1. Who operates ZAD
Data controller and service provider: Marco Zulian, VAT no. 03334690801, Viale Pio XI 204, 89133 Reggio di Calabria, Italy.
Privacy and support: zaditalialibera@zulianarchitetturadigitale.eu
Platform: ZAD Social — https://social.zulianarchitetturadigitale.me
The national Beta is free and for adults only. Text posts, photos and photo stories require no payment. Video, live streams and push notifications are not enabled. Stripe support is optional and grants no privileges. This configuration does not sell personal data or run behavioral advertising.
2. Personal data processed
Free registration does not require a real first or last name, home address or email. This is not an absence of data: accounts, posts and photos are stored on the VPS to provide the social. The private key and read chat history stay in the device browser; encrypted envelopes pass through the server and metadata remains. Backups are encrypted before upload to Google Drive, with keys stored separately.
- Account: unique username, ID, public name, biography, optional avatar and website, role and creation date. The database stores a scrypt password hash, not a plaintext password, plus hashes of recovery codes and session tokens. For MFA users, the server stores the TOTP secret encrypted with a service key and anti-replay state. Administration requires verified MFA. The initial owner's recovery is a separate private file, not a public website resource.
- Sign-in: username/password registration requires no email. Google and Apple sign-in are not connected. Saving a password in Apple Passwords is a device feature, not federated ZAD sign-in.
- Content and interactions: posts, photos, stories, comments, reactions, saves, followers, blocks, news preferences, in-app notifications, reports, reasons and appeals. Images may contain personal data even after re-encoding. Editorial articles and revisions are stored for blog operation.
- Optional support: the backend stores Stripe identifiers associated with the account, amount, currency, frequency, verified status, dates and accepted terms version. A withdrawal/refund request also stores the supplied declarant name, optional contact email, declaration and response; these are not added to the public profile. It does not store full card numbers or CVCs. Support changes no access rights or privileges. Stripe processes Checkout data according to its privacy policy; Checkout is not loaded automatically to use the social.
- Messages: encrypted envelopes, public keys, participants, authors, conversations and dates; see section 5 for limits and local copies.
- Security: the server/proxy receives IP addresses; application rate limits store hashed identifiers and expiring counters. Hashing does not automatically anonymize information. Infrastructure logs and audit data may remain. Service logs are restricted to the operator and authorized technical support. Application logs do not intentionally record passwords, codes or chat plaintext.
- Optional location: enabling fuel-search GPS stores coordinates locally and sends them to the fuel API. Search without GPS is possible. Google Maps links can pass origin and destination; see the Cookie Policy for OpenFreeMap/OpenMapTiles/OpenStreetMap cartography.
- Support: information voluntarily sent by email or external channels is used to respond. Do not send passwords or codes. For future optional support, Stripe-hosted Checkout may request an email and payment or accounting details; these are separate from data required for free registration.
3. Purposes and legal bases
- Delivering accounts and requested functions: performance of a contract (GDPR Article 6(1)(b)).
- Handling support and service requests: performance of a contract and, where relevant, compliance with legal duties.
- Keeping fiscal records and complying with the law: legal obligation (GDPR Article 6(1)(c)).
- Protecting service integrity, preventing abuse and handling reports: legitimate interests where applicable, following balancing, and/or legal duties (GDPR Article 6(1)(f)/(c)).
- Optional processing: only when supported by the applicable legal basis, including consent where legally required.
Posts about political opinions, beliefs or other sensitive matters may reveal special categories of personal data under GDPR Article 9. Avoid posting special-category information about others without a lawful basis. Choosing to publish your own information does not authorize additional uses by ZAD. Restricted content remains subject to the access controls and rights described here. ZAD does not use this information to create political profiles or sell data to advertisers.
4. Profiles, posts and visibility
Usernames and some profile presentation data may remain visible for private accounts. Schema 22 implements private accounts and follower approval requests; restricted content does not become public by approving a follower. Its interface is available in privacy settings. Posts support public or followers-only visibility with backend authorization and blocking. A private profile is not an encrypted chat and cannot prevent an authorized recipient from making copies.
Articles and public content can be read or copied and may be indexed where accessible to search engines. Neither indexing nor its absence is guaranteed. Controls cannot prevent screenshots or independent copies. Settings provides a JSON export subject to the limits in the data and deletion procedure.
