Privacy notice
1. Who the data controller is
Mastino S.r.l., with its registered office at Via Lorenzo Maria Neroni 11, Caserta, VAT number 04755530617, legal representative Germano Milite.
Privacy contact: [email protected]
2. What data we process, why and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Email and account identifier (if you sign in with Google or Apple, also the name you choose to share) | Create your account, let you sign in and recover your password | Performance of a contract (Art. 6(1)(b)) |
| Your group's expenses, member names, categories and amounts, in encrypted form | Provide expense sharing and monthly accounts | Performance of a contract (Art. 6(1)(b)) |
| My expenses (average monthly net income and net income for individual months, income and expenses imported from your history, wealth, personal budget, daily personal expenses, fixed and extra expenses), only if you enter them | Show you how much you spend and how much you have left each month. Stored encrypted in your personal space, which only you can read | Performance of a contract (Art. 6(1)(b)) |
| Technical security and connection data (for example, IP addresses in server access logs) | Operate the site, ensure security and prevent abuse | Legitimate interests (Art. 6(1)(f)) |
| Account creation date linked to an encrypted code (not to an email or name), to count new accounts without duplicates | Aggregate daily, monthly and annual registration counts | Legitimate interests (Art. 6(1)(f)) |
| Only with your consent: which sections and features you use, how long the app is open and in use, how many sessions and on which days. We do not record names, emails, IP addresses, amounts, descriptions or any other expense content | Internal statistics to understand how the app is used and improve it | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Premium purchases: plan, amount paid, date, channel (Stripe or PayPal), payment reference, any discount or ambassador code used, Premium expiry date; if you choose to answer, how you heard about us | Activate and manage Premium, handle refunds, keep accounts and calculate ambassador commissions; understand, in aggregate form, which channels lead to purchases | Performance of a contract (Art. 6(1)(b)); accounting and tax obligations (Art. 6(1)(c)) |
| Only if you leave a review: the first name and surname you enter, avatar (only if you choose one), account email (never published), rating, text, submission and moderation dates; proof of consent to publication (date and time, consent version and wording) | Check that the review comes from a registered user, publish it after moderation and demonstrate that consent was obtained | Consent to publication (Art. 6(1)(a)), which you can withdraw; account verification and moderation: legitimate interests (Art. 6(1)(f)); retaining proof of consent: defence of a legal claim (Arts. 6(1)(f) and 17(3)(e)) |
| Profile avatar, if you choose one: a code of seven numbers (skin tone, hair, glasses…) that the app uses to draw a character on your device | Personalise your profile. Stored with your profile data in the family, encrypted like expenses | Performance of a contract (Art. 6(1)(b)) |
| Premium and discount codes: redeemed codes; for restricted codes, the email they are intended for; number of attempts to enter codes | Activate Premium with a code, prevent use by someone who is not entitled to it and block attempts to guess codes | Performance of a contract (Art. 6(1)(b)); legitimate interests in security (Art. 6(1)(f)) |
| Only for participants in the ambassador programme: name, email, personal code, agreed discount and commission, sales made with the code (date, plan, amount), commissions earned and payments received | Manage the ambassador programme, show ambassadors their sales, calculate and pay commissions | Performance of the contract with the ambassador (Art. 6(1)(b)); accounting and tax obligations (Art. 6(1)(c)) |
| Only if you enable notifications: technical delivery address provided by the browser (endpoint and keys), language, notification preferences, an encrypted family code used to notify other members | Send the alerts you choose: new family expenses, Premium expiry and reminders | Consent given through the browser permission (Art. 6(1)(a)), which you can withdraw at any time |
What we do not do: no advertising, no profiling, no use of data for marketing, no sale or disclosure to third parties, and no automated decisions about you.
Usage statistics (only with your consent). After you sign in, a banner asks whether you would like to help us improve the app. If you choose “Accept”, we measure how it is used, without your name or email: which sections and features you use, for how long (only while the app is open and you are using it), how many sessions and on which days. We do this with our own system, on our own servers (the European database described below): we do not use Google Analytics or any other external tracking services, do not send this data to third parties and do not use analytics or profiling cookies.
