/privacy

Privacy

Last updated: 12 October 2026

This page explains what Polpo does with your personal data. Polpo is run by Fabrizio Salis, an individual based in Italy (VAT no. IT12636170016), who is the data controller. You can reach me at support@polpo-tools.com.

What I collect, and why

• Your account. Your e-mail address and name, and a sign-in identifier. If you sign in with Google, Microsoft or Facebook, that provider sends me your name, e-mail address and a unique id; I never receive your password for it. This is needed to give you an account and to link your purchases to you.
• Purchases. Payments are taken by Paddle, which is the seller of record: it handles your card or payment details, VAT and the invoice. I receive your e-mail, name, country, and the order and invoice references, never your card number.
• Licenses and devices. The license key issued to you, and for each computer where you activate it a device identifier derived from the machine (not a hardware serial number), the app version and the operating system. This is needed to enforce the number of seats and to offer updates.
• E-mail. A message with your license is sent when you buy, from no-reply@polpo-tools.com, through the mail provider Mailtrap.
• Problem reports. Only if you choose to send one from PolpoSign. It contains what you wrote and, only if you leave the boxes ticked, system information (app version, operating system, language) and the recent log. You can untick both and send just your text. It is encrypted on your computer and only I can read it. It never contains your documents or file names. A report is anonymous unless you tick "Link this report to my account": then the portal keeps the link between the report and your account (your account e-mail is shown to support, who is told a report arrived), you see the report in your account, and you can unlink it there at any time, which makes it anonymous again.
• Server records. Basic technical logs (such as IP address and time) and an audit of administrative actions, for security and to investigate faults.

Your documents stay with you

PolpoSign opens and signs your PDFs on your own computer. Your documents, signatures and stamps are not uploaded to Polpo. When you send a photo of a signature from your phone, the photo is encrypted on the phone so that only PolpoSign on your computer can read it; the site only passes the encrypted data on, keeps it in memory for at most five minutes and deletes it as soon as your computer collects it.

Cookies

Polpo uses only technical cookies, which are needed for the site to work and do not need your consent. There are no advertising, tracking or analytics cookies, and the site's fonts are served by Polpo itself, not by a third party.

• .AspNetCore.Cookies: keeps you signed in (until you sign out).
• .AspNetCore.Antiforgery.*: protects the forms of the site from forged requests.
• .AspNetCore.Culture: remembers your language, Italian or English (one year).
• Short-lived cookies while you sign in, so that the sign-in can be completed safely.

The notice at the bottom of the site is remembered in your browser's local storage, not in a cookie. When you open the payment window, Paddle may set its own cookies, which are covered by Paddle's cookie policy; if you sign in with Google, Microsoft or Facebook, that provider sets its own.

Who else handles your data

• Microsoft Azure hosts the site and its database, in Sweden (EU), and Microsoft Entra External ID handles signing in.
• Google, Microsoft and Facebook, only if you choose to sign in with them.
• Paddle, for payments, invoices and VAT.
• Mailtrap, to send the license e-mail.

I do not sell your data and I do not use it for advertising.

Legal basis

• Contract (GDPR art. 6(1)(b)): your account, your purchase, your license and its seats, the license e-mail, updates.
• Legal obligation (art. 6(1)(c)): keeping purchase and invoice records for accounting and tax.
• Legitimate interest (art. 6(1)(f)): technical logs and the activity log, to keep the site secure and to investigate faults.
• Consent (art. 6(1)(a)): diagnostics and problem reports, only when you press Share or Send in the app. You can withdraw it at any time in the app, or from your account.

Transfers outside the EU

The site and its database are in the EU. Paddle (the seller of record) is in the United Kingdom, which has an EU adequacy decision, and may use providers elsewhere under its own safeguards. Google, Microsoft and Facebook, if you choose to sign in with them, and the mail provider may process data outside the EU under standard contractual clauses or equivalent safeguards. There are no other recipients.

How long I keep it

Your account and license data are kept while the account exists. Records of purchases and invoices are kept as long as the law requires for accounting and tax purposes. Diagnostics your devices shared are deleted after 90 days; problem reports are deleted one year after they are closed. Payment notifications stored by the site are deleted after one year, and the activity log after two. When you ask for your data to be removed, see how to delete your data.

Your rights

Under the GDPR you can ask to access, correct, export or delete your data, to restrict or object to its use, and to complain to the Italian data protection authority (Garante per la protezione dei dati personali). You can download a copy of your data yourself from your account (Download my data, as a JSON file) and delete it on the delete your data page. For anything else, write to support@polpo-tools.com and I will answer within 30 days.

Changes

If this page changes in a way that matters, the date above changes too.