Privacy notice

Version of 20 October 2026. Notice under Article 13 of Regulation (EU) 2016/679 (GDPR) for whoever uses Varca's Identity (id.varca.app) and an Organization's app on Varca. The Italian version is the reference text.

Who the controller is

The controller is [NOME E COGNOME], a natural person, living at [INDIRIZZO]. For any question or request about this data: [EMAIL DI CONTATTO].

Varca is not a company yet: until it is, the controller is this person. No data protection officer (DPO) has been appointed.

What the Identity is

The Identity is the service, at id.varca.app, you enter Varca with. You register your phone (with the Varca app for Android) or a security key, and with them you sign in to the Organizations you belong to, on the phone and from a computer. Each Organization has its own app, on an instance kept apart from the others.

What the Identity holds

• Who you are: your name and, when the invitation names one, the email you sign in with from a computer (also the address that receives the recovery code and a notice when a phone or a key is added). The language you chose.
• Your phones and security keys: for each, the model's name (for a phone, maker and model) or the label you give it; the public key (the private one never leaves the phone or the key); the proofs of its attestation (that the key is in secure hardware, that the phone booted verified, and that the app is ours); for a security key, the credential's id, its model (AAGUID), its signature counter and how it connects; when it was added, when it was last used and, if you removed it, when.
• The notification token of each phone, which the Identity wakes the app with when a sign-in waits for approval or something is there to see.
• Sign-ins from a computer: for each request, the code shown, the service that asked, when, how many tries; the browser's and the operating system's names (from a fixed list, not the browser's whole header); the approximate city and country, estimated from the IP address with a database on the server itself (DB-IP), when possible. The IP address is not saved: it is used in memory only, to limit attempts and to estimate the place.
• Approvals: which phone approved which sign-in and when, and the sign-ins you refused ("Not me").
• Sessions: where you signed in with the Identity (up to 30 days from the phone, up to 12 hours from a computer) and which Organizations you gave access to (up to a year).
• Recovery: a fingerprint (hash) of your recovery code, never the code; recovery requests, with the code sent by email (valid 10 minutes).
• Invitations: the name and email of whoever is invited and a fingerprint of the invitation, valid 24 hours and once.

In memory, never on disk, briefly: which Organization woke your phone (an hour), and the changes to your account asked from a computer while they wait for the phone (five minutes).

Why, and on what basis

• To let you in and keep your account safe: recognising your phone or key, verifying your approvals, recovering access if you lose the phone. Basis: performing the agreement under which you use Varca (Art. 6(1)(b) GDPR). Without this data you cannot sign in.
• To protect you and the service from abuse: limiting attempts, telling you where a sign-in request comes from so you can recognise it, keeping the record of sign-ins, approvals and refusals. Basis: the legitimate interest in the service's security (Art. 6(1)(f) GDPR).

Who receives the data

• The Organizations you sign in to. At each sign-in, each one's app receives: an identifier different for every Organization (it cannot link you from one Organization to another), your name, your language, your phones' public keys (to verify your approvals), and that you used a hardware key and your fingerprint. It does not receive your email, your phones, or the other Organizations you use.
• Varca's console, used by the controller for support (removing a lost phone, for instance): it sees the name, the sign-in email, phones and keys (label, kind, when added and last used), whether a recovery code exists, and which Organizations you sign in to. Never a key, a notification token or what you approved.
• Providers processing the data on the controller's behalf:
  • Hostinger, which provides the server the Identity runs on ([DA VERIFICARE: località del server]);
  • Google (Firebase Cloud Messaging), which delivers notifications: it receives the phone's token and an empty message that wakes the app, never the content;
  • Scaleway (France), which sends the emails: it receives your address and the message's text (the recovery code, a notice);
  • GitHub, which keeps the backups, encrypted so that only the controller can read them.
• Transfers outside the European Union: Google and GitHub are US companies. [DA VERIFICARE: base del trasferimento per ciascuno, per esempio l'EU-US Data Privacy Framework o clausole contrattuali tipo.]

How long

• What concerns you, your phones, keys, sign-ins, approvals and refusals stays while your Identity exists. Today nothing is deleted automatically: a removed phone stops working but stays recorded, and expired requests stay in the history.
• Sessions expire as above; invitations after 24 hours; recovery codes sent by email after 10 minutes.
• The server's technical logs (events, no content) are kept 90 days.
• The encrypted backups are kept with no expiry.
• If you leave an Organization, your Account in that Organization is removed; your Identity stays, with the others.

What an Organization's app holds

Each Organization (Stipa, for instance) has its own app, on an instance of its own. For this data too the controller, for now, is the person named above.

• Your Account there: the name, the link to your Identity (with the identifier kept for that Organization), your role and rights, sessions and notification subscriptions.
• What you do there: tickets, notes, comments, maps, documents, conversations with the Agent and their attachments, absences, and approvals, with your phone's signature as the evidence of what you approved.
• The Organization's Agent uses a language model. Requests go through OpenRouter (United States), with their use for training refused. The default model is DeepSeek V4 Flash, served only by providers that keep no data (in Europe or elsewhere, as OpenRouter lists them). When it does not answer, or for a photo or a PDF, a fallback model (Google Gemini 2.5 Flash Lite) answers, on providers OpenRouter chooses; web research uses an OpenAI model, which receives the research questions only, never the conversation. For a single conversation another model among those tested may be chosen. Before a request leaves, emails, IBANs, tax codes, VAT numbers, phone numbers and the names the Organization already knows are replaced by placeholders; other names written in the text may reach the model. [DA VERIFICARE: base del trasferimento verso OpenRouter e gli altri fornitori fuori dall'Unione europea.]
• This data stays while the Organization exists or until you ask for it to be erased; the encrypted backups with no expiry, as above.

Your rights

You may ask at any time for:

• access: to know what data we hold about you, and a copy;
• rectification: to correct it;
• erasure: to have it deleted, when it need no longer be kept;
• restriction: that it only be kept, with no other use, while a request of yours is checked;
• portability: to receive it in a machine-readable format;
• objection: to processing based on legitimate interest.

How: write to [EMAIL DI CONTATTO]. We answer within a month. Some things you already do yourself, in Your account: changing your name and language, removing a phone or a key, making a new recovery code, "Sign out everywhere". Today the copy of your data and erasure are done by hand by the controller, at your request.

You also have the right to lodge a complaint with the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it).

Changes

If this notice changes, the new version is published at this address with its date.