To distinguish new and returning users, we recognise you through an encrypted code calculated using a secret key that we hold and that does not reveal your email or account. Technically, it is a pseudonym; however, the results we view are solely aggregates (totals and averages by day, month and year), and we use them exclusively for internal statistics to improve the app: never for advertising, profiling or disclosure to third parties.
If you refuse or withdraw consent. We collect nothing and the app works in exactly the same way. You can choose or change your mind at any time in Settings, under “Usage statistics”. The banner appears for signed-in users who have not yet chosen, including users registered before this version, and we show it again if the purposes change. When you refuse or withdraw consent, we immediately delete the encrypted code relating to you: only previously calculated aggregate totals remain, which cannot identify you.
Premium purchases. Payment takes place on Stripe or PayPal pages: they process card or bank account details, and we do not receive them. We provide Stripe with your account email for the receipt. From Stripe and PayPal, we receive only the payment outcome, amount, date, plan and transaction reference, which we use to activate Premium, handle any refund and keep accounts. If you obtained a Premium code through a subscription to Fufflix (fufflix.it), the journalism publication also published by Mastino S.r.l., order data is processed by the same controller under the fufflix.it privacy notice: for Dividi Spesa, we use the order solely to generate the code and, in the event of a refund or cancellation, deactivate it.
“How did you hear about us?” Before payment, you may tell us how you heard about Dividi Spesa (for example, YouTube, a search engine or word of mouth) and, if you choose “Other”, describe it in a few words. This is optional and has no effect on your purchase. The answer is recorded with the sale and used only to count, in aggregate form, how many purchases come from each channel. We do not use cookies, pixels, tracked links or other tools to determine this automatically: we record only what you tell us. Legal basis: our legitimate interest in understanding where to promote the app (Art. 6(1)(f)), with an answer you provide freely; we ask you not to enter personal data in the “Other” field. It is kept with the sales register and you can request its deletion at any time.
Reviews. You can leave a review only if you have an account and its email address is verified: after signing in, you enter your first name, surname, a rating from 1 to 5 stars and optional text (up to 500 characters). One review per account. Your first name, surname, rating, text and date become public, visible to anyone and discoverable by search engines, only after our approval and only if you tick the consent box. Your email is never published. We do not verify your legal identity or how much you use the app (expenses are encrypted and we do not read them): we check that the account exists and the email is verified.
Avatar. You cannot upload photos or images: the avatar is a drawing generated by the app from a code of seven numbers, so it does not process data about your face or images of other people. It remains in your profile and, if you choose one, appears beside your name in your published review (with the consent you give by ticking the box). You can change or remove it at any time; removing the review also removes the avatar from the page.
How we moderate. We read every review before publication. We reject reviews only if they contain insults or accusations against people, other people's personal data, advertising or links, if they are not about Dividi Spesa or if they appear false; we do not reject or hide them because of their rating, and we do not offer discounts, payments or gifts in exchange for reviews. If we do not publish yours, we tell you why and you can edit and resubmit it. If you edit it after publication, it returns to moderation.
Withdrawing your review. You can withdraw it at any time from Review Dividi Spesa (link fufflix.it/dividispesa/app/#/recensisci, or Settings, Account), or by writing to [email protected]. We remove it from the page and delete the name, email and text; we keep only the date and proof of the consent you gave, so that we can demonstrate consent in the event of a dispute, for up to 5 years. Deleting your account also withdraws the review. If someone has already copied the published review (for example, a search engine), we cannot delete other people's copies.
If you have enabled push notifications, you may receive an alert about replies to your review; you can disable it in Settings. The alert does not contain the review or reply text. The administrator may reply to published reviews: the reply appears publicly as “Reply from Dividi Spesa”. If you edit the review, it returns to moderation and the previous reply is removed. Existing reviews remain valid even if they are shorter than the new limits.
Ambassador codes. If you use an ambassador's code at checkout, we record the code with the sale (date, plan, amount paid) to calculate their commission. The ambassador sees only dates, plans and amounts for sales made with their code: they never see your name, email or account. Ambassadors cannot use their own code for themselves.
Notifications. Notifications are optional and enabled through your browser or phone permission. The message sent contains no expense text or data: when it arrives, the app downloads only the type of alert to display from our server. Delivery goes through your browser or operating system's notification service (for example, Google, Mozilla or Apple). You can disable notifications at any time in Settings or in your browser settings.
