1. WHO WE ARE

• The data controller is RossiFire, operating as Springr ('Springr', 'we', 'us', or 'our'), with establishment in Italy. For privacy requests, contact support@springr.io.
• This Service is intended for developers and other professionals. It is not directed at children under 18, consistent with our Terms of Service.

2. DATA WE COLLECT

• We collect only the data needed to run the Service, fulfill purchases, keep accounts secure, and improve reliability. Depending on how you use Springr, this may include:
• - Account data: email address; a display name (for email sign-up we store your email as the name; for Google or GitHub sign-in we receive the name and profile image provided by that provider); last sign-in method (email, Google, or GitHub); email verification status; and whether your account has a Springr+ license.
• - Authentication data: a hashed password if you sign up with email (we never store your password in plain text); session tokens; and, for Google or GitHub sign-in, the identifiers and tokens those providers return so we can keep your account linked.
• - Session and security data: IP address, user agent (browser and device information), and sign-in timestamps. We use these to operate your session and to detect abuse.
• - Purchase and license data: Paddle customer ID, transaction identifiers, price ID, amount, currency, purchase status, and refund status. We do not collect or store full payment card numbers, CVC codes, or bank-account details.
• - Content you submit: suggestions or improvement requests for documentation and component ideas, including the message, related page path or component type, and any example URL you choose to share.
• - Communications: emails we send you (for example verification messages) and messages you send to support.
• - Technical data generated by the site: pages viewed, approximate location derived from IP for analytics (the IP is not stored for that purpose), error and performance diagnostics, and server logs created while providing the Service.

3. LEGAL BASIS AND PURPOSE OF PROCESSING

• We process personal data only where a GDPR legal basis applies:
• - Performance of a contract (Art. 6(1)(b) GDPR): to create and maintain your account, verify your email, authenticate you, process a purchase through Paddle, grant or revoke Springr+ access, and respond to support requests about the Service.
• - Legitimate interests (Art. 6(1)(f) GDPR): to keep the platform secure (including fraud, credential stuffing, account sharing, and unauthorized bulk downloading), to debug errors and monitor performance, to understand aggregate usage of the site, to defend our intellectual property and legal claims, and to improve the product. You may object to processing based on legitimate interests as described in Section 10.
• - Legal obligation (Art. 6(1)(c) GDPR): to retain records required for tax, accounting, invoicing, and consumer-protection compliance.
• - Consent (Art. 6(1)(a) GDPR): only where we specifically ask for it. We do not send marketing newsletters and we do not run advertising or cross-site tracking. You may withdraw consent at any time without affecting processing that already took place.
• Providing an email address is required to create an account. Without it we cannot provide registered features or a paid license. You may browse public pages without an account.

4. COOKIES AND LOCAL STORAGE

• We use cookies and similar technologies as follows:
• - Strictly necessary cookies: a session cookie issued by our authentication system so you stay signed in and we can recognize your account. These cookies are required to provide the Service you request and do not require consent.
• - Functional storage: we may remember your last sign-in method (email, Google, or GitHub) and your theme preference (typically in local storage on your device). These exist only to make sign-in and appearance more convenient.
• - We do not use advertising cookies, social-media tracking pixels, or third-party marketing cookies.
• You can delete cookies and local storage in your browser. If you block strictly necessary cookies, sign-in and checkout may not work.

5. ANALYTICS, LOGS, AND ERROR MONITORING

• - Website analytics: in production we run a privacy-oriented, self-hosted analytics script. It records page views, referrers, browser/device type, and an approximate location derived from IP, without using advertising cookies and without building a marketing profile. We use this to understand which parts of the site are useful and to keep the Service reliable.
• - Error and performance monitoring: we use Sentry to capture technical errors, traces, and diagnostic logs so we can fix outages and bugs. This may include the page URL, browser information, IP address, and limited request context. Session replay is not enabled. Sentry's ingest endpoint for this project is in the EU.
• - Hosting logs: our hosting provider may process IP addresses and request metadata in server logs as part of delivering the website.
• We do not sell, rent, or trade personal data. We do not use your content or account data to train third-party generative AI models.

