ChronoStock
Legal
Privacy Policy
Privacy Policy — ChronoStock (English)
Last updated: 10/08/2026 Version: 2.0
1. Data controller
The controller of personal data collected through the ChronoStock application and the chronostock.xyz website is:
ChronoStock, registered address — to be added, VAT VAT number — to be added Email: info@chronostock.xyz
No Data Protection Officer has been appointed, the conditions of Art. 37 GDPR not being met.
2. Data processed, purposes and legal bases
| Data | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Email, user identifier (Firebase UID), credentials | Account creation, authentication | Contract — 6(1)(b) | Account life + 30 days |
| Store name, logo, sales points, collaborator data | Service delivery, team management | Contract — 6(1)(b) | Account life + 30 days |
| Inventory data entered by the user (brand, model, reference, serial, purchase and sale prices, notes, suppliers) | Core service delivery | Contract — 6(1)(b) | Account life + 30 days |
| User-uploaded images | Service delivery | Contract — 6(1)(b) | Account life + 30 days |
| Inventory backups (last 3) | Restore on user request | Contract — 6(1)(b) | Rotated; deleted with account |
| Purchase and subscription status | Subscription management, invoicing, fraud prevention | Contract — 6(1)(b) and legal obligation — 6(1)(c) | 10 years (tax law) |
| Technical logs, crash diagnostics | Security, stability, debugging | Legitimate interest — 6(1)(f) | 12 months |
| Push notification tokens | Operational reminders and service alerts | Consent — 6(1)(a) | Until withdrawn |
| Support correspondence | Handling the request | Legitimate interest — 6(1)(f) | 24 months |
We do not process special categories of data under Art. 9 GDPR, and we carry out no automated decision-making or profiling under Art. 22 GDPR.
Collaborator data. When you invite a collaborator to your store, you act as an independent controller for the data you enter about them, and ChronoStock acts as processor on your behalf. You are responsible for informing your collaborators.
3. Provision of data
Providing the data required for account creation and service delivery is mandatory; without it the application cannot be used. Providing data for push notifications is optional and can be withdrawn at any time in device settings.
4. Recipients and processors
Data may be processed by the providers listed in the Italian version of this policy (section 4), each appointed as processor under Art. 28 GDPR: Google (Firebase), Apple (App Store), Google Play, and our website hosting provider.
Personal data is never sold, rented or shared with third parties for marketing purposes.
5. International transfers
Some providers are established in the United States. Transfers outside the EEA rely on the European Commission's adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework where applicable, and additionally on the Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914, supplemented by technical and organisational measures. A copy of the safeguards is available on request at info@chronostock.xyz.
6. Security
We apply technical and organisational measures appropriate under Art. 32 GDPR, including encryption in transit (TLS) and at rest, role-based access control, and logical separation of data between stores. No system is absolutely secure. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will inform you without undue delay under Art. 34 and notify the supervisory authority within 72 hours under Art. 33.
7. Your rights
Under Arts. 15–22 GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. You may withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.
To exercise these rights, write to info@chronostock.xyz. We will respond within one month, extendable by two months for complex requests.
Right to complain. You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or the supervisory authority of your country of residence, under Art. 77 GDPR, and to seek a judicial remedy.
8. Account deletion
Delete your account directly in the app: Settings → Account → Delete Account, then confirm. Your profile and associated personal data are removed from active systems within 30 days; system backups are overwritten within 90 days. Data subject to a legal retention obligation (subscription tax records) is kept separately for the statutory period and used for no other purpose. You may also write to info@chronostock.xyz.
9. Minors
The service is intended for professional dealers and adult collectors. We do not knowingly collect data from children under 16.
10. Cookies
chronostock.xyz uses only strictly necessary technical cookies, including language preference storage. These require no consent under Art. 122 of the Italian Privacy Code.
11. Changes
This policy may be updated. Material changes will be communicated in the app or by email in advance.
12. Contact
ChronoStock — address — to be added — info@chronostock.xyz