5. Messaging and encryption
New messages are encrypted in the browser before submission using ECDH P-256, HKDF and AES-GCM. Device private keys stay in IndexedDB. The server receives public keys and encrypted envelopes for sender and recipient; the current application has no administrative envelope-decryption function. Conversation participants and metadata are known to the server.
After the recipient browser decrypts, saves locally and acknowledges a message, its envelope is deleted from the operational database. For messages created after the new policy activates, unacknowledged envelopes are no longer deliverable 30 days after sending and are removed in batches by the next successful maintenance cycle. Senders receive a notice from day 27. Earlier historical envelopes are preserved for separate review rather than retroactively erased by this update. A sender's delete action hides the message in the app but does not immediately erase the database row or previously received copies.
Local history is stored as plaintext by the app in the browser, not as an encrypted-at-rest archive. Keys belong to that browser and cannot automatically be replaced from another device. Password recovery does not recover history or keys; key recovery and multi-device sync are not implemented. Clearing site data can lose both. Older backups can retain encrypted envelopes.
This is not certification of an independently audited end-to-end protocol: out-of-band key verification and double-ratchet guarantees are not implemented. We do not promise absolute secrecy, safety of a compromised device or erasure of every copy.
6. Service providers and recipients
- Hosting: OVHcloud VPS running Node, SQLite and private filesystem photos; D1 and R2 are not active in this installation. Administrative addresses, credentials and internal backup paths are not published. Recipient categories include hosting, infrastructure support and cloud-storage providers; contact the controller for information about applicable safeguards.
- DNS and email: .me nameservers and .eu mailbox MX records checked on October 21 point to Register.it. The controller handles the mailbox for support, reports and privacy requests; do not send secrets or illegal material.
- Backups: the VPS sends daily encrypted backups to Google Drive storage reserved for the operator. Keys and credentials are kept separately from Drive and are not in public archives. Users do not access the operator’s Drive: personal exports and downloads use authenticated ZAD controls. Self-hosted n8n monitors technical outcomes, not chat plaintext. Historical copies also exist on the VPS and Marco Hard. Restoration with deletion replay has been tested. The 30-day cycle applies to new snapshots after policy activation; earlier copies remain protected for separate review, so immediate erasure of every historical copy is not promised. Copies are restricted to the operator, not a shared user Drive; the storage provider does not receive archive encryption keys.
- Optional external services: source links, Google Maps and OpenFreeMap/OpenMapTiles/OpenStreetMap cartography contact third parties when the browser makes the corresponding request. Voluntarily loading the map contacts
tiles.openfreemap.orgfor styles, fonts and map data; the provider receives the IP address and requests for viewed areas. Prices continue to come from the ZAD database. These services do not provide ZAD accounts or payments.
The social is served by the VPS. Cloudflare also provides the server-to-server relay downloading official MIMIT CSVs; that relay receives no ZAD accounts, photos or messages and does not replace the fuel database. Google/Apple OAuth and push are disabled. Stripe is connected for optional support; webhook intake is active independently of acceptance of new contributions, which can be paused while existing support remains manageable. Planned services are not listed as active. New integrations require a policy update.
This configuration does not use users' content for AI training. Valid legal requests and applicable duties may require disclosure to authorities. External services may involve processing outside the EEA. We do not guarantee that every copy stays in one country. Contact the controller for information about recipients and applicable safeguards; providers describe their own processing in their respective privacy notices.
7. Retention and deletion
The owner approved these periods on October 21, 2026. Approval alone does not activate procedures: the implementation column identifies automated controls and manual procedures. This revision deletes no existing data or backups.