6. DEVELOPER TOOLS

• Most Springr developer tools run entirely in your browser. Text, code, colors, tokens, or files you paste into those tools are processed on your device and are not sent to our servers unless a tool must make a network request to work.
• The SEO checker is an exception: when you submit a public URL, our servers fetch that page solely to generate the on-screen report. We do not add submitted URLs to a mailing list or attach them to your account profile.

7. DATA SHARING WITH THIRD PARTIES

• We share personal data only with parties that help us operate the Service, and only to the extent necessary:
• - Paddle.com Market Ltd (Merchant of Record): payments, tax, invoicing, subscription or checkout management, and payment disputes. Paddle is an independent data controller for the payment data it collects from you. See https://www.paddle.com/legal/privacy and Paddle's Buyer Terms at https://www.paddle.com/legal/checkout-buyer-terms.
• - Google LLC and GitHub, Inc.: if you choose to sign in with Google or GitHub, those providers authenticate you under their own privacy policies. We receive the account identifiers, email, name, and profile image they provide.
• - Resend: transactional email delivery (for example email verification). Resend acts as our processor.
• - Vercel, Inc.: website hosting and application infrastructure. Vercel acts as our processor.
• - Turso (ChiselStrike, Inc.): database hosting for accounts, sessions, purchases, and suggestions. Turso acts as our processor.
• - Functional Software, Inc. (Sentry): error and performance monitoring, as described above. Sentry acts as our processor.
• - Have I Been Pwned: if you create or change a password, we may check it against known breached passwords using a k-anonymity method that does not send your actual password.
• We may also disclose data if required by law, to protect the rights, property, or safety of Springr or others, or in connection with a merger, sale, or transfer of the Service, in which case we will require the recipient to honor this Policy.

8. INTERNATIONAL TRANSFERSSome providers are located outside the European Economic Area (including in the United States). Where a transfer is not covered by an adequacy decision, we rely on appropriate safeguards, in particular the European Commission's Standard Contractual Clauses, and on supplementary measures where required. Payment data transferred to Paddle is handled under Paddle's own controller terms.

9. DATA RETENTION

• - Account, session, and suggestion data: kept for as long as your account remains active. If you ask us to delete your account, we erase personal data we no longer need to keep.
• - Purchase and license records: retained as long as needed to prove your license and to meet tax, accounting, and legal obligations. In Italy this is typically up to 10 years for accounting records. Card details remain with Paddle, not with us.
• - Authentication sessions: expire according to the session lifetime; related IP and user-agent data are stored with the session.
• - Email verification tokens: stored only until they expire or are used.
• - Analytics: kept in aggregated or short-lived form suitable for product statistics, not as a permanent individual profile.
• - Error logs: kept only as long as useful for diagnosis and then deleted or anonymized.
• We cannot delete information Paddle must keep as Merchant of Record. To exercise rights against Paddle, use Paddle's own channels as well as contacting us.

10. YOUR RIGHTS

• Depending on your location, you have the right to:
• - Access the personal data we hold about you.
• - Request correction of inaccurate data.
• - Request deletion of your data ('right to be forgotten'), subject to legal retention duties (for example invoices and license records).
• - Object to processing based on legitimate interests, and to restrict processing in the cases set out in the GDPR.
• - Receive your data in a structured, commonly used, machine-readable format (data portability), where technically feasible.
• - Withdraw consent where processing is based on consent.
• - Lodge a complaint with a supervisory authority. For Italy this is the Garante per la protezione dei dati personali (https://www.garanteprivacy.it). If you live in another EEA country, you may contact your local authority.
• We do not use automated decision-making that produces legal or similarly significant effects about you.
• To exercise these rights, email support@springr.io. We may need to verify your identity before fulfilling the request. We will respond within one month, or inform you if a lawful extension applies.

11. SECURITYWe use industry-standard measures, including hashed passwords, encrypted transport (HTTPS), access-restricted infrastructure, and session controls. No method of transmission or storage is completely secure. You are responsible for keeping your password confidential.

12. CHANGES TO THIS POLICYWe may update this Policy when the Service or the law changes. The 'Last Updated' date at the top will change when we do. Material changes will be reflected on this page. Continued use of the Service after an update constitutes acceptance of the revised Policy. This Policy should be read together with our Terms of Service, Refund Policy, and License Agreement.