Privacy Policy

Last update: 01 August 2026

SKADO, headed by Mr. Angelo Cassano, born in Bari on 09/08/1994 and resident in Bari, VAT No. 08706260729 (hereinafter “SKADO”, the “Company” or “We”), in its capacity as data controller, pursuant to EU Regulation no. 2016/679 (hereinafter “GDPR”), is committed to protecting and respecting your privacy.

Subject of the processing

This information notice (together with any other documents referred to herein) describes the personal data (“Personal Data”) that the Company collects from the user of the application (“App”) and how such data are processed.

For the purposes hereof, “user” means any individual who has accessed the App.

Providing data marked as mandatory is necessary in order to create and manage the account and to provide the App’s functionalities, and constitutes a contractual requirement; failing this, we will not be able to provide the requested service. Providing data for optional purposes (e.g. marketing, nonessential analytics) is voluntary: refusal will not affect the use of the essential functionalities.

  • a) The Company collects personal information regarding visits to the App, including, by way of example only, traffic data, location data, weblogs and contact forms, as well as other communication data and the resources accessed by the user. Collecting this personal information will make future visits to the App easier, as the Company will be able to suggest relevant content based on the location from which the App is accessed.
  • b) The Company collects all information provided by the user when submitting contact forms (for example “Contacts”) and in particular some of the following: first name, last name, email address. In case of any doubt on the user’s part, the Controller will be pleased to help clarify the specific legal basis applicable to the processing and, in particular, whether the provision of personal data is a legal or contractual requirement, or a requirement necessary in order to enter into a contract. In this regard, please note that fields marked with an asterisk (*) are mandatory, since the Company needs this information to enable the operation of the App and of the user’s profile, as well as to fulfil or respond to the user’s request. Other information or personal data shared when filling in contact forms are provided at the user’s discretion. If you contact the Company, a record of such correspondence will be kept.
  • c) In addition, the Company collects all information provided by the user for registration to the application, in particular the first name, last name, email and password provided during registration or those relating to the Apple or Google account in case that login method is chosen, as well as the socalled “device ID”, in addition to information relating to the payment and the chosen subscription, namely transaction ID, product name, price, currency, offer ID and product ID (identifiers assigned by the RevenueCat platform), purchase date and expiry date. Credit card data will not be processed by SKADO but directly by the store/payment provider.
  • d) While using the application, the Company may collect: user identifiers provided by the Firebase and RevenueCat platform (necessary for sending push notifications, performance/telemetry and inApp purchases), stored products (name, expiry date, location, notes), notification preferences, language, recipes and conversations with the AI chatbot (for functionalities, reference is made to the contents of the updated T&Cs), shopping lists and invited members, as well as data necessary for Appuser communication, such as notification center, push notifications and for sending any service emails.
  • e) Personal information is used for sending direct marketing by email if this option has been accepted in the relevant contact form. You may opt out of receiving marketing communications at any time. The Company does not process special categories of personal data within the meaning of Article 9 GDPR, except where explicitly provided by law or authorised by the user.

Purposes of the processing and legal basis

Personal Data are collected and processed by the Company in order to:

  • a) allow the operation and proper maintenance of the application and the purpose set out in the General Terms and Conditions, with all the functionalities therein provided, depending on the type of subscription chosen;
  • b) tailor content and resources to the user’s preferences;
  • c) respond to the user’s requests or questions by email or telephone;
  • d) send other information and communications by email that may be of interest to the user;
  • e) create, publish and improve the most relevant content for users;
  • f) ensure that the content provided through the application is presented in the most effective way for the user depending on their device;
  • g) enable participation in the application’s interactive and communication features, if so desired;
  • h) further develop and improve the application and systems to better serve users;
  • i) send informational and promotional communications relating to the activities of the data controller;
  • j) for marketing purposes;
  • k) to analyse, for technical purposes and, where relevant, also for purposes relating to the sale of products, including promotional purposes, user behaviour (for this purpose, by way of example and without limitation, Firebase Analytics, Firebase Crashlytics, BetterStack will be used).

The use of the information described above is permitted under the applicable personal data protection law because:

  • a) it is necessary for the legitimate interests of the Company in pursuing the purposes set out above, it being understood that such interests are in any case not in conflict with the users’ right to privacy;
  • b) in some cases, it is necessary in order to fulfil the Company’s legal or regulatory obligations, for example in the event of disclosures to authorities, government or regulatory bodies; or
  • c) in some cases, it is necessary for the performance of a task carried out in the public interest and, where the Company uses special categories of Personal Data, it is necessary in order to establish, exercise or defend legal claims, or where the processing relates to personal information that is manifestly made public;
  • d) in limited circumstances, with the consent given from time to time by the user, when they agree to receive news and marketing communications by email.

