Privacy notice

Last updated: 16 September 2026

This notice explains which personal data the Galindo app processes, why, who we share it with, how long we keep it, and what your rights are. It is written under Regulation (EU) 2016/679 (GDPR).

1. Data controller

The data controller is Luca Carnaroli, based at Via 9 Strada, 61032 Fano (PU), Italy, tax code CRNLCU98B18D488K.

For anything about your data, write to support@galindo.app.

2. What data we process

2.1 Account data

When you create an account we collect your email address and the name you provide. If you sign in with Google or with Sign in with Apple, we receive your email address and name from that provider.

With Sign in with Apple you can choose to hide your real address: in that case we receive a relay address generated by Apple and never learn the real one.

If you sign in with email and password, we never see your password: it is stored in encrypted form by our authentication provider.

2.2 Preferences

We store the language you use the app in and the currency you chose for amounts. They are used to display the app and to write to you in your language.

2.3 Data you enter about your vehicles

• Make, model, number plate, registration date, fuel type, transmission, engine size, tyres, dimensions
• Purchase date and price, mileage
• Deadlines (road tax, insurance, inspection, servicing, fines) with amounts, dates and payment status
• Jobs and events (maintenance, breakdowns, accidents, modifications) with costs, garage and notes
• Refuels and charges with amounts, quantities and station
• Notes you choose to add
• Photos you attach to vehicles and to individual entries

Number plates and photos of vehicle documents are personal data, because they relate to a vehicle that can be linked to a person. Only enter documents that are yours or that you are authorised to use.

2.4 Technical usage data

To apply plan limits we record how many scans and documents you generate each month. We also keep track of the service emails already sent (which email and when), so we never send you the same notice twice.

We do not profile your behaviour, we do not use analytics or advertising trackers, and we do not show ads.

2.5 Purchases and subscriptions

Payments are handled entirely by Apple: we never receive or store your card details.

To manage purchases and subscriptions we use RevenueCat, which receives purchase receipts from Apple linked to a random identifier of your account. We do not share your name or email address with RevenueCat.

In our database we store the status of your subscription: the active plan, its expiry date, whether a free trial is running, and whether auto-renewal is on.

3. Why we process this data

We do not send newsletters or promotional messages.

4. Document scanning

When you use scanning, the photo is sent to Anthropic, which analyses it to extract the fields (garage, amounts, dates, mileage) and returns the result to us.

• A photo is sent only when you start a scan, never automatically.
• We do not store the scanned photo: we only keep the extracted data you confirm. If you want to keep the image, you can attach it to the entry yourself.
• Anthropic keeps the photo and the result for up to 30 days, then deletes them automatically, and does not use them to train its models. It may keep them longer only if a request breaches its usage policies or if the law requires it.
• Anthropic is based in the United States: sending the photo is a transfer outside the European Union (see § 6).
• You can always enter the data by hand: scanning is a convenience, not a required step.

5. Who we share data with

We rely on the following providers, who process data on our behalf and only for the purposes listed.

We do not sell your data and do not share it with third parties for advertising or marketing.

6. Transfers outside the European Union

Some providers are based in the United States. These transfers rely on the safeguards in Chapter V of the GDPR: the standard contractual clauses adopted by the European Commission and, for providers that have joined it, the EU-U.S. Data Privacy Framework.

7. Security and retention

Data is encrypted in transit and protected by rules that let each user access only their own data. Photos are kept in a private area and open only through temporary links generated for their owner and valid for one hour.

We keep your data for as long as your account is active. When you delete your account, we irreversibly delete your profile, vehicles, deadlines, events, refuels, photos, usage counts and the log of emails sent.

The only things that remain, outside our direct control, are:

• at RevenueCat, the purchase history linked to your account's random identifier, which contains neither your name nor your email;
• at Apple, the purchase data it keeps under its own privacy policy;
• at Anthropic, any scans from the last 30 days, until they are deleted automatically.

Deleting your account does not cancel an active subscription: you cancel it from your Apple ID settings.

8. This website

galindo.app uses no profiling cookies, analytics tools or advertising pixels. Fonts are served directly from our own domain. Cloudflare, which hosts the site, processes visitors' IP addresses to deliver pages and protect them from attacks.

The account confirmation and password recovery pages talk to Supabase only to complete the action you requested.

9. Your rights

You can ask at any time to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. In the app you'll find "Download my data" and "Delete account" to do this directly.

For any other request write to support@galindo.app. You also have the right to lodge a complaint with the Italian data protection authority (garanteprivacy.it) or with the authority of the country where you live.

10. Children

Galindo is not intended for anyone under 16, and we do not knowingly collect their data.

11. Changes

If we update this notice, we publish the new version here with its update date. For material changes we also let you know in the app.