Privacy Policy

1. Data controller

Scopelliti 1887 S.r.l. — Via Fata Morgana 52, 89125 Reggio Calabria (RC) — VAT no. IT02038170805. To exercise your rights you may write to the contacts given on this site.

2. Data we process

• Account data — first name, surname, email address (list owners and guests).
• List data — chosen products, messages, contributions.
• Video greetings and photographs — the footage showing face and voice, and the photographs (including post-event photographs), that a guest chooses to record or upload; and the photographs that whoever opens the list uploads to their list page (cover, gallery, event photographs), in which other people may also appear. Processed as ordinary audiovisual content, with no biometric recognition whatsoever.
• Access via email link — the guest’s email address, for passwordless sign-in and to resume a draft contribution.
• Concierge requests — name, email, phone (optional) and the text of your message, when you write to us from the form on the Concierge page.
• Browsing data for statistics — only in aggregate form and subject to your consent (see the Cookie Policy).
• Technical security data — your IP address and your browser’s signals, processed without consent because they are necessary to protect the service from abuse and automated use: they serve the Google reCAPTCHA Enterprise anti-fraud check, active on every page, and limit repeated requests from the forms that are open to anyone. We do not use them to measure your browsing or to profile you.
• Guests named by whoever opens a list — first name, surname, an optional label and, if the person opening the list wishes, an email address. We do not receive them from the guest but from whoever opens the list: if your name appears in an address book, your details come from there.
• Delivery address — street, postcode, city, province and any delivery notes, if the person who opens the list enters them to receive the gifts. Only the person who opened the list and the maison, which uses it for delivery, can see it: it never appears on the list’s public page. It stays in the account for as long as the account exists, can be corrected at any time from the settings and is erased together with the account.
• Email address of whoever pays a contribution — this is the address PayPal reports for the person who paid: PayPal is the source of this data, not a form on our site. It may be the address of your PayPal account or, if you pay by card without an account, the one you typed into PayPal’s form, which we cannot verify. We use it only to send you the receipt, and we keep it for a short time (see § 6).

3. Purposes and legal bases

• Provision of the service, including passwordless sign-in via email link (performance of a contract, art. 6(1)(b)).
• Video greetings and photographs that a guest chooses to send to the recipients: the data subject’s explicit consent (art. 6(1)(a)), which may be withdrawn at any time. For photographs in which other people appear, uploaded by whoever opens the list or published by the maison, see § 5: the application does not collect or verify the consent of the people shown.
• The Aldo artificial-intelligence assistant (advice on the catalogue): the conversation is retained only with your explicit consent (art. 6(1)(a)), which may be withdrawn at any time from the assistant’s panel; without consent the conversation is not retained. See § 4.
• Replying to requests written to the concierge: pre-contractual measures taken at your request (Art. 6.1.b). We use your contact details only to reply, and we keep the request for 12 months, after which it is deleted automatically.
• Newsletter and communications, only with explicit consent.
• Security and legal compliance (legal obligation / legitimate interest).
• Guest address book and email invitation: keeping the list of people named by whoever opens the list and, when an address is given, delivering the link to the list (legitimate interest, Art. 6.1.f). The first message we write to you informs you of this processing, as Art. 14 GDPR requires. If only your name appears in the address book, we have no way of writing to you: that is also why we say it here.
• Receipt for a paid contribution: sending the person who paid a receipt for their contribution (performance of the contract, Art. 6.1.b). It is sent, through Brevo, to the email address PayPal reports for the person who paid and, if that is different, also to the verified address of your account. If you enter an address that is not yours in PayPal’s form, the receipt will reach that address. It shows the name given for the gift, the name of the list, the amount and, if there is one, a sentence about your note; it does not show the address it was sent to. If PayPal reports no address and the account has no verified one, the receipt is not sent.

4. The “Aldo” artificial-intelligence assistant

Aldo is an artificial-intelligence system, not a person. Its answers are generated automatically by a generative model and may contain inaccuracies: always check the details on the product pages. We state this visibly every time you open the assistant, as required by art. 50 of Regulation (EU) 2024/1689 (AI Act).

Aldo recommends products from our catalogue: it takes no automated decision producing legal effects concerning you or similarly significantly affecting you (art. 22 GDPR). No product enters your list without your explicit confirmation, and no purchase is ever started by the assistant.

The conversation is retained only with your consent, which you may withdraw at any time from Aldo’s panel, as easily as you gave it (art. 7(3) GDPR). From withdrawal onwards no conversation is retained; those already saved are deleted automatically within 30 days. We ask you not to enter special categories of data (art. 9 GDPR) or third-party data into the chat.

5. Video greetings, photographs and the camera

Recording a video greeting uses your device’s camera and microphone only after your explicit consent and the browser’s permission: nothing is captured or sent without your confirmation. The video shows your face and your voice and is processed as ordinary audiovisual content — we carry out no facial or voice recognition, nor any other form of biometric identification. You may remove a video greeting or a photograph before sending it: removal also deletes the file from our archives. The augmented reality (AR) experience uses the camera locally on the device only, without sending images to our servers.

