Skip to content
FileDigest
Create a digest

Privacy Policy

Last updated: 2026-08-15

1. Who we are

FileDigest (filedigest.app, "we", "us") is a service operated by an Italian sole proprietor ("ditta individuale") under regime forfettario. The data controller is the natural person registered under the corresponding Partita IVA. Contact: hello@filedigest.app.

2. What we collect

  • Account data: email, optional display name, enabled OAuth provider if used, Supabase user id.
  • Documents you upload: the files themselves and their content, processed into Markdown digests.
  • Usage events: token counts, page counts, processing duration, plan tier, timestamps.
  • Billing data: Stripe customer id, subscription status, last 4 of card (held by Stripe, not us).
  • Operational telemetry: request logs, error traces, IP address (truncated after 30 days).

3. How long we keep it

  • Source files (your uploads): deleted from object storage immediately after successful processing (GDPR Article 5.1.c data minimization). Uploads that belong to a failed job are removed when you delete your account.
  • Processed digests: kept until you delete your account.
  • Account + billing data: kept while your account is active + 13 months for tax/audit (Italian fiscal requirement).
  • Logs: 30 days. IP addresses truncated to /24 after 7 days.

4. Third-party providers and international transfers

We use third-party infrastructure providers to deliver the service: hosting and CDN (Vercel), authentication, database, and object storage (Supabase), document parsing compute (Modal), payments (Stripe), and transactional email (Resend). Where data is transferred outside the EEA, we rely on the relevant provider agreements and transfer mechanisms available for that provider, such as DPF certification and/or standard contractual clauses where applicable.

5. Your rights (GDPR)

  • Access: every digest and its metadata can be downloaded from your dashboard (per-job ZIP). For a copy of everything we hold about you, email us and we will send it within 30 days.
  • Rectification: your account holds only your email address and plan. To correct either, email us.
  • Erasure ("right to be forgotten"): delete your account via Settings → Delete account, or by emailing us. This removes your account, jobs, digests and stored files. Deletion is hard and irreversible.
  • Portability: download any digest with its metadata as a ZIP from the job page. A one-time export of all your digests is available on request by email.
  • Object / restrict: contact us; we will stop processing where lawful.
  • Lodge a complaint: with the Garante per la protezione dei dati personali (Italian DPA).

6. Cookies

We use essential cookies only - Supabase Auth session and (during checkout) Stripe Checkout. No advertising cookies. No analytics cookies that require consent. No cookie banner needed under the e-Privacy Directive's "strictly necessary" exemption.

7. Lawful basis

Processing is based on Article 6.1.b GDPR (necessary for performance of the contract you entered when you created an account) and Article 6.1.f (legitimate interest in operational security and fraud prevention).

8. Changes

Material changes are announced by email at least 30 days in advance. Minor edits (typos, clarifications) are posted with an updated date.