1. Controller and contact
CrediPulse is operated by Andrea Carbonetti, an individual based in Italy, who is the controller for account, authentication, security and support data. Contact for privacy requests, your rights and support: carbonettiandrea@gmail.com.
When a practice uploads personal data about clients or other people, it determines its own processing purposes and must have a lawful basis to share those data. Processing carried out on its behalf requires an Article 28 GDPR agreement where applicable; this notice does not replace that agreement.
2. Data used by the service
Account data include email address, user ID, authentication information and profile metadata. Supabase Auth handles email/password credentials; the operator cannot view your plaintext password.
Workspace data include studio name, companies, member emails and roles, invitations, and the dates and accounts responsible for changes. Activity records may contain company names and colleagues’ emails.
XBRL/XML statements are sent to the analysis service and processed in memory. The application does not retain the original file. It stores the reporting year, results, formulas and extracted calculation inputs. Documents or names you enter may contain personal data.
Hosting, authentication and security providers may process IP addresses, browser information, request timestamps and operational logs to deliver and secure the service. Support messages include the information you choose to send.
3. Signing in with Google
Google sign-in is optional. CrediPulse uses basic identity permissions (openid, email and profile). Google and Supabase may provide your account identifier, email, name and profile picture where available, to create or recognize your account, authenticate you and associate workspace permissions.
CrediPulse does not request Gmail, Google Drive, contacts or calendar access. Google user data are not sold, used for personalized advertising or used to train AI models. Human access is limited to support, security, service operations or legal requirements.
You can revoke the connection in your Google Account settings. Revoking Google access does not automatically delete your CrediPulse account or shared studio content. Contact the operator to request deletion.
4. Purposes and legal bases
Account and authentication data are necessary for private workspaces. Without them you can still use the public demo. Registration does not require advertising consent; the service does not send promotional newsletters. Each practice must determine the legal basis for personal data it uploads.
- Providing accounts, sign-in, statement analysis and requested collaboration: performance of the service or pre-contractual steps, Article 6(1)(b) GDPR.
- Protecting accounts and infrastructure, checking access and recording changes: legitimate interests in security and proper service administration, Article 6(1)(f), balanced against individuals’ rights.
- Meeting legal obligations or lawful authority requests: Article 6(1)(c), where applicable.
5. Sharing and service providers
Authorized members of the same workspace can access shared information according to their roles. Owners and administrators manage members and invitations. The operator may access data as necessary for support, security and administration. Disclosures required by law are limited to what is necessary.
Supabase supplies authentication, database and statement processing. Cloudflare hosts and delivers the website. Google is involved when you choose its sign-in. Stripe provides checkout and subscription management; Link and anti-fraud features operate on the provider’s pages where applicable. Account emails use the sending infrastructure configured through Supabase.
The current test mode does not create real charges. Stripe receives the information entered on its pages; CrediPulse stores customer/subscription identifiers, status, price and access expiry. CrediPulse application code does not receive or retain full card numbers or CVCs.
Providers act as processors or independent controllers depending on the activity. Their notices and agreements explain their respective processing.
6. Processing locations and transfers
Providers use infrastructure and personnel in multiple countries. Not all processing is confined to Italy or the European Economic Area: authentication, security, support and operational metadata may involve third countries.
Provider terms and data-processing agreements describe applicable safeguards, including adequacy decisions and standard contractual clauses where relevant. Ask the privacy contact for details about recipients and safeguards for your data. Supabase’s documentation also distinguishes the database region from other operational processing.
7. Retention and deletion
Accounts and associated data are retained while the service is used and as necessary to provide it. Analyses remain in the workspace until an owner/administrator deletes them or the workspace is deleted. Subscription expiry or a colleague leaving does not automatically delete shared data.
Invitations and activity records support access management and change history. They may remain after an invitation expires or a member leaves. Account deletion removes the actor association from activity records, but textual references, such as invitation-event emails, may require further action. You can request their deletion or restriction.
Deletion requests are assessed against content ownership, other members’ rights and any legal or legal-claim retention requirements. Technical copies, backups and provider logs follow their respective retention cycles; immediate erasure from every backup is not promised. Support messages are retained to handle the request and related disputes.
8. Browser storage and cookies
The browser stores the sign-in session (credipulse.auth), language, selected workspace and calculation-display preference. Session storage may temporarily retain an invitation identifier to resume after sign-in. These support requested functions and are not used for advertising profiling.
You can clear these data in your browser settings; you may need to sign in and set preferences again. This website does not integrate advertising pixels or marketing analytics. External Google and Stripe pages may use their own cookies and anti-fraud tools under their respective notices.
9. Your rights
Where the GDPR applies, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests, by writing to carbonettiandrea@gmail.com. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Requests are handled within GDPR time limits, with proportionate identity verification if necessary.
You may complain to the Italian data protection authority or another competent authority. For data uploaded by a practice acting as controller, we will help direct the request to the appropriate party.
Financial indicators are calculated automatically from uploaded data. CrediPulse does not make lending decisions or other decisions with legal effects on users. Assessments and actions remain the responsibility of those using the results.
10. Updates
The date above identifies this version. Changes to the service, providers or operator may require an updated notice and communication to users where necessary. The applicable version will remain available on these pages.