| Data | Approved duration or criterion | Implementation |
|---|---|---|
| Accounts, profiles, posts and photos | For account use, until deletion through available controls or reasoned content management. No deletion for inactivity alone in the first Beta. | Account deletion and bounded cleanup exist. Approved operational target: finish cleanup within 7 days of a valid request, subject to justified exceptions; incomplete requests remain in maintenance and may be brought to the controller’s attention. |
| Photo stories | 24 hours of visibility. Cleanup target for media no longer used anywhere: within the following 24 hours. | Visibility expires after 24 hours; batched cleanup runs at the next successful maintenance cycle. Photos reused elsewhere are not unused media. |
| Sessions and anti-abuse counters | Sessions up to 7 days from issue unless revoked earlier. Counters follow each operation’s expiry window. | Maintenance removes expired records at the next successful cycle. |
| Undelivered messages | At most 30 days from sending; delivered envelopes are removed earlier after recipient acknowledgement. | Acknowledgement, the 30-day delivery limit, a day-27 notice and batched cleanup are implemented for new messages. Maintenance interruption may delay physical removal but does not extend delivery. Pre-policy historical messages are preserved for separate review. |
| Metadata and local history | Target: remove empty conversations inactive for 90 days, only without pending messages. Local history and keys until voluntary removal or loss of browser data. | New conversations track last activity; batched cleanup removes only empty conversations inactive for 90 days. Historical conversations are preserved. No guaranteed remote erasure of device copies or key replacement. |
| Reports, decisions, appeals and related evidence | 12 months after final case closure. Quarterly review of open cases; only necessary evidence. | The controller manually reviews closed cases, retaining only necessary evidence; general automatic case deletion is not active. Nulling user references is not guaranteed anonymization. |
| Administrative audit and technical logs | Administrative audit: 12 months. Ordinary technical logs: 30 days. Incident data: necessary records until closure, reviewed quarterly. | The controller manually reviews necessity and expiry. No general automatic purge of every provider log is promised. Application logs contain technical outcomes, not chat text or passwords. |
| Support and privacy requests | Ordinary support: 12 months after closure. Rights-request documentation: 24 months after closure, limited to necessary evidence. | The controller has undertaken daily checking. Mailbox access is restricted to the controller; closed cases and unnecessary attachments are manually reviewed against these periods. |
| Backups and operational copies | 30-day cycle for new backups after policy activation, with daily backups; temporary restore drills and operational exports: at most 7 days after verification. | Daily encrypted backups and restoration are verified. The 30-day rotation applies only to snapshots after policy activation, always keeping the last verified copy. All earlier copies are protected from automatic disposal and require separate review; immediate erasure from every historical archive is not promised. |
| Editorial revisions and operational recovery | Revisions are kept for editorial management; code caps historical revisions at 50 per article. Initial credentials/recovery: replacement or revocation only after private handover and a recovery test. | No unapproved time limit is assigned to revisions; the need for personal references and copies must be reviewed. No owner recovery material is deleted now. |
Applicable legal duties or disputes require a documented reason, necessary records only, restricted access and review; they do not justify indiscriminate retention. After backup restoration, post-snapshot deletions must be reapplied before service resumes. Schema 22 restoration, deletion replay and quarantine before restart have been tested. This does not immediately erase every historical archive. Other users’ device copies are outside our control. See the deletion procedure.
8. Your rights
Marco Zulian personally checks zaditalialibera@zulianarchitetturadigitale.eu and the in-app report queue at least once a day. This is not continuous coverage or a guarantee of a reply or removal within 24 hours. For immediate danger, contact the competent emergency services. For an urgent case, state the danger and content reference; the controller assesses it promptly when received. Appeals receive a reasoned response through available controls or support contact.
Where provided by the GDPR, individuals may request access, rectification, erasure, restriction, portability and objection and may withdraw consent without affecting earlier lawful processing. Contact zaditalialibera@zulianarchitetturadigitale.eu. You may also complain to the Italian data protection authority (Garante per la protezione dei dati personali) or another competent supervisory authority.
9. Adults, security and updates
Registration is restricted to adults and requires an 18+ declaration, not documentary age verification. Report an account belonging to a minor to the operator for assessment and appropriate measures.
HTTPS, password hashes, HttpOnly/Secure session cookies, backend authorization and administrative MFA are implemented controls, not guarantees against compromise. Operational photos and the database are not claimed to be encrypted at rest; encrypted backups were verified. Private-chat confidentiality does not remove the operator's applicable duties: we promise neither indiscriminate monitoring, ability to read every chat nor absolute immunity from liability. The controller handles incidents and valid requests with necessary access only and a record of actions. Applicable duties are not excluded for private content.
Material changes will be communicated through the service or appropriate channels. This notice describes operation and does not promise absolute anonymity or security.