Privacy policy

Under Articles 13 and 14 of EU Regulation 2016/679 (GDPR). Last updated: 31 October 2026. This is a translation: in case of discrepancy the Italian version prevails.

1. Data controller

The data controller is Andrea Crippa, who can be contacted at [email protected].

2. What data we process

• Browsing the site: technical data such as IP address, browser and requested pages, logged by the hosting provider for security and operation. Visit statistics are collected in aggregate form and without cookies.
• Email alerts, only if you subscribe: email address, chosen vendors and products, date and time of subscription and confirmation, and a non-reversible fingerprint of your IP address (needed to prove consent and prevent abuse). The plain IP address is not stored.
• Reports of missing vendors or products: the text you write (we ask you to enter only the product name) and a non-reversible fingerprint of your IP address to limit abuse. They are not linked to your subscription.
• Messages you send us: email address and content of the message.

We do not process special categories of data and do not carry out profiling; personalised ads from advertising providers appear only if you consent (see below and the cookie policy). We do not record who opens our emails or clicks their links: our emails contain no tracking pixels and links lead straight to the site, without going through measurement services.

How we protect subscribers' data

In the database, email addresses are encrypted (4096-bit RSA-OAEP) and the key to decrypt them is not on the site's servers, only on the system that sends the alerts. Product choices are encrypted too (AES-256-GCM). The personal links in our emails are not stored: they are recomputed with a secret key. Anyone obtaining a copy of the database could therefore neither read the addresses nor tell which products each subscriber follows.

Telegram channel

Anyone joining the @patchradar_it channel does so through Telegram, which processes data under its own privacy policy. The channel administrator can see subscribers' public name and username but does not store them or use them for any other purpose; the site receives no data about channel subscribers.

3. Purposes and legal basis

• Making the site available and protecting it from abuse: the controller's legitimate interest (Art. 6(1)(f) GDPR).
• Sending you the security alerts you chose: your consent (Art. 6(1)(a) GDPR), collected with double opt-in by email. You can withdraw it at any time with the link in every email, without consequences.
• Answering your messages: performance of your request (Art. 6(1)(b) GDPR).
• Showing ads, which fund the free service: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code), given through the cookie banner and revocable at any time from the "Cookie preferences" link at the bottom of every page. Without consent, ads do not use cookies or identifiers for profiling.

4. Who processes data on our behalf

Data is processed electronically and entrusted to providers appointed as processors (Art. 28 GDPR):

• Cloudflare, Inc. (USA): site hosting, subscriber database, forwarding of incoming mail.
• Amazon Web Services EMEA SARL (Luxembourg, EU), Amazon SES service: sending alert emails from its Stockholm (EU) servers. It receives the address only when an email is sent and notifies us of non-existent addresses or of people marking our emails as spam, so we can cancel their subscription.

Advertising

Ads are provided by Google Ireland Limited (Google AdSense) and its advertising partners, who process data as independent controllers under their own privacy policies. With your consent they may use cookies and device identifiers to show personalised ads and measure their effectiveness. How Google uses data: How Google uses information from sites that use its services. The list of partners and the individual purposes can be viewed in the cookie banner. Email alert subscribers' data is never shared with advertising services.

Transfers to the United States are based on the EU-U.S. Data Privacy Framework, to which Cloudflare, Google and Amazon adhere, and on the European Commission's Standard Contractual Clauses. Data is not sold or passed to third parties for marketing purposes.

5. How long we keep data

• Unconfirmed subscriptions: deleted after 7 days.
• Active subscriptions: until cancelled, which you can do at any time. On cancellation the email address and choices are deleted immediately; for 2 years we keep only a non-reversible fingerprint of the address and the dates of consent and withdrawal, to protect ourselves in case of disputes.
• Reports of missing vendors or products: the anonymous text for 12 months; a non-reversible fingerprint of the IP address, used only to limit abuse, for 2 days.
• Technical browsing logs: according to the hosting provider's retention, usually a few days.

6. Your rights

You can at any time request access to your data, rectification, erasure, restriction of processing and portability, and object to processing (Arts. 15-22 GDPR), by writing to [email protected]. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.

Providing your email address is optional, but without it you cannot receive the alerts.

7. Cookies

For cookies, see the cookie policy.