Privacy notice

3.1 Fingerprint, timestamp and signature

Your browser computes the SHA-256 fingerprint of the file and sends it to the service, which generates the date and time, the attestation string and a security signature (HMAC). These are technical data of the certificate.

Legal basis: provision of the service requested by the user (art. 6.1.b) and legitimate interest in the integrity of the service (art. 6.1.f).

3.2 Author-declared data (optional)

You may state a title, author, year and notes. These are optional: if you enter them, they appear on the certificate and are stored within the PDF certificate. The "author" field may contain a real name and therefore personal data. Such data are bound to the signature (they cannot be altered after issuance, for integrity).

Legal basis: provision of the requested service (art. 6.1.b). It is you who decides whether to enter them.

3.3 IP address (anti-abuse and anti-bot)

The IP address is processed for rate-limiting (abuse prevention) and for the Cloudflare Turnstile anti-bot check when the attestation is issued. It is not used to profile you.

Legal basis: legitimate interest in the security of the service (art. 6.1.f).

3.4 Visit statistics (Matomo)

We use Matomo, an analytics tool self-hosted on our own infrastructure, configured with an anonymised IP address and in cookie-less mode. It collects aggregate statistics only, which are not shared with third parties for commercial purposes. For this reason no consent is required and the service does not display a cookie banner.

Legal basis: legitimate interest in improving the service (art. 6.1.f). Retention: 13 months.

3.5 Developer access: API key request

This subsection concerns exclusively those who request a self-service API key from the page attestazione.spaziogenesi.org/developer/keys — not those who use the attestation service from the website: for that use, as already described above, we do not process any identifying personal data.

To issue the key we ask you to confirm your email address through Google, Microsoft or LinkedIn ("one-shot" sign-in: we only read the email address verified by the provider, then we discard the token — no session, no cookie, no ongoing access to your account). We process your email address, the chosen provider and the date of the request, in order to issue the key, to moderate its use (including any communication in case of revocation or suspected abuse) and to keep an anti-abuse record. The key itself is never written into an HTML response: it travels only in the URL fragment (#sgk=…), which the browser never sends to a server — not a cosmetic improvement, but one less piece of data that could remain in a log.

Legal basis: pre-contractual/contractual measures requested by the data subject (art. 6.1.b) and legitimate interest in abuse prevention (art. 6.1.f). Retention: for as long as the key remains active, then 180 days from revocation (anti-abuse record), after which the email address is anonymised automatically. Early erasure on request: see §7.

Anyone holding an active key or a Professional subscription may also submit their application to the public "Integrations" showcase (attestazione.spaziogenesi.org/integrazioni): in that case the name of the application, its URL, description and any logo — data that you choose to provide — become public, but only after a manual check by the service manager (pre-moderation: nothing goes online without explicit approval). Your email address always remains private and never appears in the showcase. You can amend or withdraw your submission at any time from your profile (every amendment goes back into review); withdrawal immediately removes the entry from the public page. Legal basis: consent (art. 6.1.a) — the submission is a voluntary and revocable action. Retention: for as long as the submission remains active, or until withdrawal; a request to erase the key (§7) also anonymises the owner of the submission and removes it from the showcase.

3.6 Telegram channel (bot)

This subsection concerns exclusively those who use the Telegram bot @SGAttestBot — a convenience channel, distinct from the website: here the file you send passes through Telegram's servers and through our Worker, which computes its fingerprint in streaming and immediately discards the bytes — we never store it. The bot states this before downloading any file; if absolute privacy matters to you, the website remains the channel where the file never leaves your device.

We process your Telegram user id, whether you have accepted the warning about the file passing through, and daily usage counters (how many attestations/verifications you have requested), in order to apply quotas and prevent abuse. We do not process the username, name or any other data from your Telegram profile.

Legal basis: provision of the service requested by the user (art. 6.1.b) and legitimate interest in abuse prevention (art. 6.1.f). Retention: usage counters are deleted automatically after 90 days. Early erasure on request: see §7.

