This English version is a courtesy translation, provided for convenience only. The Italian version is the sole legally binding text: in case of any discrepancy between the two, the Italian version prevails.
Do you want your data deleted? Write to privacy@optinproof.app. We answer within one month.
Below you find what to put in the email, what happens next and what really disappears. It covers the data that goes through OptinProof.
1. First of all: who are you?
Whoever reads this page is one of two people. The route is different. Work out which one you are, so you do not write to the wrong door.
- You have an OptinProof account. You signed up, you log into the panel, you collect consents. We hold your data. We handle your request. Go to section 4.
- You gave your consent to a business that uses OptinProof. You left your number or your email on a form, or you receive its messages. Your data belongs to that business. We hold it on its behalf. Go to section 3.
2. Do you only want the messages to stop?
These are two different things. Stopping the messages you do yourself, in one click, straight away. Deleting the data is a written request, and it takes longer.
If all you want is not to be contacted again, you do not need to write to anyone. The route is already inside the messages you receive:
- the unsubscribe link, in the messages that carry it. It opens a page that tells you who wrote to you. One click and you are out.
- on WhatsApp, the button inside the message. Or reply STOP. That business stops writing to you on WhatsApp.
Then you get a receipt, with the date and a reference number. It is yours. You need it if one day you have to show that you said no.
If you leave WhatsApp with STOP or the button, the data that says who you are — name, number, internet address and program — stays at most 48 hours after your exit has been recorded and verified; then we remove it. What stays is the proof that you had said yes, and a fingerprint of your number, so we never write to you again. If with that business you also have another contact detail (for example an email) that you have not switched off, that data stays as long as it is needed to write to you there.
If you want your data deleted, you can ask for it separately — section 3 or section 4, depending on who you are.
With “Stop everything” that business stops writing to you at your subscription's contacts, in every subscription that uses them. Subscriptions confirmed with the same code close and are deleted like yours. The others stop writing to you at those contacts, but their data is kept: we have no proof they are yours. So that we never write to you again, we keep a fingerprint of your contact, not the contact itself.
3. If you gave your consent to a business
Send an email to privacy@optinproof.app. Put Data deletion as the subject. Inside, write:
- the contact detail the messages reach you at: the phone number, or the email address;
- the name of the business, if you know it.
We answer you within one month and tell you what was done.
Sometimes we ask you for something more, to be sure it is you. The reason is simple: deleting one person's data because somebody else asked would be the worst harm of all.
You can also write to the business directly. You find its contact details on the page that opens from the unsubscribe link, inside its messages.
Why it goes through the business: your data was collected by it. It decides why to keep it and for how long. We hold it on its behalf and do what it tells us. The business decides the deletion, and we carry it out.
4. If you have an OptinProof account
Write to privacy@optinproof.app from the email address you signed up with. That way we know straight away that it is you.
Then there is one thing to know before closing. If your account holds consents you collected, those rows are the proof of the people who said yes to you. After the closure you have 90 days to download them; then the instruction you recorded for them applies.
At the end of that period we delete your business's contact details and, if you did not ask us to keep the records, also your account's users and logins (if you did, a read-only login remains). What remains: invoices and payments, for ten years, as the law requires of us; a minimal account record (name, legal name, VAT number, registered email and form address), so that nobody else can take those identifiers; the record that you accepted the Terms and the data processing agreement. How long they remain is stated in the privacy notice, § 8.
The consents you collected follow a rule of their own. When you close the account, the instruction you recorded for their records applies: delete them at the end of the period (standard closure), or keep them for you, each until 5 years and 1 month after the most recent of the consent, the last message and the withdrawal of all channels. If you recorded none, at the end of the period in which you can download your data we delete the records too, and 30 days later the minimal list of who said no as well.
The reason is that they protect you. If somebody one day disputes a message you sent them, the proof that they had said yes must still be there.
5. What happens when we delete
Here is exactly what disappears and what does not. It is better to know beforehand.
What disappears is the data that says who you are: the name, the contact details, the internet address the consent came from and the program you were browsing with.
What stays is one row that says a consent existed, on this date.
It stays because that row is what shows the business had not written to you without permission. And that protects you too. Without it, it would be your word against theirs.
There is then one thing that surprises people, so we explain it. Every consent carries an electronic signature, there to show that the row has not been tampered with. After deletion that signature never comes back.
That is not a fault: it is the proof that we really did delete. The signature covered data that is no longer there. And alongside it stays a certificate, taken before deleting, saying that the proof was valid while the data was still there.
Finally, one thing we do not remove before its time. If an email we sent you came back undelivered, or somebody reported it as unwanted, that address ends up on a list of mailboxes we no longer write to. It stays there 24 months after the last bounce, or 5 years and 1 month after the last report: taking you off earlier would mean starting to write to you again.
6. How long we take
We answer you within one month. That is the deadline set by European Regulation 2016/679, the one everybody calls the GDPR.
Sometimes it takes longer: if the request is complicated, or if many arrive together, the deadline can be extended by two months. In that case we write to you before, not after.
There is no button that deletes. A person reads the request and carries it out. That is why it takes time, and why you get a written answer saying what we deleted and what remained.
If the answer does not satisfy you, you can turn to the Italian Data Protection Authority (Garante per la protezione dei dati personali). For any other question about your data, write to privacy@optinproof.app.