Privacy Policy

The controller of the personal data collected through Flippy (the "Service", available at www.my-flippy.click) is Tiziano Teso, residing at Via Fratelli di Dio 323, 20099 Sesto San Giovanni (MI), Italy (the "Controller").

For any question about your personal data you can write to privacy@my-flippy.click.

The Controller has not appointed a Data Protection Officer (DPO), as this is not required under Article 37 GDPR.

2.1 If you create an account

• Email address, used to identify you and to send you sign-in links.
• Password, only if you choose to set one. It is stored in hashed form by our authentication provider: nobody, not even the Controller, can read it.
• Sign in with Google: if you choose this option, Google shares with us the email address, name, profile picture and an identifier of your Google account. We never receive your Google account password.

2.2 If you subscribe to a paid plan

• The chosen plan, the subscription status, the renewal date and the customer and subscription identifiers at Stripe.
• You enter your payment details (card, billing address) directly on Stripe's payment page: the Controller does not receive or store them.

2.3 The content you publish

• The pages of your documents. The PDF you upload is converted into images directly in your browser: only the page images reach and remain on our servers, not the original PDF file.
• Title, display settings, any logo, interactive links and, if you enable lead collection or sell the flipbook, the publisher name and contact you provide.
• The total number of views of each flipbook. It is a single counter: we do not record who read the flipbook.

2.4 If you read a flipbook that collects contacts ("email gate")

Some publishers ask for your email address before showing the flipbook. In this case we collect your email and, only if you tick the box, your consent to receive communications from the publisher.

For this data the controller is the publisher of the flipbook, whose name and contact are shown in the form itself. Flippy's Controller processes it only on behalf of the publisher, as a processor (Article 28 GDPR), and does not use it for its own purposes. You can exercise your rights with the publisher; you can also ask us directly to delete your email from all flipbooks, from the erasure request page.

2.5 If you buy a flipbook

• The email address you provide, the purchased flipbook, the amount and the date of purchase. We use them to send you the permanent access link to the flipbook and to resend it on request.
• The access link is personal: our systems only store a hashed fingerprint of it, not the link itself.
• Payment is made to the Stripe account of the flipbook's author, who is the seller towards you and processes payment data as an independent controller.

2.6 Technical data

When you visit the site, our hosting and infrastructure providers receive your IP address and the technical data of the request (browser, operating system, requested page), which are needed to deliver the pages and to protect the Service from abuse. The Controller does not use this data to profile you.

The Service does not use analytics tools, advertising pixels or profiling cookies. It only uses technical cookies and local storage, described in the Cookie Policy.

2.7 If you write to us

The email address and the content of the messages you send to our contact addresses, in order to answer your request.

• Creating and managing your account, providing the Service and publishing your flipbooks: performance of a contract (Article 6(1)(b) GDPR).
• Managing your subscription and payments: performance of a contract (Article 6(1)(b)).
• Sending you the access link to a purchased flipbook: performance of a contract (Article 6(1)(b)).
• Keeping the payment records required by law: legal obligation (Article 6(1)(c)).
• Protecting the Service from abuse and fraud and handling reports of illegal content: legitimate interest (Article 6(1)(f)).
• Answering your requests: performance of a contract or legitimate interest (Article 6(1)(b)/(f)).
• Answering requests from authorities: legal obligation (Article 6(1)(c)).

The Controller does not send promotional communications and does not transfer or sell your data to third parties.

Data is processed by providers acting as processors on behalf of the Controller, bound by a data processing agreement:

• Supabase, Inc. — database, authentication and content storage. Data is stored on servers in the European Union (Frankfurt, Germany).
• Vercel, Inc. — website hosting.
• Stripe — processing of subscription payments. For European customers the provider is Stripe Payments Europe, Ltd. (Ireland).
• Amazon Web Services, Inc. (Amazon SES) — sending emails (sign-in links, confirmations and links to purchased flipbooks) and receiving the messages sent to our contact addresses. It processes email addresses and message content. We do not track email opens or link clicks.

The following are instead independent controllers, each under its own privacy policy:

• Google Ireland Limited, if you choose to sign in with Google, for the authentication of your Google account;
• Stripe and the author of the flipbook, for payments relating to flipbooks for sale;
• the publisher of a flipbook, for contacts collected through its email gate.

The database and content remain in the European Union. However, some providers are based or have servers in the United States: Vercel, Amazon Web Services (emails are processed in the AWS Virginia region) and, for support activities and some processing, Supabase and Stripe.

These transfers are based on the European Commission's adequacy decision on the EU-US Data Privacy Framework, for providers that participate in it, and on the Standard Contractual Clauses approved by the Commission and included in the providers' data processing agreements (Articles 45 and 46 GDPR).

• Account and content: as long as the account is active. If you delete your account, the account, flipbooks, images, logo and collected contacts are deleted immediately and any subscription is cancelled; database backups are overwritten within the provider's rotation period.
• Payment records: kept by Stripe for the period required by tax law, up to 10 years, even after the account is deleted.
• Contacts collected through an email gate: until the publisher deletes them, or until you ask for their deletion.
• Flipbook purchases: as long as the purchased flipbook remains published, so that you can keep accessing it.
• Erasure requests: the confirmation link expires after one hour; the request remains recorded as proof that it was carried out.
• Technical data: kept by hosting providers for a few days, unless needed for security reasons.

Under Articles 15-22 GDPR you have the right to:

• access your personal data and receive a copy;
• ask for its rectification;
• ask for its erasure;
• ask for the restriction of processing;
• object to processing based on legitimate interest;
• receive the data you provided in a machine-readable format (portability);
• withdraw any consent you gave at any time, without affecting the lawfulness of prior processing.

You can exercise many rights on your own: from your account Settings you can download your data and delete your account; from the erasure request page you can ask for your email to be deleted from the flipbooks that collected it. For anything else write to privacy@my-flippy.click: we reply within 30 days.

You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live.

The Controller takes appropriate technical and organisational measures to protect data: encrypted connections (HTTPS), passwords and access links stored only in hashed form, database access rules that let each user see only their own data, and access to administration systems limited to the Controller.

The Service is not intended for children under 14, the minimum age set in Italy for consenting to information society services (Article 2-quinquies of the Italian Privacy Code). If you believe a minor has provided us with personal data, write to us and we will delete it.

We may update this policy when the Service or the law changes. The date at the top shows the latest change. If the changes are significant, we will let you know by email or with a notice on the site.

Tiziano Teso
Via Fratelli di Dio 323, 20099 Sesto San Giovanni (MI), Italy
Email: privacy@my-flippy.click