Privacy Policy

1. Who is responsible

The controller of your personal data is {OPERATOR_NAME}, {OPERATOR_ADDRESS}. You can contact us about privacy at hello@debuto.app.

We have not appointed a data protection officer, because our processing does not require one. For requests sent through a page owner's booking, order or newsletter form, the page owner is the controller and Debuto acts on their behalf (see below).

2. What we collect

Account data: your email address, display name, sign-in identifier and sign-in method.

Content you create: page text, links, images and videos you upload. Your published pages are public.

Billing data: Stripe handles your card details; we keep your Stripe customer and subscription identifiers, your plan, and a record of the checkout terms you accepted (the text version and the time).

Marketplace data: for buyers, the name, email and shipping address given at checkout and the order details; for sellers, the Stripe Connect account identifier and payout status. Stripe collects sellers' identity documents directly.

Reports: the reason and details you give, and your account if you are signed in.

Technical data: your network address is used briefly to protect the service and limit abuse. Page statistics record page views and clicks with the country, device type and referring site, without cookies, without your network address and without any identifier that recognises you.

3. Why we use it and on what legal basis

To provide your account, publish your pages, take payments and run the marketplace: performance of our contract with you.

To keep accounting and tax records, report seller income where tax law requires it, and handle reports of illegal content: compliance with our legal obligations.

To keep the service secure, prevent fraud and abuse, moderate content and produce aggregated page statistics: our legitimate interests, balanced against yours. You can object to this processing at any time.

Where we ask for your consent, for example to connect an outside service, you can withdraw it at any time without affecting earlier processing. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Cookies and analytics

Debuto does not use advertising, profiling or tracking cookies, so we do not show a cookie banner. We set only a strictly necessary cookie that keeps you signed in, and your browser stores technical settings needed for the service to work.

Our site statistics use Cloudflare Web Analytics, which counts visits without cookies and without identifying you.

5. Who receives your data

We use processors that act only on our instructions under data processing agreements: Cloudflare (hosting, database, file and video storage, email delivery, network security and site statistics) and Google Firebase (sign-in).

Stripe processes payments and payouts; for identity checks, fraud prevention and its own legal duties Stripe acts as an independent controller under its own privacy policy.

Sellers receive the name, shipping address and order details of their buyers in order to deliver. Page owners receive the requests sent through their forms. We disclose data to authorities when the law requires it. We do not sell personal data.

6. International transfers

Our providers are based in or have group companies in the United States, and some data may be processed outside the European Economic Area. These transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, to which these providers are certified, or on the standard contractual clauses approved by the Commission.

7. How long we keep it

Account and content data: while your account is open. When you ask us to delete your account, we delete your content and personal data within 30 days, and copies in backups expire within a further 30 days.

Payment, invoicing and tax records, including the record of the checkout terms you accepted: for ten years, as Italian tax and accounting law requires.

Booking and order requests: 365 days. Network-address hashes: at most 48 hours. Page statistics: while the page exists.

Reports and moderation decisions: for as long as needed to handle the report, any challenge and any legal claim.

8. Your rights

You have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, to receive the data you gave us in a portable format, and to withdraw consent at any time.

To exercise a right, including deleting your account or getting a copy of your data, write to hello@debuto.app from the email address of your account. We reply within one month and may ask you to confirm your identity.

You can also complain to a data protection authority, in particular in the country where you live or work. In Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it).

9. Children

Debuto is not meant for people under 16 and we do not knowingly collect their data.

10. Changes

We will update this policy when our practices change and tell account holders about material changes by email; the date above shows the latest version.