Importing from files. The CSV or Excel file you import is read only on your device and is not sent to us: imported expenses and income are stored encrypted, like other entries.
Storage on your device. Apart from this, we use only the technical storage needed for the app to work (your sign-in session, app data and statistics choice), which does not require consent. The exception is the YouTube video player, which we load only when you press a video's cover image (see “Who we share data with”).
Providing your email is necessary to use the app; without it, we cannot create your account. If you sign in with Google, we receive your email and profile name from Google; we do not receive your password.
3. Your expenses are encrypted
Your group's expenses are encrypted on your device before they are sent. Only unreadable text reaches our servers (database in Belgium, European Union), and we neither read nor use the expenses.
Two modes. Standard (default): to let you recover your family on a new phone simply by signing in, the family's encryption key is stored in the database, linked to your account and itself encrypted with a key derived from the account. Only your account can read it through the database rules; however, the technical administrators of the database (Mastino S.r.l. and the provider Google) would have the technical ability to reconstruct it. We undertake not to access family content, except at the user's explicit request (for example, for support) or where required by law.
Maximum protection (optional, in Settings): the key is encrypted with a passphrase generated by the app and known only to you, which is never sent to or stored by us. In this mode, we are technically unable to read your expenses. On each new phone, you will be asked for the passphrase after signing in. If you lose it and no longer have any connected device, no one can recover the data, including us. You can enable or disable this mode at any time; if you disconnect the device or delete the family, the link with the account is deleted.
4. Data anonymity: what you can and cannot do
In Settings, Account, “Data anonymity” you will find two free tools that work on your device:
- Anonymous copy. Download a file with the same amounts, dates and categories, but without member names (they become “Person 1”, “Person 2”) or expense descriptions. It does not contain your personal savings, email or account identifier. It does not change your data and is not sent to us: you download it and decide whom to give it to.
- Anonymise past months. Permanently delete descriptions of expenses older than 3, 6 or 12 months, as you choose. Amounts, dates, categories and who paid upfront remain, so balances, charts and forecasts do not change. If synchronisation is active, the change applies to the whole family and all devices. It cannot be undone: the app recommends exporting a backup first.
The personal history you import from a CSV or Excel file (expenses and income) follows the same rules as other “My expenses” entries: it is stored encrypted in your account and no other member can see it.
What is not anonymous. Your account (email or Google sign-in) remains your identifier until you delete it in Settings, Account, “Delete profile”; it is needed to let you sign in, recover your password and recognise any Premium entitlement. Even after “Anonymise past months”, recent months, member names and fixed expenses remain as you entered them. An anonymous copy prevents identification from the file's content alone, but we cannot guarantee that someone already familiar with your spending habits could not recognise them from the amounts.
Why we do not anonymise accounts. An account with no reference to a person could not recover its password, be recognised as Premium after a refund or purchase, or exercise the rights provided by the GDPR (access, portability, erasure), because we would no longer know whose data it was. For this reason, we offer complete deletion instead of account anonymisation.
My expenses. The net income, imported income, wealth, budget and personal expenses you enter in “My expenses” are stored in the service's database, in an area readable only by your account (database rules), separate from the family: no other member sees them. Before being sent, they are encrypted on your device with a key derived from your account, and we neither read nor use them. As with the family's standard mode, the technical administrators of the database (Mastino S.r.l. and the provider Google) would have the technical ability to reconstruct this key: we undertake not to do so, except at your explicit request or where required by law. This lets you recover them if you change phones or clear your browser data: just sign in again. They are also included in the backup you export. Extra income entered manually remains only on the device. If you have not signed in, everything remains only on the device.
5. Who we share data with
We use providers that process data solely on our behalf, as processors (Art. 28):
- Google Ireland Limited / Google LLC (Firebase): email and Google sign-in (Authentication) and the encrypted database (Realtime Database).
- The public, solely for the first name, surname, rating, text and date of approved reviews, with your consent: this is not a provider, but publication on the Dividi Spesa page.
- Netlify, Inc.: hosting the website and web app.
- Cloudflare, Inc.: technical routing of the fufflix.it/dividispesa address to the site and execution of our server functions (Premium activation, payments, codes, ambassador programme, notifications and statistics).