For each purpose we indicate the actual legal basis and, where it relies on our legitimate interest, we describe its contents and your right to object at any time by writing to the addresses indicated in this information notice or via the inApp settings.

  • Operation and maintenance of the App → performance of the contract
  • Adapting content to the user’s preferences → legitimate interest in improving the user experience, or performance of the contract where strictly necessary to provide the requested functionality
  • Contact/support → performance of the contract and/or legitimate interest in improving the quality of support
  • Sending “other information/communications by email excluding direct marketing” → legitimate interest in informing users about nonpromotional service updates, with a possible right for the user to object
  • Creation, publication and improvement of content → performance of the contract, legitimate interest in improving the quality of content. Possible user objection for nonessential uses
  • Effective delivery of content based on the device → performance of the contract (technical adaptation necessary for use), possible user objection where nonessential tracking is used
  • Participation in interactive/communication features (chatbot) → performance of the contract for chats, shared lists, community; possible legitimate interest for moderation/antifraud with the user’s right to object in case of additional nonnecessary processing
  • App development and improvements and telemetry/Crashlytics systems → legitimate interest in security and service improvement, with minimisation measures, user right to object in case of additional nonnecessary processing, without prejudice to the collection of essential technical data for security and reliability, which must always be possible
  • Sending informational and promotional communications relating to the controller’s activity → optin consent with the possibility of withdrawal, or active softspam with the possibility of immediate optout and the right to object to marketing at any time
  • Marketing → data processed on the basis of explicit consent for campaigns, marketing profiling and channels not covered by softspam, with granular optin by channel/purpose and right to object at any time where technically possible
  • Analysis of user behaviour also for promotional purposes (e.g. Firebase Analytics) → consent for analytics for promotional/profiling purposes with revocable optin; legitimate interest may apply for strictly aggregated and nonidentifying analytics if they are effectively not necessary for marketing and with strong minimisation, without prejudice to the right to object with an optout.

The Company does not take decisions based solely on automated processing, including profiling, which produce legal effects concerning the user or similarly significantly affect them. Any profiling activities for marketing or personalised analysis purposes will take place only with prior consent, with the right to withdraw such consent at any time and to object to processing for direct marketing purposes.

Retention period

The Company retains information for the period necessary to fulfil legal obligations. The retention period of personal information depends on the purpose for which the data are processed and on the tools by which such personal information is processed. It is not, however, possible to indicate the retention period in a reasonably precise and predetermined manner in this information notice. The criteria used to determine the applicable retention period are closely related to the time (i) needed for the relevant purpose, (ii) necessary to perform the business relationship with the user, (iii) accepted by the user and/or (iv) required by applicable laws.

It is specified that data strictly necessary for the operation of the App are never deleted, and that data collected for purposes related to the performance of the contract between the Controller and the user will be kept until such contract has been fully performed, and likewise data collected for the Controller’s legitimate interests will be kept for as long as necessary to fulfil those purposes.

In general, the Controller will use its best efforts to comply with the following data retention scheme:

  • Data indicated above as necessary to keep the account active: until account deletion.
  • Inapp purchase data: present even after account deletion, but anonymised by deleting the customer identifier.
  • Productrelated data: present even after account deletion, but anonymised by deleting the customer identifier.
  • Messages exchanged with the chatbot: until account deletion.
  • Notifications: present even after account deletion, but anonymised by deleting the customer identifier.
  • Notification tokens: present even after account deletion, but anonymised by deleting the customer identifier.
  • Technical logs/telemetry: according to the methods set out in the information notice of the relevant platform.
  • Payment data (store purchase metadata): according to the methods set out in the information notices of Apple/Google and RevenueCat.
  • Data derived from photographs of purchase receipts: the photos are immediately deleted once data have been extracted via OCR. Once extracted via OCR, the data will be retained for one hour from the scan. Once converted into a product list and entered in the SKADO App, the data are processed like the other productrelated data (see above).

All data which, under the anonymisation conditions indicated above, will be retained beyond the date of account deletion are intended to build databases or will make it possible to perform data analyses, including data regarding the platform’s own revenues.

The Controller may be authorised to retain Personal Data for a longer period whenever the user has given consent to such processing, provided that such consent is not withdrawn. In addition, the Controller may be obliged to retain Personal Data for a longer period whenever this is necessary to fulfil a legal obligation or by order of an authority.

Once the retention period has expired, personal data will be deleted. Therefore, the right of access, the right to erasure, the right to rectification and the right to data portability cannot be exercised after the expiry of the retention period.

