligation (art. 6.1.c) | For as long as the law requires |
We do not use your content to train artificial intelligence systems, we do not sell it, and we do not carry out advertising profiling.
4. Inactivity
If an account has no active subscription and is not used for 24 months, we send you an email 30 days before deletion and another 7 days before. If you sign in in the meantime, the count starts again. Accounts with an active subscription, or that own a workspace with an active subscription, are not deleted for inactivity.
5. Where the data is kept and for how long
Account and project data is kept on Cloudflare infrastructure in data centres in the European Union. A working copy also stays in your browser, so you can keep working without a connection: you can delete it by clearing the site’s data in your browser.
- Projects in the trash: recoverable for 30 days, then deleted.
- Deleting a shared workspace: its projects are deleted for all members.
- Deleting your account: data is deleted within 30 days, except backup copies, which expire within a further 30 days, and billing records the law requires us to keep.
6. Site statistics
To understand which pages are useful and where visitors come from, we use Cloudflare Web Analytics. It collects aggregated, anonymous data: visits, page views, country, device and browser type, and where traffic comes from. It sets no cookies, does not identify people and does not follow them from one site to another. We do not use tools such as Google Analytics, which would require a consent banner.
7. Providers
We use providers that process data on our behalf, or that act as independent controllers for some processing. Each has its own privacy notice, which you can read:
- Cloudflare, Inc.: hosting, databases, storage, security and aggregated statistics. Privacy policy.
- Stripe Payments Europe Ltd.: payments and subscription management. Stripe also processes payment data as an independent controller. Privacy policy.
- Resend, Inc.: sending service emails. Privacy policy.
- Google LLC: only if you choose to sign in with Google. Privacy policy.
Some providers may process data outside the European Economic Area. In those cases the transfer relies on the EU-US Data Privacy Framework or on the Standard Contractual Clauses approved by the European Commission.
8. Data by tool
Sumerian
We process the screenplays, boards, character sheets, saved versions and read-only links you create. When you import a screenplay (Final Draft, Fountain, PDF, Word), the file is read and converted in your browser: the original file is not uploaded to our servers, and only the resulting screenplay is saved, once you confirm the creation of the project. Each read-only link records the number of times it was opened, and can have a password and an expiry date.
CineCall
CineCall has no account and sends no data to our servers: the data you enter (for example contacts and settings) stays on your device, in the browser.
Tools coming soon
Each new tool will have its own section at launch, describing the data it actually processes.
9. Who can see your data
No one, except: you; people you invite to your workspace, with the role you give them; anyone who opens a read-only link you created; and Tardigrado staff, only for security reasons or for support at your request. The service administrator signs in to the management panel with two-step verification and normally sees only account data, not project content.
10. Your rights
You can ask at any time for access, correction, deletion, restriction and portability of your data, and object to processing based on legitimate interest (articles 15–22 GDPR), by writing to info@tardigrado.it. You can export your work at any time, in the formats each tool provides. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).
11. Cookies
Details are in the cookie policy.
12. Changes
We may update this notice. The date at the top shows the latest version; for significant changes we will notify you by email or in the app.