Privacy Policy

Version 1.0 — Last updated: 02/25/2026

This privacy policy describes how Fulvio Gilardoni ("we", "the Controller") collects, uses, and protects the personal data of users of the Replay service (hereinafter "the Service"), accessible at https://replay.fgstack.com.

Personal data is processed in compliance with EU Regulation 2016/679 (GDPR) and applicable Italian data protection legislation.

1. Data Controller

Name: Fulvio Gilardoni
Registered address: Via Leonardo da Vinci, 3 - 23865, Oliveto Lario (LC)
Email: fulvio.gilardoni@gmail.com
PEC: fulvio.gilardoni@ingpec.eu
VAT number: IT02738610134

2. Personal data collected

The Service collects the following categories of personal data:

a) Data provided by the user

Email address — used for registration and authentication.
Password — stored exclusively in encrypted form (BCrypt hash). We never have access to the plaintext password.

b) Data generated through use of the Service

Uploaded files — CSV and XLSX files uploaded for comparison. Files are retained for the lifetime of the project to enable comparison with future versions. They are permanently deleted when the project or the user account is deleted.
Project metadata — project name, column schema, comparison results (diff JSON), counters, timestamps.

c) Technical data

Session cookie (ReplayAuth) — required for authentication.
System logs — IP address, browser type, request timestamps (retained for security and debugging purposes).
Analytics data — only with prior consent, via Azure Application Insights (load times, errors, performance).

3. Purposes and legal basis

Purpose	Data processed	Legal basis
Service provision (registration, login, file comparison)	Email, password hash, files, project metadata	Performance of a contract (Art. 6.1.b GDPR)
Security and abuse prevention	System logs, IP	Legitimate interest (Art. 6.1.f GDPR)
Service analysis and improvement	Anonymous analytics data	Consent (Art. 6.1.a GDPR)
Service communications	Email	Performance of a contract (Art. 6.1.b GDPR)
Payment and subscription management	Email, billing data (via Paddle)	Performance of a contract (Art. 6.1.b GDPR)

4. Data retention

User account — retained until the account is deleted by the user or until the Service ceases.
Uploaded files — retained for the lifetime of the project; permanently deleted upon project or account deletion.
Comparison results (diffs) — retained for the lifetime of the account.
System logs — retained for a maximum of 90 days.

5. Necessity of providing data

Providing your email address and password is required in order to create an account and use the Service. Failure to provide this data makes it impossible to register and access the Service.

Uploading files is required to use the comparison feature. Files are retained for the lifetime of the project and deleted upon project or account removal.

6. Automated decision-making and profiling

The Service does not carry out profiling or automated decision-making that produces legal effects or similarly significant effects on data subjects within the meaning of Art. 22 GDPR.

7. Data Protection Officer (DPO)

No Data Protection Officer (DPO) has been appointed as the Controller does not fall within the cases required by Art. 37 GDPR. For any requests regarding personal data protection, you may contact the Controller at: fulvio.gilardoni@gmail.com.

8. Data recipients

Personal data may be shared with:

Microsoft Azure — application hosting and file storage (Azure Blob Storage, EU datacenter).
Neon Tech Inc. — cloud PostgreSQL database where user accounts, project metadata, and comparison results are stored (Neon Privacy Policy). Data is hosted in European Union datacenters.
Paddle.com Market Limited — payment processor for subscription management. Paddle processes the user's email address and billing data as Merchant of Record (Paddle Privacy Policy).
Law enforcement — only upon request from judicial authorities.

We do not sell, rent, or share your data with third parties for marketing purposes.

9. Data transfers

Application data and files are hosted on Microsoft Azure and Neon servers located in the European Union. Payments are processed by Paddle, which may process billing data in the United Kingdom and the European Economic Area, in compliance with Standard Contractual Clauses (SCCs) under the GDPR. For more details, see the Paddle Privacy Policy.

The Service uses the following cookies:

Cookie	Type	Purpose	Duration
`ReplayAuth`	Technical (essential)	User authentication	30 days
`replay_cookie_consent`	Technical (essential)	Cookie preference storage (localStorage)	Indefinite
`ai_session` / `ai_user`	Analytics (with consent)	Azure Application Insights — performance monitoring	30 min / 1 year

Essential technical cookies do not require consent as they are necessary for the Service to function. Analytics cookies are only activated after explicit user consent via the dedicated banner.

You can revoke analytics cookie consent at any time from the "Account" page or by clearing your browser data.

11. Your rights

Under Articles 15-22 of the GDPR, you have the right to:

Access — obtain confirmation of processing and access your data.
Rectification — correct inaccurate or incomplete data.
Erasure ("right to be forgotten") — request deletion of your data.
Restriction — restrict processing in certain cases.
Portability — receive your data in a structured, machine-readable format.
Objection — object to processing based on legitimate interest.
Withdrawal of consent — withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise your rights, contact the Controller at: fulvio.gilardoni@gmail.com.

12. Right to lodge a complaint

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali):

Website: www.garanteprivacy.it
Email: protocollo@gpdp.it

13. Security

We adopt appropriate technical and organizational measures to protect personal data, including:

HTTPS encryption for all communications
BCrypt password hashing
HttpOnly and Secure cookie attributes
Anti-spam protection (rate limiting)
File deletion upon project or account removal

14. Changes to this policy

The Controller reserves the right to modify this policy at any time. Changes will be published on this page with an updated date. Continued use of the Service after publication of changes constitutes acceptance thereof.