Data collected by third parties, such as those collected by BetterStack, Firebase Analytics and Firebase Crashlytics, are not controlled by this Company, and therefore reference is made to the privacy notices of such third parties: should you have difficulty in locating those information notices, you may contact the Controller via the email address indicated below, and the Controller will provide such assistance as is within its power.

Insofar as the processing of Personal Data is based on your consent, you also have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of any processing based on consent before such withdrawal. We remind you that the sending of informational and promotional communications can be stopped at any time by selecting the “unsubscribe” option at the bottom of each newsletter received. From that moment on, you will no longer receive our informational and promotional communications.

Sharing Personal Data with third parties

In order to facilitate the efficient use of information and to provide the user with content and/or resources, information is disclosed to third parties. However, such disclosure will take place only in the following circumstances:

  • a) to suppliers, contractors and agents (IT providers, hosting services, maintenance, push notifications, analytics/telemetry platforms, inapp purchase services, authentication tools, AI/voice providers, consultants and parties supporting the provision of the services. Parties processing data on our behalf act as “processors” under agreements compliant with Article 28 GDPR; certain parties (e.g. operating system manufacturers/store platforms) may act as independent controllers for their own purposes): the Company may engage or rely on other companies and individuals to perform certain functions on its behalf, such as hosting and/or maintaining the contents of the application or providing certain features contained therein, or providing marketing services or economic updates on the user’s request. Recipients will have access to personal information only to the extent required to perform their functions, and may not use it for other purposes. Recipients will be bound by contractual confidentiality obligations. They will act as processors;
  • b) to governmental or judicial authorities if the Company believes they are legally obliged to request it.

The Company points out, in particular, that the main (but not the only) recipients of the data collected under this Information Notice will be Google and Apple (by means, by way of example and without limitation, of the following services: Firebase Analytics, Firebase Crashlytics, Firebase Cloud Messaging, Apple Inapp Purchases, Apple Push Notification Service, Firebase Remote Config (feature flags and enabling/disabling functionalities); Gemini API (text and voice chatbot); GoDaddy (skado.app domain); Google Analytics (clientside telemetry); Google Inapp Purchases (inapp purchases via RevenueCat); Hetzner (VPS provider for platform hosting); BetterStack (backend performance/telemetry); RevenueCat (intermediary for inapp purchases); Sign in with Apple (thirdparty login tools on iOS); Sign in with Google (thirdparty login tools on Android and iOS); Simple Analytics (GDPRcompliant website analytics, cookieless); Speech recognition with Apple (texttospeech and speechtotext to convert voice into text and vice versa); Speech recognition with Google (texttospeech and speechtotext to convert voice into text and vice versa)).

In addition, the system will integrate with Alexa technologies, for which reference is made to the privacy policy available on Amazon’s pages.

Finally, OCR text extraction functionalities for receipts will be performed using mistral.ai features, for which reference is made to the relevant privacy notice.

The data managed by these thirdparty services are mainly located in the EU or in North America, Central America and Asia.

If you have difficulty in locating the information notices relating to the data processing carried out by those third parties, you may contact the Controller at the email address indicated below, and the Controller will provide such assistance as is within its power.

IP addresses

The Company collects information about computers, smartphones or other IT devices. Such information includes (where available) the device ID, operating system and software or browser version, for system administration. These are statistical data about users’ actions and browsing behaviour which may identify the person, their device and email address. By way of example and without limitation, the Analytics, Crashlytics and RevenueCat services mentioned above allow the association of the device ID with the authenticated user, thereby identifying the person who has correctly provided their personal details and email address.

These data, which will be collected by third parties (Google), are mainly aimed, though not exclusively, at ensuring the correct functioning of the App or for maintenance purposes. Reference is therefore made to Google’s privacy policy and its services, it being understood that SKADO remains available for any indications, clarifications or suggestions on how to contact the platforms for information requests.

Transfer of Personal Data

The Personal Data collected may be transferred to and processed in one or more countries inside or outside the European Union. Data are transferred outside the EU only to countries that the European Commission considers to offer an adequate level of protection, or where the Company has implemented appropriate safeguards to preserve the confidentiality of such information.

If the transfer is made to countries covered by an adequacy decision of the Commission, the transfer will be based on such decision; in the absence of an adequacy decision, we will adopt appropriate safeguards (e.g. the Commission’s Standard Contractual Clauses) and, where necessary, additional measures. You can obtain a copy or information on the safeguards by writing to the address indicated below.

