Privacy notice

Who is responsible

Fabrizio Ferrante, operating under the Phabdev name, Italy. Contact: fabrizio.ferrante@phabdev.it. Professional address: Via Broni 1, 10126 Torino (TO), Italia. VAT ID: IT14076150961.

This notice concerns starter.phabdev.com and its source delivery, not applications that you build or run from the downloaded source. Last updated: 23 September 2026. You can contact the controller in Italian or English.

What we process and why

• Site and download delivery: IP address, request time, requested URL (including any campaign parameters), HTTP status and browser/request information can be processed by the hosting and security infrastructure. Purpose: deliver the requested pages/files, diagnose faults and prevent abuse. Legal basis: legitimate interests in a functioning, secure website (GDPR Article 6(1)(f)); this is not permission for behavioural advertising.
• Contact you initiate: your email address, name if supplied and message contents, processed to answer your request. Basis: steps at your request before a contract, where applicable (Article 6(1)(b)), or legitimate interest in answering other correspondence (Article 6(1)(f)). Providing these details is voluntary; without a reply address we cannot respond. Do not send passwords or sensitive personal data.
• Download confirmation: a sessionStorage receipt records an action identifier, timestamp and download state to show the requested confirmation page. It is not a user account or proof of payment. See the storage notice.
• Campaign links and Google Ads measurement: incoming campaign parameters may accompany internal navigation. After optional measurement consent, the Google tag can associate a confirmed Lite email request or server-verified Pro purchase with an advertising visit. PHABDEV sends Google an event identifier and, for a purchase, the verified amount and currency; it does not send the form email or buyer name. Purpose: measure campaign performance. Basis: consent (Article 6(1)(a)).

Optional audience measurement: only after you choose Allow analytics, Vercel Web Analytics and PHABDEV's first-party Cloudflare endpoint measure permitted page visits and product actions. The first-party record contains a random session identifier, event, page, coarse source/campaign and optional product-research choice. It excludes email, name, IP address, advertising click identifiers and arbitrary URL parameters. Basis: your consent (Article 6(1)(a)). Refusing analytics leaves the site, forms, checkout and download usable. Use Analytics preferences in the footer to withdraw consent and stop subsequent measurements.

There is no application-account registration, Google Analytics, PostHog, remarketing audience or enhanced-conversion upload on this landing. Google Ads conversion measurement loads only after consent. Optional email requests and subscriptions are described below. We do not receive the projects, users, passwords or database contents of a starter application you run yourself. We do not sell visitor data or use it for automated decisions producing legal or similarly significant effects.

Recipients and international processing

Vercel supplies website hosting and delivery. Google supplies consent-gated advertising conversion measurement. Cloudflare supplies DNS, Worker processing, D1 storage and file storage/delivery. They process technical request data for these services; their roles also include their own security and service administration where described in their notices. Email you send to fabrizio.ferrante@phabdev.it is handled by the mail service of Aruba S.p.A. and the controller. The source repository is private; downloading Lite does not require a GitHub account.

These providers operate internationally, including outside the European Economic Area. An R2 storage location in Western Europe does not mean all request handling, support or subprocessors remain in the EEA. Applicable safeguards may include adequacy decisions and standard contractual clauses. Provider details and transfer terms: Vercel DPA, Vercel privacy notice, Cloudflare DPA, Cloudflare privacy policy, Google privacy policy. Contact the controller for information about applicable safeguards. A link to a provider's terms is not a claim of EU-only processing.

Retention

The browser receipt is valid for ten minutes and kept in sessionStorage until the tab's session ends or you clear site data; browser session restoration can prolong storage. Optional attribution has a thirty-minute validity check. Consented first-party funnel events are kept in Cloudflare D1 for up to 90 days and then deleted by scheduled retention.

Infrastructure logs follow the applicable provider service settings and security retention rules; retention can vary by log type, subscription and incident/legal requirements. Technical records are retained for service delivery, fault diagnosis and security investigation, and for longer only where required for legal obligations or a specific dispute. Contact correspondence is kept while needed to resolve the request and follow-up; material needed for a legal obligation or dispute may be retained for that specific purpose. Contact us for details about a particular record and the applicable provider retention.

Your rights

Subject to the applicable conditions, you may request access and a copy, correction, erasure, restriction, and portability; object to processing based on legitimate interests; and withdraw any consent without affecting earlier lawful processing. Write to fabrizio.ferrante@phabdev.it, identifying the request and relevant interaction. We may request only the information reasonably needed to verify identity. We normally respond within one month; if a lawful extension is needed we explain it within that month. Requests are normally free.

You may complain to the Italian Garante per la protezione dei dati personali or the competent supervisory authority where you live, work or believe an infringement occurred. Contacting us first is not a condition for complaining.

Changes

This notice will be updated before new collection purposes or providers are introduced. Consent will be requested where required. Downloading Lite or reading this notice is not consent to marketing.

Optional email delivery and PHABDEV updates

Requesting Lite by email does not subscribe you to marketing. We use the supplied address to fulfil your request (GDPR Article 6(1)(b)). Resend processes delivery; its operational logs follow the provider's retention. We do not retain a file-only recipient in our contacts database. An email address is required for this delivery flow; marketing consent is not required.

The separate, unchecked updates option covers PHABDEV guides, news and offers about starter kits and developer tools, based on consent (Article 6(1)(a)). A subscription starts only after confirmation through the email link. Cloudflare D1 holds your address, consent wording/version and request/confirmation dates. Unconfirmed requests expire after 48 hours and scheduled cleanup removes them. Confirmed subscriptions expire after two years unless renewed. Marketing messages include an unsubscribe link. Withdrawal does not affect previous lawful processing or access to Lite. On withdrawal we remove the readable address and retain a keyed suppression identifier and preference dates for up to two years.

Cloudflare and Resend process this information to operate the service, with possible processing outside the EEA subject to applicable contractual safeguards. This flow uses no email-open pixels, tracked email clicks, purchased lists or automated profiling. Contact fabrizio.ferrante@phabdev.it for privacy requests. Email delivery is not an order, payment or reservation.

Pro orders and delivery

The checkout form temporarily records the name you provide on the pending order; Paddle separately collects the buyer email and payment/billing details as merchant of record under its privacy notice. After verified payment, PHABDEV stores that name and the buyer email together with the Paddle customer ID, transaction ID, internal order ID, purchase state and dates in Cloudflare D1. We use this purchase record for delivery, purchase support, refund/access handling and proof of the commercial licence. Access-code hashes and payment/access dates are also stored; private files are held in R2. Resend sends the branded delivery email with a private code and purchase terms. Basis: contract performance and legal obligations where applicable. Unpaid orders, including their names and any unconfirmed marketing preference, expire after 7 days; operational event/delivery records after 30 days; paid/revoked order and buyer-contact records after two years. Provider logs, billing and necessary accounting records have separate retention.

An optional, unticked checkbox at checkout lets you separately request PHABDEV guides, updates and offers. The order records the consent wording, version and time. After verified payment, the delivery email asks you to confirm within 48 hours; marketing starts only after that confirmation. Refusing or withdrawing marketing consent does not affect the purchase, delivery or support. Confirmed marketing contacts and consent evidence follow the mailing retention described above, and every marketing message must provide an unsubscribe method. With optional measurement consent, a coarse acquisition source is retained for up to 90 days; no recipient email is sent to analytics. Cloudflare, Paddle and Resend may process data outside the EEA under applicable contractual safeguards. See https://www.paddle.com/legal/privacy and https://resend.com/legal/privacy-policy.