OptinProof
Home

Privacy Policy

Last updated: 7 October 2026

Courtesy translation. The text below is a courtesy translation, provided for convenience only. The Italian version is the sole legally binding text: in case of any discrepancy, the Italian version prevails.

This English version is a courtesy translation, provided for convenience only. The Italian version is the sole legally binding text: in case of any discrepancy between the two, the Italian version prevails.

This policy describes how OptinProof processes personal data under Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended.

1. Data controller

The controller is Alessio Galfo (sole trader), Italian VAT number 18214141006, established in Italy. For any request: privacy@optinproof.app.

2. Dual role (important)

OptinProof processes data in two distinct roles:

  • As Controller, for the data of its own registered users (anyone who creates an account on the platform): see the sections below.
  • As Processor (Art. 28 GDPR), for the data of the end contacts collected and managed by customers through the platform: in that case the customer is the Controller and OptinProof acts on its behalf and on its instructions, under a data processing agreement (DPA).

3. Data we collect

  • Registration data: first name, last name, email address, phone number, business name, website.
  • Verification data: OTP code sent by SMS to confirm the phone number.
  • Usage and technical data: access logs, IP address, device/browser information, solely for security and operational purposes.
  • Data of people who fill in a consent form: besides the data you enter, for security and abuse prevention we process your IP address and technical signals from your browser (also through Cloudflare Turnstile, when it is active), anti-abuse counters and technical logs. Legal basis: legitimate interest in the security of the form and of the service (Art. 6(1)(f) GDPR).

4. Purposes and legal bases

  • Provision of the service and account management — basis: performance of the contract (Art. 6.1.b).
  • Phone number verification via OTP — basis: performance of the contract / pre-contractual measures.
  • Security, abuse and fraud prevention — basis: legitimate interest (Art. 6.1.f).
  • Legal obligations (accounting, tax) — basis: legal obligation (Art. 6.1.c).
  • Service communications — basis: contract; any marketing communication only with prior consent.

5. Suppliers and recipients of data

To provide the service we rely on the suppliers listed below, who may process personal data. For each one we say what it does and what its role is.

5.1 Suppliers that process data on our behalf

When a supplier also processes data as an independent controller, we say so in its entry and in 5.2. For the contact data collected by customers we act as processor (see § 2): these are our sub-processors.

  • Supabase: database, authentication and storage, with data hosted in Supabase's European region in Ireland.
  • Vercel: application hosting and technical request logs, including the IP address.
  • Twilio: delivery of OTP codes by SMS; the voice call starts only on resend, if the person asks for it. For this service Twilio acts on our behalf, under the data processing agreement that is part of the contract with Twilio; to prevent fraud and abuse of its own service it acts as an independent controller (see 5.2).
  • Amazon Web Services: sending email (Amazon SES) and SMS, from the AWS European region in Ireland.
  • Anthropic: artificial intelligence features: assistant, text generation and automatic replies to WhatsApp messages, whose text it receives; in the assistant, also the files the user attaches (images, PDFs and the text extracted from documents).
  • Google (Gemini): AI image generation and editing; it receives the request and, if present, the image to be edited.
  • Google (Google Analytics): measurement of visits to the pages of the public website only, and only if you accept measurement from the cookie banner (see § 10). For this service Google acts on our behalf, under the data processing terms we accepted on 10/11/2022; the data-sharing options with Google offered in our account settings are switched off.
  • Upstash: anti-abuse counters. The counter key may contain the IP address, internal account identifiers and, for the support bot, the Telegram chat identifier; the phone number enters it only as a fingerprint (a transformation of the number that is not readable at a glance but remains personal data).
  • Cloudflare: anti-bot check (Turnstile) on the public consent form, when the service keys are set; it processes the IP address and technical signals from the browser, and we use it solely for security (Cloudflare's role is stated in 5.2); and running of scheduled tasks. If the keys are not set the check is not there.
  • Sentry: reporting of the application's technical errors, with data hosted in Sentry's European region. Reports are sent from our servers and, only when an error occurs, from the browser of people who visit our pages: in that case Sentry receives the connection from the browser, and therefore its IP address. Before sending, a filter of ours removes the IP address, the cookies and headers of the request, the parameters of page addresses, and the email addresses and phone numbers it recognises, and replaces our internal identifiers with random codes. Our Sentry account is set not to store the IP address, and a rule deletes the approximate location derived from it. These are automatic filters: data written in a form they do not recognise may remain.
  • Meta Platforms (WhatsApp Business Cloud API): sending and receiving WhatsApp messages. For this service Meta acts on our behalf, under its data processing terms for businesses (WhatsApp Business Data Processing Terms); for the purposes its terms reserve to it, it acts as an independent controller (see 5.2).

5.2 Suppliers that also process data as independent controllers

For the processing it decides on its own, the supplier sets the purposes and means and is an independent controller, with its own notice.