3.7 Email-domain agreements (academies, institutions, companies)

This subsection concerns exclusively those who attest a work under an agreement between Spazio Genesi and an institution — an academy, a school, a company — (identified by the domain of your institutional email address, e.g. @studenti.youracademy.it) — whether by requesting an API key (§3.5) or through the "Attest with your email" access directly from the website. In both cases we confirm your email address with the same "one-shot" Google, Microsoft or LinkedIn sign-in described in §3.5: no password, no account with us. In the case of access from the website, the outcome is a signed voucher that lives only in your browser (in sessionStorage; it disappears when you close the tab or click "Sign out", with a maximum validity of 8 hours) — we create neither cookies nor sessions on our server.

For attestations issued under an agreement only, we process your institutional email address, the sign-in provider and the association between your email address and the fingerprints of the works you attest. This log exists solely in order to: deliver the certificate custody guarantee provided for by the agreement, account for the monthly allowance shared with the institution, and produce an aggregate report for the institution (totals and number of members, never a nominal list of works) for invoicing and renewal purposes — unless otherwise agreed in writing with the institution. We do not process any additional data for those who use the service without an active agreement on their email domain.

Agreements may also cover companies and software houses whose application attests on behalf of their own users: in that case we process only the email address of the contact person holding the partner's API key (see §3.5) — the end users of the application remain anonymous to us: we process no data about them.

Legal basis: provision of the service requested by the student, member or employee under the agreement (art. 6.1.b) and legitimate interest in abuse prevention (art. 6.1.f). Retention: for the duration of the custody guarantee provided for by the agreement (5–10 years depending on the agreement with the institution) — consistent with the very purpose of the log, which is to prove coverage over time. Early erasure on request: see §7.

3.8 Professional subscription

This subsection concerns exclusively those who activate the paid annual subscription from the page attestazione.spaziogenesi.org/profilo. As for §3.5 and §3.7, identity is confirmed with the same "one-shot" Google, Microsoft or LinkedIn sign-in: no password, no account with us, and the resulting voucher lives only in your browser (sessionStorage, never a cookie).

To activate and manage the subscription we process your email address, sign-in provider, subscription references (Stripe identifier, status, expiry date, amount) and the association between your email address and the fingerprints of the works you attest in this tier — the latter being what makes it possible to show you the archive of your certificates in the profile page and to honour the guarantee of retrieval for at least 5 years. The channel through which you produced each certificate (website, API, MCP, Telegram bot) is recorded in the same log, where it can be distinguished.

You may also tell us, optionally and with separate consent, your sector and your region (Professional profiling) or the application/operating system/development environment you use (Developer profiling, if you also hold an API key) — data that are never public and that we use only to offer you favourable terms or agreements when available. You can amend and erase them yourself at any time from the profile page, without writing to us.

Payments: payment processing takes place entirely on Stripe (the Checkout page and the management portal are hosted by Stripe): we never see nor store your card details. From Stripe we receive only the subscription identifiers needed to provide the service (not the payment details).

Reserved discount codes: if we agree a dedicated discount code with you (for example as part of an agreement or a personal promotion), we retain the email address to which the code is reserved, for the sole purpose of enforcing that reservation at the time of activation. The data is entered by us when the code is created — no action of yours on the website generates it — and it remains for the period of validity of the code; early erasure on request, as for the other data in this section (legal basis: pre-contractual measures requested by the data subject, art. 6.1.b, and legitimate interest in managing dedicated commercial terms, art. 6.1.f).

Legal basis: performance of the subscription contract (art. 6.1.b); accounting and tax obligations concerning the payment references (art. 6.1.c); specific consent for the optional profiling (art. 6.1.a), which can be withdrawn at any time with no consequences for the subscription. Retention: the attestation log and the subscription references are kept for at least 5 years from the production of each certificate — that is the very guarantee we offer, so the email address is not anonymised early for a terminated subscription as long as there are certificates still covered by that guarantee. The optional profiling data, by contrast, are cleared 180 days after termination, if not removed earlier by the data subject. Early erasure on request: see §7 — note that, unlike the other sections, here erasure entails the loss of access to your browsable archive (certificates already issued remain valid and retrievable by fingerprint, as for anyone).