Privacy

Elia Scarafoni — Key To Clean
Contrada Vigana 25, 21034 Cocquio-Trevisago (VA), Italia
keytocleanstore@gmail.com

Data controller. The controller is Elia Scarafoni, operating under the Key To Clean brand, at the address and contact details shown on this page. Contact keytocleanstore@gmail.com for privacy enquiries and requests.

Data and purposes. Technical browsing data is processed to provide and secure the website. For purchases we process your name, email, phone, address, products, amounts, consents and order status to conclude and perform the contract, provide support and handle payment and legal obligations. Required information is necessary to complete these activities; without it you cannot order, but you can browse the website.

Legal bases. Requested accounts, orders and pre-contractual enquiries are processed to perform a contract or take steps at your request. Accounting and tax records are processed to meet legal obligations. Security and abuse prevention rely on the controller’s legitimate interests, subject to your rights. Newsletters and promotional messages require separate, optional and revocable consent.

Newsletter and waiting list. With your consent, we record your email, language, date and notice version to send brand updates and offers. Withdraw consent at any time by emailing keytocleanstore@gmail.com or using the unsubscribe link in promotional messages, if sent. Withdrawal does not affect previous lawful processing or an order already concluded. Essential order messages are not promotional messages.

Payments. Card payments use Stripe: full card details and the security code are entered on the provider’s protected page and are not stored by the Key To Clean website. We receive technical identifiers, amounts and results needed to manage your order. For bank transfers we process references needed to verify receipt. Stripe also processes data under its own notice at stripe.com/privacy.

Providers and recipients. Vercel hosts the website. When enabled, the PostgreSQL database and transactional email service process only data needed to store orders and send messages; the prepared email integration uses Resend. Delivery details may be shared with the appointed carrier and professional advisers assisting with obligations. Data is not sold or disclosed for advertising purposes.

International transfers. Providers may process data outside the European Economic Area. Where required, the controller checks for an adequacy decision or another GDPR safeguard, including standard contractual clauses. Contact the controller for information on safeguards and providers actually enabled. A European database location does not by itself exclude every international transfer.

Retention. Guest cart and account session cookies last up to 30 days. Legacy sign-in links expire after 15 minutes, and expired technical records are deleted during scheduled maintenance. Orders and required records are kept for applicable legal obligations and protection of rights, normally up to ten years for records subject to accounting retention. Account data is kept while the account is used or until a closure request, subject to further obligations. Promotional consent is managed until withdrawal or the purpose ends and is periodically reviewed. Enquiry data is kept as long as needed to handle the request and resulting contractual matters.

Security. We use protected connections, access controls, HttpOnly sessions, random identifiers, verified payment notifications and request limits. Technical identifiers used for abuse prevention are cryptographically transformed and are not used for commercial profiling. The website does not make legally significant decisions based solely on automated profiling.

Your rights. Where applicable, request access, rectification, erasure, restriction or portability, object to legitimate-interest processing and withdraw consent. Email keytocleanstore@gmail.com; we may request only information necessary to verify identity. You may complain to the Italian data protection authority at garanteprivacy.it. Requests do not remove applicable retention obligations.

Business partnerships. Company enquiry data is used to assess and respond to the proposal. If direct delivery is unavailable, the site explains this and may prepare a draft in your mail app; sending requires your action. An enquiry does not subscribe you to marketing.

Testimonials and social links. Community photos and screenshots are hosted by this website without automatically embedding Instagram tracking tools. The controller must have the rights and legal basis to publish the content. Contact keytocleanstore@gmail.com about concerns or removal requests. External websites open when you choose to follow a link and apply their own notices.

Optional customer account. Guest checkout remains available. If you create an account we process your name, email, optional phone, securely hashed password and technical session records to provide the requested area. Orders linked to your email become visible after verification. Multiple saved addresses are optional; changes do not alter past orders.

External sign-in. When available and chosen by you, Google and Apple provide the account identifier, email and available name to authenticate you. We do not request access to mail, contacts or files. Apple may provide a private relay address. Additional methods are linked from a recently authenticated account; accounts with different emails are not automatically merged. Google and Apple also process data under their own notices.

Account email and security. Email-verification and password-reset links expire in one hour and can be used once. Sessions last up to 30 days unless signed out or revoked. Passwords, tokens and keys cannot be viewed in the admin area. Technical identifiers used for abuse limits are cryptographically transformed.

Account providers. Authentication runs within the website using the Better Auth library, without an external hosted authentication service. Vercel hosts the site, Neon stores the PostgreSQL database and Resend delivers transactional email. Stripe handles payment and Spediamo.it receives necessary delivery details. Google and Apple credentials are used only when you choose those methods.

Closure and retention. Request closure in settings: access is disabled and sessions revoked. When processed, saved addresses and sign-in methods are deleted and the profile is anonymised. Orders and retention obligations remain separate. A cryptographic email fingerprint is retained to prevent benefit misuse, without storing the plain email in that register. Newsletter consent remains separate and optional.

Version: 2026-10-24-accounts