Privacy Notice

1. Controller and contact

The controller is Catanzaro Francesco, who personally manages the Arukadia project and brand; Arukadia is not presented as a separate incorporated company. For privacy information and rights, contact account@arukadia.com with “Privacy” in the subject. Do not send passwords, verification codes or licence keys.

2. Registration and account

Registration is voluntary and does not require an invitation. We require email, password, display name and language. A pseudonym is allowed; no legal name, surname, address, phone, identity document, birth date or payment details are required. Technical identifiers, account status, essential operation dates and security records are generated. Passwords are stored as secure hashes, not plaintext. These data support account creation, email verification, authentication, recovery and requested functions under GDPR Article 6(1)(b). Security, abuse prevention and necessary audit rely on Article 6(1)(f).

You must acknowledge the Privacy Notice, accept the Terms and declare that you are at least 18. The audit stores account ID, declaration type, document version and UTC timestamp, without adding raw IP, user-agent or fingerprint for this evidence. Acknowledgement is not consent to processing. The evidence documents the requested service and accepted conditions (Article 6(1)(b)) and protects rights in disputes (Article 6(1)(f)). Creating an account grants no automatic licences, products, privileged roles or restricted access.

Invitations remain optional. An administrator may use an email from contact with the recipient or a person proposing agreed access. Invitations must be relevant and expected; they support agreed access under legitimate interest, taking account of reasonable expectations. You may ignore the invitation or ask for deletion.

3. Security, MFA and navigation

Requests include IP and technical connection information. The application uses security counters and identifiers derived from IP or email; Aruba may hold technical and error logs. Technical sessions, email codes, optional MFA and recovery codes protect accounts; MFA is required for administrators. Necessary events such as access, suspension, revocation and assignments are recorded. These serve secure delivery and abuse prevention (Article 6(1)(b) for requested functions and (f) for security).

4. Library, downloads and licences

The service stores assigned product, channel, validity and access state. Linking an installation adds installation ID, reported program version, activation request, dates, status and technical delivery receipts. Signed licence files are encrypted at rest; ID, revision, profile, start and expiry support activation and renewal. Authorised administrators can export the request or current licence for renewal. These functions provide authorised downloads, updates, licences and support (Article 6(1)(b)); anti-abuse and audit use (f). Web download access and the software licence are separate. These flows do not collect general program usage statistics.

5. Optional remote projection

When you start or view a projection, Arukadia relays images of the shared view, graphical indicators, session identifiers, temporary credentials and times. Visible names or chart data may pass through the server to the recipient; the entire archive is not uploaded. The service does not record video. Delivery of the requested session and security rely on Article 6(1)(b) and (f). Use fictitious data for tests. A person sharing third-party data must be authorised and provide appropriate information; this notice does not replace a professional’s notice to clients. Sharing links through email or WhatsApp is the user’s choice in their own tools, also subject to those providers’ terms.

6. Necessary data and functions not enabled

Without the required registration data and email verification the account cannot be used. Public pages can be visited without registering. Program linking and projection are separate optional functions. Registration and activation do not upload desktop preferences, client lists, natal charts or the program archive. Online archive backup, public commercial forms, online payments, newsletters, marketing analytics and personalised advertising are not enabled. No marketing consent is required. There are no solely automated decisions with legal or similarly significant effects; technical checks apply assigned permissions and licence validity.

7. Recipients and infrastructure

The controller and authorised personnel access only data needed for their tasks. Users see their own profile and assignments; authorised administrators manage accounts, invitations and licences. Aruba S.p.A. provides hosting, MySQL and email in the role specified in its service and processing agreements, with authorised subprocessors. The recipient’s email provider also processes messages. Data may be disclosed to authorities for legal obligations or protection of rights. No external analytics or application copies to non-EEA providers are configured. Infrastructure processing and any provider transfers follow their agreements; the recipient’s chosen email provider may operate outside the EEA. Contact the controller for recipients and applicable safeguards.

8. Retention

Accounts are retained while active or needed for the requested service. On closure, unnecessary data is reviewed for deletion or anonymisation; only data necessary for applicable obligations, security or legal protection remains for the relevant period. Declarations follow the account relationship and relevant protection of rights. Invitation and verification outcomes may remain to manage access and investigate abuse or disputes. An invitation lasts 24 hours; an email code lasts 10 minutes. Expiry does not automatically erase database rows.

Sessions expire after 30 minutes of inactivity and at most 12 hours. Administrative reconfirmation lasts five minutes. Initial program pairing lasts 15 minutes; approved credentials last at most 180 days, unless revoked earlier. Licence, assignment and audit history is retained for the relationship, renewals and support, then only as needed for disputes, security or obligations.

Projection replaces the current image with the next. Closing deletes the session and image; without publisher activity it expires after five minutes. Cleanup and subsequent requests remove residual data, not necessarily at the exact expiry instant. Infrastructure logs follow provider technical management. Restricted backup copies can contain older data until removed or replaced; accepted deletion requests must be reapplied after restoration. Account and historical-copy cleanup also requires manual work; automatic deletion at licence expiry is not promised.

9. Cookies and browser preferences

Account areas use the technical session cookie __Host-arukadia with Secure, HttpOnly and SameSite. Language, audio, admin theme and interface preferences can remain in localStorage until browser site data is cleared; temporary navigation and playback state use sessionStorage. They are not used for advertising or cross-site tracking. Clearing them can sign you out or reset preferences. This notice requires no login and adds no tracking scripts or cookies.

10. Rights and changes

Where applicable, you may request access, rectification, erasure, restriction and portability, and object to legitimate-interest processing for reasons relating to your situation. Consent for any future consent-based processing may be withdrawn without affecting prior lawful processing. Contact account@arukadia.com, preferably from your account email. Proportionate identity checks may be needed. Replies follow GDPR Article 12, normally within one month; reasoned extensions are communicated within that month. Erasure can remove web access and is subject to legal exceptions. You may complain to the Italian Garante or another competent supervisory authority.

Changes to functions and processing will appear here with an updated date and version. Online archive backup will require specific information before activation.