Privacy notice
Who manages your data
The data controller is Andrea Gadducci, owner of the sole proprietorship Kreluna Software. You can contact us at info@kreluna.it with [COSMORA] Privacy in the subject line. This notice covers the COSMORA website and app.
Account and profile
We process your email address, account identifier, credentials managed by the authentication service, and the public name and country entered in your profile. If you sign in with Apple or Google, we receive the data made available by that sign-in service, such as your email address, name and profile picture. We do not receive your Apple or Google account password. These data are used to create and maintain your account and provide the requested features, on the basis of performing the service (Article 6(1)(b) GDPR). Required fields are necessary for the relevant feature; without them, you may be unable to use it.
Community, listings and messages
We store the photos and videos you upload, post and listing descriptions, messages, saved preferences and crew memberships so that you can use these features. Your public name, country, posts and listings may also be visible to visitors who are not signed in. Messages are intended for the conversation participants; they are not public posts. Do not enter sensitive data or information about other people without a legitimate basis. Publicly shared content may be copied by others: deleting it from COSMORA does not automatically remove external copies.
Sellers and orders
For your seller profile, we process the contact details, country, and commercial, billing and delivery information you enter. Shops are also asked for business details and terms of sale. Payments, Stripe account connection, deposits and rentals are disabled in this version. Any test orders created previously retain the participants, products, amounts, statuses and Stripe identifiers; participants can view them and use the available actions for test orders. The necessary identifiers may be sent to Stripe to check or refund those test transactions. None of these operations represents a real payment collection, shipment or refund. Do not enter card, bank account or identity-document details in the app’s fields.
Photos, location and optional features
We access the files you choose to upload; we do not automatically publish your entire photo library. The background removal module in the selling section processes the image on your device after the optional model is loaded; subsequently publishing the photo is a separate action. The OpenStreetMap map loads when you open it and communicates your IP address and displayed area to the provider. GPS location is used on your device only when you enable it, to show your position on the map; the component does not save coordinates in the COSMORA database. Map requests may nevertheless reveal the displayed area. You can revoke permissions in your device settings and use other features without GPS.
Support and security
We process messages sent to support, reports and blocks to respond to requests and combat abuse. Automatic text checks may suspend the publication of content pending review; you can ask support for a review. Security and moderation operations are based on the legitimate interest in protecting users and the service (Article 6(1)(f) GDPR), subject to the right to object. Any mandatory compliance obligations are based on Article 6(1)(c) GDPR. Do not send passwords, temporary codes or full card details to support.
Providers and technical data
We use Supabase for authentication, databases and files, Sites and Cloudflare infrastructure to serve the website, and Aruba for support email. Apple and Google are involved when you use their sign-in options; OpenStreetMap is involved when you open the map. Stripe may be involved in managing any previous test orders. Infrastructure providers may process IP addresses, requests and technical logs necessary for operation and security. Session data and technical preferences, such as language, are stored on your device. We do not use these data for behavioural advertising. External services may operate in multiple countries: we do not guarantee that all processing takes place exclusively within the European Economic Area. You can request information about recipients and applicable safeguards at info@kreluna.it.
Retention and deletion
Your account and content are retained while you maintain your account or until you request deletion, unless they are needed to manage transactions, disputes or legal obligations. The retention period for support and security data depends on the handling of the request or incident and the need to protect rights; logs and backups also depend on the infrastructure service used. We do not promise instant deletion from every backup. You can delete your account using the dedicated feature: the process removes the account, associated content and files. If there are real transactions to handle, the process requires you to contact support. If deletion fails, write to us to complete your request.
Your rights
Where provided for by the GDPR, you may request access to, rectification, deletion, restriction and portability of your data, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing. Write to info@kreluna.it: we may ask for the information strictly necessary to verify your identity. You have the right to lodge a complaint with the Italian Data Protection Authority or the competent authority in your country.
Updates
We will update this notice if features or data processing change. In particular, any activation of real payments will require updated information before they are used. Last updated: 3 October 2026.