Privacy Policy

1. Data Controller

The Data Controller is Nicola Giancecchi, COE SM31734, based at Via Guardia del Consiglio 15, 47899 Serravalle (RSM). Any request or information regarding the processing of personal data can be sent by email to info@pop.sm or by certified mail (PEC) to pop@pec.sm.

2. Representative in the European Union

Pursuant to Articles 3 and 27 of Regulation (EU) 2016/679, the Controller has appointed as its Representative in the European Union: 365TRUST Europe S.r.l., Piazza IV Novembre 4, 20124 Milan (MI); email: representative.eu@365trust.me; PEC: representative.eu@pec.365trust.me; tel. (+39) 02 303124495.

3. Type and origin of data processed

Rollino does not require creating an account and does not collect personal identification data (name, address, contact details) to operate. Data is collected directly through use of the app and the technical services it relies on, and includes:

• Photos and videos taken with the app: these stay exclusively in the device's local storage (and, if the user enables iCloud, in their personal iCloud space), and are never transmitted to the Controller's servers.
• Device identifiers and usage diagnostic data (in-app events, crash logs), collected in aggregate form via Firebase Analytics and Crashlytics.
• Data related to in-app purchases and subscriptions, managed by Apple through the App Store and technically processed by RevenueCat; the Controller does not receive or store payment data.
• Opaque Screen Time tokens: by design of Apple's FamilyControls/ManagedSettings frameworks, the app never knows which applications the user has chosen to block, but only receives non-identifying tokens.

4. Purposes and legal basis of processing

The data collected is processed for the following purposes:

• delivering the app's features (creating rolls, blocking apps, developing and notifying photos). Legal basis: performance of pre-contractual/contractual measures with the user;
• technical management of single purchases and in-app subscriptions. Legal basis: performance of pre-contractual/contractual measures;
• identifying and fixing crashes and malfunctions, improving stability and user experience. Legal basis: the Controller's legitimate interest in the correct functioning of the service;
• compliance with any applicable legal obligations. Legal basis: compliance with legal obligations the Controller is subject to.

Rollino does not use the IDFA or any cross-app advertising tracking: App Tracking Transparency permission is therefore not requested, because it is not used.

5. Processing methods

Data processing is carried out in compliance with the principles of lawfulness, fairness, transparency, minimization, and security, using IT and telematic tools, and adopting technical and organizational measures adequate to guarantee the confidentiality, integrity, and availability of information, pursuant to GDPR.

6. Disclosure of data to third parties

Data may be disclosed, exclusively for the purposes indicated above and to the extent strictly necessary, to the following parties:

• Apple Inc.: App Store, iCloud, Screen Time (FamilyControls); Apple acts as an independent controller for its own platform services;
• Google Ireland Ltd. (Firebase): Analytics and Crashlytics, acting as a data processor;
• RevenueCat, Inc.: technical management of in-app purchases and subscriptions, acting as a data processor.

None of these parties receive your photos or videos: your content stays on your device or in your personal iCloud space.

7. International data transfer

Diagnostic and purchase-related data processed through Firebase and RevenueCat may be processed on infrastructure located in the United States. Such transfer takes place in compliance with GDPR, on the basis of the Standard Contractual Clauses approved by the European Commission or other equivalent safeguards adopted by the respective providers. The Controller can provide further information on request.

8. Data retention periods

Photos and videos remain on the user's device until manually deleted or the app is uninstalled: the Controller keeps no copy. Diagnostic data collected via Firebase is retained according to Google's retention policies, typically no more than 14 months. Data related to purchases and subscriptions is retained by Apple and RevenueCat according to their respective policies, for the time necessary for contract management and any applicable tax obligations.

9. Automated decision-making

The Controller does not employ automated decision-making processes, including profiling, pursuant to Article 22 of GDPR.

10. App permissions

• Camera and microphone: to take photos and videos within the app.
• Notifications: to alert you when a roll is ready and has been developed.
• Photo library (add-only): to export, only at your request, developed shots to the system photo library.
• Screen Time: to block selected apps while a roll is in progress.

Each permission is optional wherever technically possible and can be revoked at any time from iOS Settings.

11. Your rights

As a data subject, you have the right to exercise the rights set out in Articles 15 et seq. of GDPR against the Controller: access to personal data, rectification, erasure, restriction of processing, objection, and the right to lodge a complaint with the competent Data Protection Authority. These rights can be exercised by sending a written request to the contacts indicated in section 1, or by writing to hello@rollino.camera. Since photos and videos remain on the device, deleting them or uninstalling the app also removes this content, except for anything the user has exported or saved to iCloud.

12. Contact

For questions about this notice or about data processing, write to hello@rollino.camera or contact the Controller using the details in section 1.