Privacy policy

1. Who handles your data

Marco Mezzavilla, via Jacopo Crescini 143B, 35126 Padova, Italy, is the controller for account, contact and service administration data. Write to hub@marcomezzavilla.com for privacy requests.

2. Data and purposes

Accounts and invitations: we use your name, email address, protected password, interface language and library management permissions to manage access to the management area. If you are invited, your name and email address may be provided by the person who invites you.

Support and service administration: we handle the messages you send us and the information needed to manage the service and meet accounting duties.

Site and viewer use: we process IP addresses, session data and technical request data to deliver content, manage access and protect the service.

The legal bases depend on the purpose: performance of the contract for customers who are natural persons; legal obligations for accounting requirements; and our legitimate interests in providing and securing the service for business contacts, collaborators and readers. Without the required account details, we cannot create or manage your access.

3. Personal data in PDFs

The customer decides which PDFs to upload and publish and is responsible for the lawfulness of publishing any personal data they contain. For personal data in PDFs stored and published on their behalf, the customer acts as controller and Browse acts as processor. This processing must be governed by an agreement under Article 28 GDPR before it begins; the agreement may be attached to the service contract.

4. Cookies and providers

We use technical cookies for login and security: session and XSRF-TOKEN last up to 2 hours, and “Remember me” up to 400 days. We do not use advertising or analytics cookies.

Hetzner hosts the service and stores PDFs in Germany, with backups in Finland. Ploi is used to manage the server. Resend sends service emails, which may be processed in the United States.

PDFs published through Browse are intended for public consultation, not confidential sharing. Library management permissions govern what collaborators can do in the management area; they do not make published PDFs private.

Resend describes its safeguards for transfers outside the EEA in its data processing addendum.

5. Retention

Accounts and documents: we keep these data for as long as they are needed to provide the service. Documents moved to the trash are scheduled for deletion after 7 days.

Backups: deletion from the service does not immediately remove backup copies. Previous versions remain for 35 days from the next synchronization; database backups follow a 14–35 day rotation.

Exports: ZIP packages are scheduled for deletion 7 days after completion. Deleting an export package does not delete the original documents in the library.

Service expiry: library owners can normally export their documents for 30 days after ordinary expiry. Expiry does not immediately delete the documents. Any subsequent deletion following expiry will be preceded by an email specifying the deadline for retrieving them. Contact us to request deletion or arrange data retrieval.

Other records: invitations, support messages and technical logs are kept for as long as needed to manage the service, handle requests, protect security and meet legal duties. Accounting records are retained for the periods required by law.

6. Your rights

Email us to request access, correction, deletion or restriction of your data. Where applicable, you may also request portability or object to processing based on legitimate interest. We normally respond within one month; any lawful extension will be explained.

For personal data in a PDF, contact the customer who manages it; we assist them with requests concerning data processed on their behalf. You may lodge a complaint with the Italian data protection authority or your competent supervisory authority.