Privacy policy

Data controller and contact

Data controller: Ordito, the company that offers and develops the Tintoret.to Service. For privacy requests or support, contact support@tintoret.to.

Personal data we collect

• Account and authentication data (name, email, profile image, and identifiers associated with Google login).
• Usage and configuration data (credits, requested actions, preferences and settings, Drive integration state).
• Content processed to deliver the Service: uploaded images, prompts/text, markup, and generated outputs.
• Payment-related data (status and transaction/order identifiers) handled via external providers (e.g. PayPal). We do not store full card details.
• Optional data such as newsletter email and saving preferences (e.g. selected Drive folder).
• Technical data (e.g. IP address, user agent, timestamps, technical cookies, security logs).

Sources of data

• From you (account creation, Service usage, support, newsletter).
• From Google when you sign in and, if enabled, when you connect Drive.
• From payment providers to confirm payment status.
• Automatically from your device/browser (technical and security logs).

Purposes and legal bases

• Provide the Service and manage your account (contract).
• Run AI processing and return results (contract).
• Handle payments and legal obligations (legal obligation).
• Security, abuse prevention, debugging and reliability (legitimate interests).
• Newsletter, guides and marketing communications by email (consent, if given).
• Tailoring offers based on app usage, purchases and remaining credits (separate consent, if given).

Communication and tailored-offer preferences

These preferences are optional, separate from delivery of the Service and are not preselected. You can choose whether to receive marketing communications and, separately, offers tailored using information such as activity, purchases and remaining credits. You can change or withdraw either choice at any time in the app Settings or through the unsubscribe link in every marketing email.

We retain the preference status, date, source and identifier of the policy version shown. Policy text is maintained once per version and is not duplicated in every user's profile. Essential operational emails about the account, security and purchases are not marketing communications.

AI providers and content processing

To deliver AI features, the Service may send your inputs (such as images and prompts) to the AI provider used by the app (for example Google). The provider's processing is governed by their own terms and privacy notices.

Google Drive (optional)

If you connect Google Drive, the app requests the permissions needed to save files in the folder you choose. Files are uploaded from your browser directly to your Drive. Access tokens are managed according to the integration mode configured by the admin.

Sharing and recipients

We share data only with providers that help deliver the Service (e.g. hosting, security, email, payments, Google login, AI providers, and Google Drive if connected). We do not sell personal data.

Transfers outside the EEA

Some providers may process data outside the European Economic Area. Where applicable, we use appropriate safeguards (such as standard contractual clauses and technical/organizational measures) to protect data.

Retention

We retain data only as long as needed to provide the Service and meet legal obligations. In general:

• account data is retained while your account is active, or until you request closure;
• technical and security logs are retained for a limited, proportionate period;
• payment-related data follows retention required by providers and/or law.
• evidence of privacy preferences and later changes is retained to document those choices; the minimum data needed to honor an opt-out may be kept after withdrawal to prevent further marketing messages.

Security

We use reasonable technical and organizational measures to protect data (access controls, encryption where appropriate, monitoring and anti-abuse protections). No system can guarantee absolute security.

Your rights

You may exercise rights available under applicable law (access, correction, deletion, restriction, objection, portability). To make a request, contact support@tintoret.to. You may also lodge a complaint with your supervisory authority (in Italy: Garante per la protezione dei dati personali).

Cookies and local storage

We use technical cookies and local storage for authentication, preferences and security. If and when we introduce non-essential cookies (for example non-technical analytics or marketing), they will be managed via a dedicated consent flow.

Updates

We may update this policy to reflect service changes. The last updated date indicates the current version.