Privacy Policy and Terms of Service

The data controller and provider of Sellstrap is Gianfranco Coratella, acting in his own name. Address: Via Mazzini no. 80, 74016 Massafra (TA), Italy. Contact for privacy matters, contractual communications, and reports: info@sellstrap.dev. Website: sellstrap.dev.

This policy covers Sellstrap visitors, registered users, and purchasers. It does not describe the processing of data belonging to users of software that purchasers will independently develop and operate using the code they receive.

To register and use an account, we process the email address, user identifier, and data needed for authentication and session management. Credentials are managed through Supabase Auth: passwords are not stored in plain text. Account verification and password recovery messages are handled by the authentication service.

If Google or GitHub sign-in is selected, the relevant provider supplies the authorized data, such as an identifier, email address, name, and profile picture. The provider independently processes data relating to its own service under its own privacy policy.

We process the name and description entered in the configurator and the selected modules to generate the requested file. The configuration is associated with the order and transmitted to Stripe in the payment session metadata, together with an account reference. There is no need to enter secrets, credentials, health data, or third parties' personal data in the description.

Payment takes place through Stripe Managed Payments. Stripe collects the data needed for the transaction and billing. Sellstrap neither receives nor stores the full card number or its security code. Stripe makes transaction data available, including the email address supplied at checkout; any additional billing data depends on the information collected by the payment service.

To record the purchase and deliver the product, we process order and account identifiers, amount, currency, date, payment and any refund status, delivery email address, purchased configuration, license key, file reference, and data needed to document the sending of the confirmation.

The customized file is kept in private storage. The LICENSE.md file inside the ZIP includes the purchaser's email address and license key as proof of purchase. These data therefore accompany copies of the downloaded archive: the purchaser must take this into account before sharing the project.

We use Resend for the delivery email and provide it with the recipient's address, message content, signed link, and license key. Receipts, invoices, and payment-related communications are handled separately by Stripe/Link.

Account and contract. Creating and managing the account, preparing the requested configuration, recording the purchase, generating the file, and sending the delivery email are based on performance of the contract or pre-contractual steps requested by the user under Article 6(1)(b) GDPR. Account management also applies to people who have not yet purchased.

Legal obligations. Processing needed for tax and accounting obligations or lawful requests from authorities is based on Article 6(1)(c) GDPR, within the limits of the obligations that apply to Sellstrap.

Security and protection of rights. Data strictly needed to prevent abuse, diagnose errors, and handle disputes may be processed on the basis of the legitimate interest in service security and the protection of rights under Article 6(1)(f) GDPR, with due regard for data subjects' rights.

Email and order data are required for their respective functions: without them, it is not possible to create an account or deliver the product. Signing in through an external provider is optional. Acknowledging this policy does not constitute consent to marketing or profiling.

Supabase provides authentication, the database, and private file storage. Vercel hosts the application and processes the technical data needed to provide it. Resend, a service of Plus Five Five, Inc., sends delivery emails. These providers act as processors for processing carried out on behalf of the controller under their respective agreements; they may have independent purposes for other data, within the limits of their own privacy policies.

Stripe/Link processes data for payment, fraud prevention, compliance, and transaction management under its own privacy policy and the roles set out in its agreements. Google and GitHub, if selected for sign-in, act as independent controllers for their own activities. Authorities or advisers may also receive data when necessary for legal obligations or the protection of rights. Internal access is limited to authorized persons.

Sellstrap's Supabase project is configured in the European eu-west-1 region. This location does not mean that all provider processing takes place exclusively in the European Union. Resend states that its main processing activities take place in the United States; other providers and subprocessors may process data outside the European Economic Area.

Transfers are governed by the applicable provider agreements using the safeguards required by the GDPR, including, where applicable, the European Commission's standard contractual clauses. Information about the safeguards and how to obtain a copy can be requested from the controller; the relevant agreements are linked in the references at the end.

Account: for as long as needed to make it available and manage it; when the account is closed, the ordinary authentication purposes end. Only data needed for other justified purposes, such as legal obligations or disputes, may remain.

Order, configuration, file, and license: for fulfilling and documenting the purchase, making the file available, and protecting related rights, limited to the necessary data. Documents subject to statutory retention follow the period required by the applicable law; this does not automatically extend retention of the entire account.

Logs, communications, and errors: for as long as needed for delivery, handling a specific report or security event, and checking it; any retention for a dispute is limited to relevant data. Backups follow the providers' technical cycles. Deletion is not presented as instantaneous across all backups.

The website uses technical cookies for authentication and session management and functional tools for language preference. Technical connection data and logs may include IP address, request date and time, requested resources, browser information, and error reports, to the extent processed by the infrastructure to provide and protect the service.

Supabase cookies in the sb-...-auth-token family, including when split into several parts, maintain the session. In the configuration examined, they have a maximum lifetime of 400 days from being set or renewed; that period is not the validity period of an individual token. The NEXT_LOCALE cookie stores the language and is configured as a session cookie. Users can delete these cookies in their browser, losing their session or preferences. Strictly necessary cookies do not require prior consent.

This policy does not authorize advertising cookies, marketing cookies, or additional tracking. Introducing them would require specific information and, where required, prior consent. The external Stripe/Link checkout is also subject to that service's privacy policy and settings.

Communications use HTTPS, and files are held in private storage. The account and download entitlement are checked before a link is obtained from the dashboard. Once issued, a signed link lets anyone holding it download the file while it is valid: it does not necessarily require another account sign-in. Users must keep it confidential.

The link sent by email is currently valid for seven days; links generated from the personal area have a short lifetime. Link expiry does not end the right to use code already lawfully downloaded.

In the cases provided for by Articles 15-22 GDPR, data subjects may request access, rectification, erasure, restriction, and portability, and object to processing based on legitimate interests. For any consent-based processing, consent may be withdrawn without affecting the lawfulness of earlier processing.

Requests should be sent to info@sellstrap.dev. The controller responds within the time limits of Article 12 GDPR, normally within one month; if the conditions for an extension are met, the controller communicates its reasons and duration. Proportionate information may be requested to verify identity. Erasure is subject to statutory limits and does not erase processing carried out independently by providers, to whom separate requests may be addressed.

A complaint may be lodged with the Italian Data Protection Authority (www.garanteprivacy.it) or the competent authority in the data subject's country. Sellstrap does not use the configurator to make decisions based solely on automated processing that have legal effects on individuals; Stripe's independent fraud prevention checks are described in its policy.