- Stripe Payments Europe, Ltd. (Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): Premium payments. They also process payment data as independent controllers, under their own privacy notices.
- Cloudflare, Inc., for the presentation and tutorial videos, hosted on our subdomain video.dividispesa.com. A video loads only when you press its cover image: until you do so, your visit downloads no video. After the click, Cloudflare, which delivers the file, receives at least your IP address and technical browser data, as with any request to the site, under its own privacy notice. We use no third-party player or service for playback. If you do not watch the videos, none of this happens.
- Google (App Check, Fraud Defense): an invisible anti-abuse check to verify that sign-in requests come from the real app rather than automated programs. To do this, the app contacts Google's servers, which receive technical browser data and your IP address; no emails, expenses or other content pass through them. Legal basis: legitimate interests in security (Art. 6(1)(f)).
- Browser or operating system notification services (for example, Google, Mozilla, Apple), only if you enable notifications: they deliver the alert to your device, without content.
For expenses in other currencies (a Premium feature), the app requests the day's exchange rate from the public Frankfurter service, which publishes European Central Bank exchange rates: only the currency code and date are sent, without amounts, names or other personal data.
Usage statistics do not involve any additional providers: they are written to the Firebase database already described above.
We show ambassadors only dates, plans and amounts of sales made with their code, never the buyer's identity.
We do not disclose data to other parties, except where required by law.
6. Transfers outside the European Union
Not all data stays in Europe. In particular, Google's sign-in service (Firebase Authentication) operates from data centres in the United States, where your email is processed. Stripe, PayPal and notification services may process data in the United States under their own privacy notices. Netlify and Cloudflare may also process technical connection data (for example, IP addresses) in the United States.
Transfers are protected by the EU–US Data Privacy Framework (for participating providers) and, in any event, by the Standard Contractual Clauses approved by the European Commission and included in the agreements with providers. You can request a copy of the safeguards by writing to our privacy contact.
7. How long we retain data
- Account: while the account is active. After deletion, data is removed from our systems; providers complete removal from backups within approximately 180 days.
- Encrypted expenses: while the group exists; they are deleted when the last member leaves the group or at your request.
- Usage statistics: the encrypted code, together with the days on which it is active (used to count how many different people use the app during a period), is deleted after 14 months without use, or immediately if you refuse or withdraw consent; aggregate totals cannot identify you and are retained. The encrypted code with the account creation date (used only to avoid counting a registration twice) is deleted when you delete your account.
- Purchases and payments: for the period required by accounting and tax obligations (up to 10 years, Art. 2220 of the Italian Civil Code). Premium entitlement remains while the account exists.
- Reviews: while published or pending; after withdrawal or deletion, only the date and proof of consent remain, for up to 5 years.
- Ambassador programme: for the duration of the collaboration and then for the period required by accounting and tax obligations (up to 10 years).
- Notifications: while you keep them enabled; the delivery address is deleted when you disable them or when the browser revokes it.
- Attempts to enter codes: a counter that resets after one hour.
- Technical server access logs: for providers' standard retention periods, usually no more than a few weeks.
8. Your rights
You can request access, rectification, erasure, restriction and portability of your data, object to processing (Arts. 15–22 GDPR), and withdraw any consent given at any time (for statistics, simply disable them in Settings, under “Usage statistics”). Write to [email protected] from your account email address: we respond within 30 days.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
9. How to delete your account and data
From the app: Settings, Account, Delete profile. This removes your access.
Without the app: write to [email protected] from the address you registered with, using the subject “Dividi Spesa account deletion”. We delete the account within 30 days.
Expenses you entered in the online family remain available to other members (they are the family's shared records) until the family is deleted in Settings, Synchronisation, “Delete the online family”. If you want them deleted immediately, delete the online family first, then the account.
10. Children, changes and contacts
Children. The service is restricted to people aged 18 or over. If we discover that an account belongs to a child, we delete it.
Changes. If we make substantial changes to this notice (for example, introduce new statistical purposes, a subscription or new providers), we notify you in the app and, where necessary, ask for your consent again.
Contacts. Mastino S.r.l. · Via Lorenzo Maria Neroni 11, Caserta · [email protected]