OptinProof
Home

Privacy Policy

Last updated: 30 August 2026

Courtesy translation. The text below is a courtesy translation, provided for convenience only. The Italian version is the sole legally binding text: in case of any discrepancy, the Italian version prevails.

This English version is a courtesy translation, provided for convenience only. The Italian version is the sole legally binding text: in case of any discrepancy between the two, the Italian version prevails.

This policy describes how OptinProof processes personal data under Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended.

1. Data controller

The controller is Alessio Galfo (sole trader), Italian VAT number 18214141006, registered at Via Tagaste 53, 00121 Rome (RM), Italy. For any request: privacy@optinproof.app.

2. Dual role (important)

OptinProof processes data in two distinct roles:

  • As Controller, for the data of its own registered users (anyone who creates an account on the platform): see the sections below.
  • As Processor (Art. 28 GDPR), for the data of the end contacts collected and managed by customers through the platform: in that case the customer is the Controller and OptinProof acts on its behalf and on its instructions, under a data processing agreement (DPA).

3. Data we collect (registered users)

  • Registration data: first name, last name, email address, phone number, business name, website.
  • Verification data: OTP code sent by SMS to confirm the phone number.
  • Usage and technical data: access logs, IP address, device/browser information, solely for security and operational purposes.

4. Purposes and legal bases

  • Provision of the service and account management — basis: performance of the contract (Art. 6.1.b).
  • Phone number verification via OTP — basis: performance of the contract / pre-contractual measures.
  • Security, abuse and fraud prevention — basis: legitimate interest (Art. 6.1.f).
  • Legal obligations (accounting, tax) — basis: legal obligation (Art. 6.1.c).
  • Service communications — basis: contract; any marketing communication only with prior consent.

5. Suppliers and external processors (sub-processors)

To provide the service we rely on suppliers that process data on our behalf, under appropriate contractual safeguards:

  • Supabase — database, authentication and storage.
  • Vercel — application hosting.
  • Twilio — delivery of OTP codes by SMS.
  • Meta Platforms (WhatsApp Business Cloud API) — sending and receiving WhatsApp messages.
  • Anthropic — AI assistant features.
  • Google (Google Ads API) — reading and managing the Google Ads advertising accounts that the customer voluntarily connects to the platform.

6. Google Ads account data (Google API Services)

If the customer chooses to connect their own Google Ads account, OptinProof accesses the data of that account through Google's APIs, under the OAuth authorisation that the customer grants and can revoke at any time. The following sets out specifically which data we process, for which purposes, where it is stored and with whom it is shared.

  • What data we access: the OAuth tokens issued by Google (a short-lived access token and a refresh token) and the authorised scope; the identifying data of the advertising account (Google Ads customer ID, descriptive name, any parent manager account, currency and account status); the data of the account's campaigns (ID, name, status, daily budget) and their performance metrics (impressions, clicks, spend).
  • How we use it: solely to provide the customer with the features they have requested, namely showing them their own accounts and campaigns inside the panel, creating new campaigns at their request — which are always created paused, so that no spend occurs until the customer activates them — and pausing or resuming campaigns on their command. We do not use this data for any purposes of our own.
  • Where and for how long we store it: the tokens, the account identifying data and the essential campaign data (name, status, daily budget) are stored in our database managed by Supabase, in the `ads_accounts` and `ads_campaigns` tables, with restricted access: the tables are protected by row-level security rules and are not readable from the browser or by unauthorised users. The performance metrics (impressions, clicks, spend) are not stored: they are requested from Google at the time and displayed on screen. Storage lasts for as long as the customer keeps the account connected.
  • With whom we share it: with no one. Google Ads data is not sold, transferred or disclosed to third parties, is not used for our own or third-party advertising, is not used to profile individuals, is not used to train or improve artificial intelligence models, and is not used for any purpose other than those set out above. The only transfer is to the supplier that hosts the database on our behalf (Supabase), as a sub-processor.
  • How it stops: when the customer disconnects the account, the tokens are deleted from our database; when the last connected account is disconnected, the authorisation is also revoked with Google. The customer can at any time also revoke the authorisation from the permissions page of their own Google account.

OptinProof's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Transfers outside the EU

Some suppliers may process data outside the European Economic Area. In such cases the transfer is governed by appropriate safeguards (e.g. the European Commission's Standard Contractual Clauses) or by adequacy decisions.

8. Data retention

Account data is retained for the duration of the relationship and, thereafter, for as long as necessary to comply with legal obligations. Data processed in our role as Processor is retained according to the instructions of the customer acting as Controller, and deleted when the service ends.

9. Your rights

You have the right of access, rectification, erasure, restriction, objection and data portability, as well as the right to withdraw consent at any time. You can exercise your rights by writing to privacy@optinproof.app. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

10. Cookies

The platform uses technical cookies necessary for operation, language and authentication: these require no consent and cannot be turned off.

On the public website we may also use cookies and similar technologies for measurement (how many people read a page and which source they came from) and marketing (which ads actually bring visits, through Google Ads). These are not activated until you accept them: on your first visit a banner asks you to choose, and refusing takes the same number of clicks as accepting.

The measurement tool is Google Analytics 4, provided by Google Ireland Limited. The data collected — pages visited, traffic source, device type, IP address — may be transferred to Google LLC in the United States under the EU-US Data Privacy Framework, the European Commission adequacy decision of 10 July 2023.

⭐️ Consent data never goes through Google Analytics. The public consent collection forms and the management panel load no measurement tool at all: anyone who leaves their contact details on an OptinProof form is not tracked by us or by third parties. You can verify this yourself by viewing the source of any collection page.

We use Google Consent Mode v2: tags start in a denied state and write no identifiers until they receive your consent. Your choice is stored in a technical cookie for 6 months and you can change it at any time from the Cookie preferences link at the bottom of every page.

11. Use of artificial intelligence (AI Act)

OptinProof uses artificial intelligence systems for: (a) a conversational assistant in the panel and in the automated agent on WhatsApp; (b) image generation for campaigns. In compliance with Regulation (EU) 2024/1689 ("AI Act"), Art. 50:

• when you interact with the WhatsApp agent you are informed that you are talking to an AI and you can ask for a human operator; • images generated by artificial intelligence are marked as such. The models are provided by Anthropic (Claude) and Google (Gemini) as sub-processors; they are not used for automated decisions producing legal effects on data subjects.

12. Changes

We may update this policy; the version in force is always published on this page together with the date of last update.