Privacy Policy
Controller: Daniele Romei
Address: Via San Pietro 11, 10020 Riva presso Chieri (TO), Italia
Tax identifier: C.F. RMODNL82D03C236V - P.IVA 05401440960
Effective date: 2026-09-29
Privacy contact: privacy@welmemo.com
Service and browsing data
WelMemo manages accounts and house sites. The data controller is Daniele Romei; the privacy contact is privacy@welmemo.com. The server receives IP addresses, requests and technical browser information to deliver and protect the service.
Accounts, email verification and authentication
Name and email are used for initial verification; an account is created after verification and registration completion. Passwords are stored as hashes. Verification and reset tokens, sessions, administrator authentication and revocation checks protect access. Do not share verification or recovery links.
Content and media
Owners enter text, contacts and images and choose what to publish. House sites display published content; guests can view an open house and request offline storage. Protected houses require authorization and cannot be saved offline. Copies already saved on guests’ devices cannot be deleted remotely. Owners must be entitled to publish other people’s data.
Security and support
Rate limits and quotas counter abuse and fraud and protect accounts. Counter identifiers do not contain clear-text emails or IP addresses; this does not anonymize all server logs. Support mode allows authorized staff to access a customer’s area when necessary and records audit operations.
Payments, email and translation
Payment takes place in PayPal’s environment, where PayPal processes the necessary data under its own privacy notice. Card payments use PayPal-hosted fields on the payment page: WelMemo never receives or stores PAN or CVV. For payment and explicitly authorized annual renewal it retains an encrypted token, provider references and minimal card metadata. The token is revoked when no longer needed; if the provider is unavailable, the local copy is deleted within 7 days of disabling renewal. The token is excluded from ten-year accounting retention. WelMemo retains only references needed for subscription status, transactions, reconciliation and administrative obligations. Transactional verification, recovery and service emails are sent through the SMTP service. Only text the user chooses for automatic translation is sent to Google Cloud Translation, Basic API. Avoid including unnecessary personal data in text to be translated.
Turnstile and optional statistics
Cloudflare Turnstile protects flows subject to anti-bot checks and may process necessary technical signals, such as IP address, browser/user-agent information, TLS fingerprint and origin/sitekey. Cloudflare acts to protect the site and may also process some signals under its own privacy notice to improve Turnstile; it is not an advertising tool. Google Analytics is currently disabled. If enabled in future, it will load only after consent for optional marketing-page statistics. No Analytics tag or ping is sent before consent. Refusing does not limit the service; you can change or withdraw your choice through Manage cookies.
Retention, recipients and legal grounds
Registration, account management, delivery of WelMemo, hosting and publication of user-selected content, transactional emails, service-related support and user-requested automatic translation rely on a contract or pre-contractual steps (Article 6(1)(b) GDPR). Administrative, tax and accounting data and records that must be retained under applicable obligations rely on a legal obligation (Article 6(1)(c)). Security, prevention of abuse, bots and fraud, account protection, strictly necessary technical logs, audit and protection of service integrity rely on the controller’s legitimate interests (Article 6(1)(f)), limited to what is necessary and subject to the balancing required by the GDPR. Consent (Article 6(1)(a)) applies exclusively to optional statistics/Google Analytics, if and when enabled. Session and storage durations are described in the Cookie Policy; token validity is not the retention period of its record. Technical logs are retained only as long as necessary for security and audit purposes. When the subscription expires, the service and house site become unavailable. The account and content remain recoverable through renewal for 12 months after expiry; after that period without renewal, content and personal data no longer needed are deleted and the account is anonymized. The minimum necessary administrative, accounting and payment data are retained separately for 10 years from the relevant accounting reference date, then deleted when no longer needed. Further retention may occur only for a specific applicable obligation or to establish, exercise or defend rights or legal claims, managed separately. Copies already downloaded to offline devices cannot be deleted by the server.
Rights and contact
To exercise applicable rights of access, rectification, erasure, restriction, portability or objection, write to privacy@welmemo.com. Statistics consent may be withdrawn at any time without affecting the lawfulness of processing before withdrawal. You may complain to the competent supervisory authority. Requests are assessed under applicable law and retention obligations.
Recipients and transfers
As necessary for their respective functions, data may be processed by the hosting/infrastructure and email provider, Google Cloud Translation for text selected for translation, Cloudflare Turnstile for protected-flow security, PayPal for payments and subscriptions, and authorized technical/administrative staff. Data may be disclosed to authorities or other parties where required by law. Some providers may also process data outside the European Economic Area. Where applicable, transfers take place under the safeguards provided by the GDPR and the providers’ relevant agreements/privacy notices, such as adequacy decisions, standard contractual clauses or other mechanisms provided by law.
Providing data and automated decisions
Email and data required for registration and account management are necessary to enter into and perform the service contract; payment data are essential to activate or renew the subscription. Without mandatory data, the account cannot be properly created, activated or managed. House content is optional and chosen by users according to what they wish to share. WelMemo does not make decisions based solely on automated processing that produce legal or similarly significant effects on users. Turnstile may automate anti-bot checks to protect specific flows.