  • Stripe: payment of subscriptions, credits and voluntary contributions. Stripe processes payment data on our behalf, under the data processing agreement that is part of the contract with Stripe, and as an independent controller for fraud prevention, anti-money-laundering and identity-verification obligations, the choice of payment providers and the improvement of its own services, under its own notice. The card number and security code are collected by Stripe on its own page and do not pass through our systems. In a refund or dispute notice we may receive the card network and the last four digits of the card, which we do not keep.
  • Twilio: to prevent fraud and abuse of its own service, it processes the data of verification requests as an independent controller, under its own notice.
  • Meta Platforms (WhatsApp): for the purposes its terms reserve to it, Meta processes some data as an independent controller, under its own notice.
  • Meta Platforms (connection from the panel): only when you press the button to connect WhatsApp or a social network, your browser loads Meta's login tool from Meta (connect.facebook.net), with automatic app-event logging switched on; we do not load it when the page opens. From that moment Meta processes the data under its own notice.
  • Cloudflare (Turnstile): besides acting on our behalf, it processes the technical signals of the anti-bot check (IP address, TLS fingerprint, User-Agent header) also to improve its own bot detection, as an independent controller, under its own notice.
  • Telegram: for those who write to our support bot (see § 13). It is also one of the platforms on which the customer may publish, with the account they connected.
  • Google, sign-in with Google: if you sign in with Google, Google is an independent controller and knows you are signing in to OptinProof; we receive your name and email.
  • Google (YouTube): on the public site the video player starts only when you press play; from that moment Google processes the data as an independent controller. If the local preview does not load, the browser requests the thumbnail from YouTube before play.

5.3 Recipients chosen by the customer

On the customer's instruction, and only if they have configured it, we pass data to services the customer chooses: the social platforms on which they publish (Facebook, Instagram, Threads, TikTok, X, LinkedIn, Telegram), Google Ads (whose accounts, once the customer connects them, we read and manage: see § 6), the CRM they connect (HubSpot) and the addresses (Zapier, Make, n8n or others) to which they ask us to send contacts and, in flows, the text of the message. These services are not our processors: the customer is the controller of those processing activities and answers for them to their own data subjects.

5.4 Other

  • European Commission (VIES): check of the customer's VAT number; the registered name and address may come back to us.
  • Aruba PEC (qualified time stamp): when the function is active, it receives only the cryptographic fingerprint of the register, from which personal data cannot be traced.

6. Google Ads account data (Google API Services)

If the customer chooses to connect their own Google Ads account, OptinProof accesses the data of that account through Google's APIs, under the OAuth authorisation that the customer grants and can revoke at any time. The following sets out specifically which data we process, for which purposes, where it is stored and with whom it is shared.

  • What data we access: the OAuth tokens issued by Google (a short-lived access token and a refresh token) and the authorised scope; the identifying data of the advertising account (Google Ads customer ID, descriptive name, any parent manager account, currency and account status); the data of the account's campaigns (ID, name, status, daily budget) and their performance metrics (impressions, clicks, spend).
  • How we use it: solely to provide the customer with the features they have requested, namely showing them their own accounts and campaigns inside the panel, creating new campaigns at their request — which are always created paused, so that no spend occurs until the customer activates them — and pausing or resuming campaigns on their command. We do not use this data for any purposes of our own.
  • Where and for how long we store it: the tokens, the account identifying data and the essential campaign data (name, status, daily budget) are stored in our database managed by Supabase, in the ads_accounts and ads_campaigns tables, with restricted access: the tables are protected by row-level security rules and are not readable from the browser or by unauthorised users. The performance metrics (impressions, clicks, spend) are not stored: they are requested from Google at the time and displayed on screen. Storage lasts for as long as the customer keeps the account connected.
  • With whom we share it: we do not hand it over or sell it to third parties, we do not use it for our own or third-party advertising, we do not use it to profile individuals, we do not use it to train or improve artificial intelligence models and we do not use it for any purpose other than those set out above. The data is processed, to run the service, by the suppliers listed in § 5, in particular the supplier that hosts the database on our behalf (Supabase).
  • How it stops: when the customer disconnects the account, the tokens are deleted from our database; when the last connected account is disconnected, the authorisation is also revoked with Google. The customer can at any time also revoke the authorisation from the permissions page of their own Google account.

OptinProof's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Transfers outside the EEA

Some suppliers listed in § 5 are based in the United States or may process data, or access it, outside the European Economic Area. Where § 5 says that data is hosted in a European region, this states where it is stored and does not rule out that the supplier accesses it from outside the EEA. For each supplier you can ask privacy@optinproof.app which transfer mechanism applies (Art. 45 and 46 GDPR). Some services that are not our suppliers (Telegram, the social platforms the customer chooses) process data as independent controllers also outside the European Union, under their own notice.

8. Data retention

Account data is retained for the duration of the relationship and, thereafter, for as long as necessary to comply with legal obligations. Data processed in our role as Processor is retained according to the instructions of the customer acting as Controller, and deleted when the service ends.