The photographs that whoever opens the list uploads from the Studio (cover, gallery, event photographs) appear on the list page, which anyone can view when the list is public, and may also show other people. When the service asks whoever opens the list to declare that they have the consent of the people shown, the application records that declaration (who made it, when, and which text they declared): it does not collect or verify the consent of the people shown, whom it does not know. The maison may also publish some event photographs in its own showcase: this is a separate act, carried out by an administrator who declares, on behalf of the boutique, that it has the consent of the people recognisable in the photographs, likewise recorded and likewise not verified by the application. A photograph in the showcase can be withdrawn at any time.

6. Retention

We retain data for as long as necessary for the purposes described and for legal obligations, then delete or anonymise it. In particular: list and contribution data for the duration of the service and the applicable statutory periods; video greetings and photographs remain for as long as the list they belong to remains, and are deleted when you remove them, when the list is deleted, or when you delete your account — today there is no automatic time-based deletion for these files, and when there is, this notice will say so; browsing data for the periods stated in the Cookie Policy. Conversations with the Aldo assistant, where you authorise their retention, are kept for a maximum of 30 days and then deleted automatically; they are removed in any case if you delete your account. Requests written to the concierge are kept for 12 months from the day they reach us, then deleted automatically: only boutique staff can read them, and the text you wrote to us cannot be edited by anyone.

If you do not sign in to your account for three years, we write to you one week before the term expires: if you come back, everything stays as it is. If you do not, the account joins a list the maison reviews and may be closed, together with the data linked to it. It does not close by itself: a person decides. Contributions already paid remain recorded afterwards too, because they are accounting records the law obliges us to keep.

The details of guests named by whoever opens a list stay in that list’s address book for as long as the list exists or until whoever opened it removes them, and are deleted with the list or with the account. The email address is used only for the invitation, which is sent once only. To find out whether your name is in an address book, or to ask to be removed, you can write to us at the contacts given on the site.

If you ask to delete your account from the settings, the account is suspended immediately and your open lists are closed. You can change your mind: from the link we email you, you can cancel the request, and the lists closed for it reopen, until the maison gives the go-ahead and in any case for at least 14 days. Then a member of the maison gives the go-ahead and the deletion begins: your profile, lists, delivery address, photos, video greetings and the other linked data are erased. The contributions already paid and the linked accounting records stay on file, together with the names shown on the list that received them, because the law obliges us to keep them: that list is no longer visible or usable by anyone. If you left a gift on other people’s list, the payment stays on file and your note stays without your name and your video. We also keep a minimal trace that the deletion took place, with no names or emails.

The email address we receive from PayPal is kept for one hour in a store reserved to the system: neither you, nor whoever opens the list, nor the boutique staff can read it from the site or the Console. It is deleted right after the receipt is sent; if the sending does not go through, it expires after one hour and the automatic deletion removes it, as a rule, within a day. It is also deleted together with your account. Because it lives so briefly and is not part of your archive, it does not appear in the “Download your data” file (rights of access and portability, Art. 15 and 20 GDPR): to find out whether we hold one at this moment, or to ask for it to be deleted, write to us at the contacts given on the site.

7. Processors and transfers

We use external suppliers. The following act as data processors on our behalf: Google (Firebase: authentication, database, media storage and hosting); Google reCAPTCHA Enterprise, the anti-fraud check active on every page, which receives your IP address and your browser’s signals; Google Cloud Vertex AI for the Aldo assistant, with processing in the European region europe-west1; Brevo for sending service emails, with servers in the European Union; and, subject to consent, Google Analytics 4 for aggregated browsing statistics. The onboarding map relies on Google Maps and Places, which receive your IP address and the text you type to search for a city. Payments are executed by PayPal, which receives the amount, the order reference and the description of the products purchased, and which also processes this data for its own purposes, including fraud prevention. Some of these services may involve transfers outside the European Union: these are made to suppliers certified under the EU-US Data Privacy Framework or, where it does not apply, on the basis of the European Commission’s Standard Contractual Clauses. The durations of measurement cookies are stated in the Cookie Policy.

8. Your rights

You may exercise your rights of access, rectification, erasure, restriction of processing and data portability, you may object to processing, and you may withdraw consent at any time (including consent to video greetings and photographs). We will respond within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

9. Cookies

The use of cookies and similar technologies is described in the Cookie Policy, where you can also manage your preferences.

10. Minors

The service is not aimed at minors and does not ask for or verify the age of those who use it: there is no date of birth to enter, and nothing prevents a minor from using it. We therefore cannot rule out that a minor appears in content uploaded to the service, for example in a video greeting recorded by a guest or in a photograph.

In Italy, a minor who has turned 14 may give consent on their own to the processing of their data in information society services; under 14, the consent of whoever holds parental responsibility is required (art. 2-quinquies of the Italian Privacy Code). The box a guest ticks to agree to record and send their own video greeting is a declaration by that person: we have no way of knowing whether whoever ticks it is old enough to do so, nor of verifying a parent’s authorisation.

If you hold parental responsibility and believe that a video or photograph showing a minor was uploaded without your authorisation, or if you are a minor and would like us to remove something you sent, write to us at the contacts given on the site, stating the list and, if you can, the content. The data controller is the one named in section 1: we will examine the request and, where the conditions are met, remove the content, replying to you within one month.