Privacy Policy

1. Who we are

FileDigest (filedigest.app, "we", "us") is a service operated by an Italian sole proprietor ("ditta individuale") under regime forfettario. The data controller is the natural person registered under the corresponding Partita IVA. Contact: hello@filedigest.app.

2. What we collect

• Account data: email, optional display name, enabled OAuth provider if used, Supabase user id.
• Documents you upload: the files themselves and their content, processed into Markdown digests.
• Usage events: token counts, page counts, processing duration, plan tier, timestamps.
• Billing data: Stripe customer id, subscription status, last 4 of card (held by Stripe, not us).
• Operational telemetry: request logs and error traces.
• IP address: never stored by FileDigest itself: not in our database, not in our application logs, and not sent to our error tracker. Vercel, our host, sees it on every request and keeps it in its request logs for at most 30 days. Supabase, our authentication provider, keeps it with your sign-in sessions (deleted when the session ends or your account is deleted) and in its authentication logs for at most 90 days.

3. How long we keep it

• Source files (your uploads): deleted from object storage immediately after successful processing (GDPR Article 5.1.c data minimization). Uploads that belong to a failed job are removed when you delete your account.
• Processed digests: kept until you delete your account.
• Account + billing data: kept while your account is active + 13 months for tax/audit (Italian fiscal requirement).
• Logs: request and application logs are kept by Vercel for at most 30 days; error reports (which contain no IP address) are kept by Sentry for at most 90 days.
• IP addresses: never stored by FileDigest itself: not in our database, not in our application logs, and not sent to our error tracker. Vercel, our host, sees it on every request and keeps it in its request logs for at most 30 days. Supabase, our authentication provider, keeps it with your sign-in sessions (deleted when the session ends or your account is deleted) and in its authentication logs for at most 90 days.

4. Third-party providers and international transfers

We use third-party infrastructure providers to deliver the service: hosting and CDN (Vercel), authentication, database, and object storage (Supabase), document parsing compute (Modal), payments (Stripe), transactional email (Resend), and error monitoring (Sentry). Where data is transferred outside the EEA, we rely on the relevant provider agreements and transfer mechanisms available for that provider, such as DPF certification and/or standard contractual clauses where applicable.

5. Your rights (GDPR)

• Access: every digest and its metadata can be downloaded from your dashboard (per-job ZIP). For a copy of everything we hold about you, email us and we will send it within 30 days.
• Rectification: your account holds only your email address and plan. To correct either, email us.
• Erasure ("right to be forgotten"): delete your account via Settings → Delete account, or by emailing us. This removes your account, jobs, digests and stored files. Deletion is hard and irreversible.
• Portability: download any digest with its metadata as a ZIP from the job page. A one-time export of all your digests is available on request by email.
• Object / restrict: contact us; we will stop processing where lawful.
• Lodge a complaint: with the Garante per la protezione dei dati personali (Italian DPA).

6. Cookies

We use essential cookies only - Supabase Auth session and (during checkout) Stripe Checkout. No advertising cookies. No analytics cookies that require consent. No cookie banner needed under the e-Privacy Directive's "strictly necessary" exemption.

7. Lawful basis

Processing is based on Article 6.1.b GDPR (necessary for performance of the contract you entered when you created an account) and Article 6.1.f (legitimate interest in operational security and fraud prevention).

8. Changes

Material changes are announced by email at least 30 days in advance. Minor edits (typos, clarifications) are posted with an updated date.