Other periods: the OTP codes we generate are valid for 10 minutes and we keep them only as a fingerprint; the anti-abuse counter keys expire on their own, at the latest about 48 hours after the last request; error reports stay on Sentry for 30 days; in Google Analytics event data is kept for 2 months and user-level data for 14 months. For Telegram support: the request and the forwards to the operator are deleted after 90 days, the one-time panel code after 2 days, the identifiers of received messages after 30 days (see § 13).

9. Your rights

You have the right of access, rectification, erasure, restriction, objection and data portability, as well as the right to withdraw consent at any time. You can exercise your rights by writing to privacy@optinproof.app. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

10. Cookies

The platform uses technical cookies necessary for operation, language and authentication: these require no consent and cannot be turned off.

On the public website (the home page, pricing and the other information pages) we use Google Analytics to measure visits: which pages are read, where visitors come from and with which type of device and browser. Google Analytics loads only if you accept measurement from the cookie banner: before you choose, and if you refuse, your browser downloads no Google script. When you accept, Google Analytics writes its own cookies in your browser (_ga and _ga_ followed by our property identifier). We do not use it on the legal pages, on the consent collection forms, on the revocation page or in the management panel. Google processes this data on our behalf (see § 5); for how long it is kept see § 8.

The banner also asks whether you accept marketing. We load no advertising tools and do not link Google Analytics to Google Ads: this choice is only passed to Google Analytics, together with measurement, as an indication on the use of data for advertising.

The public consent collection forms and the revocation page do not load measurement or marketing tools. Someone who leaves or withdraws their contact details is not profiled or measured for analytics or advertising purposes. The management panel does not load them when it opens; only if you press the button to connect WhatsApp or a social network does your browser load Meta's login tool from Meta (connect.facebook.net) (see § 5).

To protect the form from automated submissions, the public form uses Cloudflare Turnstile when the service keys are set: it is an anti-bot check that processes the IP address and technical signals from the browser, which we use solely for security (see § 5). Only if a technical error occurs does the browser send a report to Sentry, filtered as described in § 5. The video player on the public site starts only when you press play (see § 5). The IP address and technical logs are also processed by us and by our suppliers for security and abuse prevention (see § 3 and § 5).

We remember your choice in a technical cookie for 180 days, so the banner is not shown to you again. You can change it at any time from the Cookie preferences link at the bottom of the public website's pages: if you withdraw consent to measurement, Google Analytics stops loading and its cookies are deleted from your browser.

11. Use of artificial intelligence (AI Act)

With reference to Regulation (EU) 2024/1689 ("AI Act"), Art. 50, OptinProof uses artificial intelligence systems for: (a) a conversational assistant in the panel and in the automated agent on WhatsApp; (b) image generation for campaigns:

• when you interact with the WhatsApp agent you are informed that you are talking to an AI and you can ask for a human operator; • images generated by artificial intelligence are marked as such. The models are provided by Anthropic (Claude) and Google (Gemini); for their role see § 5; they are not used for automated decisions producing legal effects on data subjects.

12. Changes

We may update this policy; the version in force is always published on this page together with the date of last update.

13. Support via Telegram (@optinproof_bot)

If you write to us through the Telegram bot @optinproof_bot, the controller (Alessio Galfo, OptinProof) processes:

  • to answer automatically and to protect the service from abuse: your Telegram chat and user identifiers, the identifiers of the messages received, and anti-abuse counters;
  • if you ask to talk to a person, also: the reference and status of the request, language, timestamps and, only if you came from the OptinProof panel with your account, the business you are writing about (through a one-time code, of which we keep only a fingerprint).

The text of your messages is not stored in our archives. Only if you ask to talk to a person and human support is active are the messages you write afterwards forwarded to the operator inside Telegram; otherwise they stay in your chat with the bot. Bot commands and messages the bot does not accept (too long, too many, or sent too fast) are not forwarded: they stay only in the chat, and the bot tells you so there.

Purpose and legal basis. We process this data to answer your support request. The legal basis is your request (Art. 6(1)(b) GDPR, steps taken at the data subject's request) and, for registered users, the performance of the contract.

Telegram. Telegram is the service the conversation takes place on, and the one you chose to use. It processes messages under its own privacy policy, as an independent controller, also outside the European Union. The technical request data listed above is kept by the providers listed in this policy.

It is optional. Using Telegram is not required: you can also write to support@optinproof.app, and if you prefer not to use Telegram you lose nothing.

No automated decisions. The bot's automatic answers only give general information about pricing and features. They do not take decisions about you.

Retention. The data of a request, including the business you are writing about, is deleted 90 days after its last activity (closing included); forwards to the operator 90 days after they were made. The one-time code linking the panel to the bot is deleted 2 days after it was created. The identifiers of received messages are deleted after 30 days. Copies of the messages inside Telegram chats (yours and the operator's) are not deleted by us: you can delete them from your chat.

Rights. You can exercise your rights of access, rectification, erasure, restriction, portability and objection by writing to privacy@optinproof.app. You also have the right to lodge a complaint with the supervisory authority.