In particular, the following data: email, first name, last name and device ID will be transferred outside the European Union, especially to the USA, in the ways described below or found in the privacy notices of the following third parties:

  • Apple: via APNs, thirdparty access
  • Google: via Firebase, Gemini, thirdparty access
  • BetterStack
  • RevenueCat

Data security

Although the Company is committed to doing everything possible to protect personal information, you are informed that the transmission of information over the internet is not completely secure and the security of Personal Data transmitted to the application or to third parties cannot be guaranteed; for this reason, any data transmission is at the user’s own risk.

However, strict operational procedures and appropriate technical and organisational security measures are applied in order to prevent any unauthorised access, alteration, deletion or transmission of such personal information. All information transmitted to and from the servers complies with web encryption standards (SSL, TLS, etc.).

User rights

Articles 15 to 22 GDPR grant the user, as data subject, the exercise of specific rights, which are set out below:

  • Right to access and obtain a copy of your Personal Data: the user has the right to request confirmation as to whether the Company is processing any of their personal data. If so, they may access their Personal Data and certain information regarding the processing. In some cases, they may ask the Company to provide an electronic copy of their data.
  • Right to rectification of Personal Data: where the user is able to demonstrate that their Personal Data held by the Company are inaccurate, they may request that such data be updated or corrected.
  • Right to be forgotten/to data erasure: in certain circumstances, the user has the right to have their Personal Data erased. The request may be made at any time and the Company will assess whether it can be granted. However, this right is subject to legal rights or obligations which may require the Company to retain data. If it is established that, under the law, the request for erasure of Personal Data can be granted, the Company will promptly do so without undue delay.
  • Right to object: although the processing of the user’s data by the Company is based on its legitimate interest (and on no other processing ground), the user has the right to object to the way the Company processes their Personal Data with reference to their particular situation.
  • Right to withdraw consent: insofar as the processing of Personal Data is based on your consent, the user also has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of any processing based on consent before such withdrawal.

Where personal data are processed for a public interest, in the exercise of an official authority vested in the Controller or for the purposes of the legitimate interests pursued by the Controller, users may object to such processing by providing grounds relating to their particular situation to justify the objection.

Users should be aware, however, that if their personal data are processed for direct marketing purposes, they may object to such processing at any time, free of charge and without providing any justification.

Where the user objects to processing for direct marketing purposes, personal data will no longer be processed for such purposes. To find out whether the Controller is processing personal data for direct marketing purposes, users may refer to the relevant sections of this document.

How to exercise your rights

In order to exercise their rights, users may write to the following email address: info@skado.app.

It is also possible to lodge a complaint concerning the processing of Personal Data with the local Data Protection Authority.

The user may exercise at any time the rights of access, rectification, erasure, restriction of processing, data portability, objection, as well as withdrawal of consent. We will respond without undue delay and within one month of receipt (extendable by two months in the case of complex or numerous requests), informing you of the reasons for any extension. The exercise of rights is free of charge, except in the case of manifestly unfounded or excessive requests.

Marketing communications

The Company sends marketing communications by email only if the user has consented to this. As a rule, the forms used by the Company to collect Personal Data contain a tick box to be selected if the user wishes to receive marketing communications.

When marketing communications are sent by email, the user may choose not to receive further communications by clicking on “unsubscribe” or using the optout function in the email. Furthermore, it is possible to exercise the right to withdraw consent at any time by contacting the Company at the email address: info@skado.app and providing the following information: name, email address, telephone number, and the marketing communications that you no longer wish to receive.

Further information on data collection and processing

Legal action

The User’s Personal Data may be used for legal purposes by the Owner in court or in the stages leading to possible legal action arising from improper use of this Application or of the related Services.

The User declares to be aware that the Owner may be required to disclose personal data upon request of public authorities.

Further information about the User’s Personal Data

In addition to the information contained in this privacy policy, this Application may provide the User, upon request, with additional and contextual information concerning particular Services or the collection and processing of Personal Data.

System logs and maintenance

For operation and maintenance purposes, this Application and any thirdparty services may collect files that record interaction with this Application (system logs) or use other Personal Data (such as the IP address or device ID) for this purpose.

Information not contained in this policy

More details regarding the collection or processing of personal data may be requested from the Controller at any time. Please refer to the contact information at the beginning of this document.

Changes to this Privacy Policy

The terms of this Policy may change from time to time. The Company will publish any substantial changes to this Policy by appropriate notice on this application or by contacting the user through other channels.

Contacts

Please note that questions, comments and requests regarding this Policy must be addressed to the Company at the following email address: info@skado.app.

The default languages are Italian and English; where users have different reasonable expectations, they may contact SKADO at the address indicated above.

This information notice is always available in the app and on the website and is updated when purposes, legal bases, recipients or transfers change.