COSMORA · Kreluna Software
Privacy notice
COSMORA privacy
Here you can find out how COSMORA processes your personal data, for what purposes and how to exercise your rights. This notice covers the COSMORA app, cosmora.kreluna.it, and the COSMORA pages and restricted dashboard at software.kreluna.it/cosmora/. Other areas of the company website have their own notices: their advertising technologies do not automatically describe those used by COSMORA.
Who manages your data
The controller is Andrea Gadducci, owner of the sole proprietorship Kreluna Software, Viale Dante Alighieri 3, 51016 Montecatini Terme (PT), Italy. Contact: info@kreluna.it, subject [COSMORA] Privacy.
Account and sign-in
We process your email, account identifier, credentials managed by the authentication service, public name, country and information you choose to add to your profile. Apple or Google sign-in provides the information made available by that service, such as email, name and picture; we do not receive your Apple or Google password. Registration, email confirmation and authentication dates support account management. The basis is performance of the requested service (Article 6(1)(b) GDPR). Required data are necessary for the feature you choose; you can browse areas available without an account.
Community and visibility
We process uploaded photos and videos, posts, listings, messages, favourites, connections and participation in crews and meetups to provide the features you request (Article 6(1)(b) GDPR). Public name, country, posts and listings may be visible without signing in. Messages are for the participants, not public posts. Avoid sharing sensitive information or other people’s data without authority to do so. Others may copy public content: deleting the original does not automatically delete external copies.
Administration, support and security
The controller and authorised persons can view email, name, country, registration, last authentication, account status, and content and notification-device counts in a restricted dashboard to manage the service and community growth. Last authentication does not measure every app opening. The dashboard does not show passwords, push tokens or private chats. We handle support requests, reports and blocks to provide assistance and protect the service: Article 6(1)(b) GDPR for service-related requests, Article 6(1)(f) for legitimate interests in administration and security, and Article 6(1)(c) for legal duties. You may object to processing based on legitimate interests. Automated text checks may hold publication pending review; you can request human reconsideration from support.
Photos, maps and optional features
We access the files you choose to upload; we do not automatically publish your photo library. Published files may retain embedded metadata, including EXIF or location: check and remove information you do not want to share before uploading. Background removal processes the image on your device after an optional model download. Opening a map sends OpenStreetMap and its infrastructure your IP address, technical request information and displayed area. If you enable GPS, the component uses your position on-device to show you on the map and does not save GPS coordinates in the COSMORA database; map requests may still reveal the area. Permissions are managed in device settings. Ticket, video and other links open external services with their own notices; their operators receive the data needed for your visit or requested feature.
COSMORA notifications
Notifications are optional and rely on the consent you give by choosing to enable them (Article 6(1)(a) GDPR). We register an installation identifier, device token, platform, language, choice and technical timestamps, linked to your account, to send our thank-you message and COSMORA news through Apple Push Notification service or Google Firebase Cloud Messaging. They are not third-party advertising. You can turn them off in Profile: the token is removed from the COSMORA register when the request reaches the server. If you are offline, the app retries when connectivity returns or the app reopens. Revoking permission in your phone settings prevents notifications from being displayed; the app updates the register when reopened with a working connection. Devices inactive for more than 90 days are excluded from sending: exclusion does not mean deletion. Account deletion removes associated push records from COSMORA systems; it does not mean every identifier held by Apple or Google is immediately deleted.
Cookies and on-device storage
COSMORA uses technical browser or app storage to maintain sign-in and remember language, terms acceptance, whether the thank-you message was read and notification choices. The app retains the session so you can return signed in; signing out removes the local session. The dashboard uses sessionStorage under cosmora-admin-auth, tied to the tab session: it is not an advertising cookie. Other local preferences remain until changed or you clear app or website data; clearing them does not delete your server account. COSMORA uses these technologies for requested features, not behavioural advertising. Meta Pixel and Google Ads are not integrated into COSMORA components or the dashboard.
Sellers, orders and payments
For a seller profile we process the contact details, country and commercial, billing or delivery information you provide; shops also provide business details and sale terms. Payments, Stripe account connection, deposits and rentals are disabled in this version. Earlier test orders may retain participants, products, amounts, statuses and Stripe references used to view or perform available test actions. These actions do not represent real payments, shipments or refunds. Do not put card, bank account or identity-document information in free-text fields.
Providers and transfers
Supabase provides authentication, database and file services; Sites and Cloudflare provide web infrastructure; Aruba provides support email. Apple and Google are involved in your chosen sign-in and, if enabled, notifications; OpenStreetMap in maps; Stripe may be involved in test orders. They also process technical information needed for service and security. COSMORA’s Supabase database is configured in the EU region in Frankfurt, Germany. This does not mean all processing, support access or external services remain in the EEA: providers may use international infrastructure and subprocessors. Their public terms describe safeguards for transfers; you can request information on the recipients, countries and safeguards applicable to your processing, and copies of the relevant documents, at info@kreluna.it.
Retention and deletion
Accounts, profiles and content are retained to operate the service while the account is active, unless the content or account is deleted. Support requests and reports are retained to handle the request or case; further retention must be limited to information necessary for legal duties or disputes, for the relevant period. Technical logs and any infrastructure copies follow provider settings: deletion in the app does not guarantee immediate removal from every log or copy. Delete account removes the account, associated content and files from COSMORA’s operational systems. If non-test orders exist, automatic deletion requires support intervention; this does not remove your right to request erasure. Contact us if deletion fails or to learn which timeframes apply to your request. The information above also applies to push records and local storage.
Rights and requests
Where provided by law, you can request access and a copy, correction, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent without affecting prior processing. Email info@kreluna.it; we ask only for information necessary to verify identity. For GDPR requests, we respond without undue delay, normally within one month; an extension of up to two further months is possible where permitted, with reasons and the need for extension communicated within the first month. You may complain to the Italian Data Protection Authority or another competent authority, including in your habitual residence or workplace where applicable. Your applicable rights are not limited by the app language you choose.
Children and parents
COSMORA’s declared audience includes teenagers aged 13 and above and adults. This does not mean that a 13-year-old can independently give every consent: conditions depend on the country and purpose. The app does not currently provide an age-verification or parental-authorisation system; accepting the terms does not demonstrate that these requirements are met. For requests about a child’s information or to report inappropriate use, contact info@kreluna.it. Child-safety rules and reporting channels are available in the app.
Updates
We update this notice when features or processing change. Material changes and any new consent requests are communicated before data are used for purposes that require them. This notice describes processing; it is not blanket consent to any use of personal information.