Privacy notice

Version of 2026-11-01

Who processes your data

The data controller is Gabriele Serpi (GSFLASH PRODUCTION), P.IVA 18239851001, PEC gabriele.serpi@pec.fiscozen.it. For any privacy request write to gabriele@gabrieleserpi.com.

What data we process

Your email and, if you provide them, name and organisation. Billing data (name, address, tax or VAT number) when you buy. Usage data of the services TallyFlow, UTCflow, Sottotitoli Live, PTZFlow: rooms, settings, consumption (for example hours of automatic captions), technical logs. The content you enter in the services, for example caption texts and transcripts in the archive. A non-reversible fingerprint (hash) of your IP address and device, used only for security and to prevent abuse of free trials. Card and Alipay payments are handled by Stripe: we never see or store card data.

Why and on what basis

To provide the services you asked for and manage your account (performance of a contract). To issue invoices and meet tax obligations (legal obligation). To protect the services from abuse, fraud and unauthorised access (legitimate interest). To send you news about the products, only if you consented or you are already a customer of similar products, and you can opt out at any time (consent or legitimate interest). Essential service messages (security, expiry dates, changes to the terms) are always sent.

How long

Account data: while the account is active and up to 24 months after last use. Invoices and tax data: 10 years, as required by Italian law. Transcripts in the captions archive: 6 months after the last change, with an email notice before deletion. Technical logs: up to 12 months. Consent records: for the whole relationship and as long as needed to prove them.

Who receives them

Only providers we need to run the services, acting on our behalf: the server provider (in the European Union); Stripe (payments); Deepgram, only if you use automatic captions: it receives the audio to transcribe; Microsoft, for the mailbox we reply from; Fiscozen, for invoicing. Some providers are based in the United States: transfers rely on GDPR safeguards (EU-US adequacy decision or standard contractual clauses). We do not sell your data or use it for advertising.

When the data belongs to your users

If you use the services to process other people's data (for example speakers' names in minutes, crew members, players of a tournament), you or your organisation are the controller of that data and we process it only on your behalf as processor (art. 28 GDPR), under the terms of use. You must inform those people.

Cookies

We only use technical cookies needed to run the service: the login session and the chosen language. No profiling, no advertising, no third-party analytics.

Your rights

You can ask at any time to access, correct, delete, restrict or receive your data in a readable format (portability), or object to processing, by writing to gabriele@gabrieleserpi.com. You can withdraw consent to news from the link at the bottom of every email or from your account. You can lodge a complaint with the Italian data protection authority (www.garanteprivacy.it) or the authority of your country.

Children

The services are meant for professionals and organisations, not for children under 14.