Privacy policy

Who is responsible for your data

The data controller is Matteo Gavin, an Italian sole proprietorship trading as Developpy, VAT number (P.IVA) 05367990289.

Registered office: Via D.M. Turoldo 6, 35020 Sant'Angelo di Piove di Sacco (PD), Italy.

For any privacy question or request, write to hello@developpy.io.

What this policy covers

This is the information notice required by Articles 13 and 14 of the GDPR (EU Regulation 2016/679). It covers developpy.io in every language version. It does not cover the Developpy Partners portal at partners.developpy.io, which has its own privacy policy (opens in a new tab), the websites we link to, or the Shopify stores we build for clients, where the store owner is responsible for its customers' data.

The Checkout Upsell Builder app has its own privacy policy, linked from its Shopify App Store listing.

The Universe waitlist (closed)

Until the Universe theme by Developpy launched on the Shopify Theme Store on November 2, 2026, the site had a waitlist form that asked only for your email address. The form closed at launch, and the site no longer collects addresses.

If you joined the waitlist, we use your address only to send you one email announcing the launch, and then we delete it. Legal basis: the consent you gave when you joined (Article 6(1)(a) GDPR).

You can withdraw your consent at any time by writing to us, and we delete your address straight away. Withdrawing does not affect an email sent before.

Until it is deleted, your address is stored in Cloudflare KV, a key-value store of our hosting provider Cloudflare, which processes it on our behalf. Our server never wrote it to its logs.

Emails and call bookings

When you write to hello@developpy.io, we use your message and the identification and contact details it contains to answer you and, if you ask for it, to prepare a quote. Legal basis: steps taken at your request before a contract, and our legitimate interest in answering business inquiries (Article 6(1)(b) and (f) GDPR). Our email runs on Google Workspace. Giving us your details is up to you, but without them we cannot answer you or prepare and carry out a contract.

The Book a call links open Calendly, a scheduling service. The details you enter there, such as your name, email address and notes, reach us through Calendly, which processes them on our behalf. Calendly's own privacy notice also applies on its site.

We keep business correspondence as long as we need it to handle your request. When a contract follows, we keep the related data for the periods Italian tax and civil law require, up to a maximum of ten years after the relationship ends, and longer only when we need it to establish, exercise or defend a legal claim. Legal basis: compliance with our legal obligations (Article 6(1)(c) GDPR) and our legitimate interest in defending legal claims (Article 6(1)(f) GDPR).

Hosting, security and logs

developpy.io is hosted on Cloudflare. To deliver pages and protect the site from abuse, Cloudflare processes technical data about every request, such as your IP address, the time, the page requested and your browser's user agent. This data is deleted once it has served its purpose, but it may be kept longer when needed to investigate a suspected attack on the site. Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).

Our own code on Cloudflare keeps your IP address in memory only, for a short time, to limit repeated waitlist submissions. It never writes it to storage. More generally, we process personal data by hand and electronically, with organizational, physical and technical measures that keep it secure and confidential.

Visit statistics and ad measurement

We count visits with Cloudflare Web Analytics. It sets no cookies, stores nothing in your browser and does not build a profile of you: it records page views with the page address, the referring site, the browser type and the country, and shows us totals. Legal basis: our legitimate interest in knowing which pages people read (Article 6(1)(f) GDPR).

If you accept statistics cookies, Google Analytics 4 records the pages you visit, how you reached the site, your device, browser, approximate location (derived from an IP address that Google does not store) and clicks on our booking and email links, linked to a random identifier stored in a cookie. Google processes this data on our behalf. We keep event data for two months and user-level data for fourteen months.

If you accept statistics cookies, Microsoft Clarity also records how you use our pages, such as clicks, scrolling and mouse movement, and turns them into heatmaps and session recordings, linked to a random identifier stored in a cookie. Clarity is provided by Microsoft Corporation, whose privacy statement (opens in a new tab) explains how it handles this data.

If you accept marketing cookies, the Meta Pixel sends Meta the pages you visit and the same clicks, with your browser's identifiers, so we can measure our ads on Facebook and Instagram and show them to people who visited the site. For collecting and sending this data, we and Meta Platforms Ireland Limited are joint controllers; Meta then uses it as an independent controller under its own privacy policy, which also explains how to manage the ads you see.

Legal basis for all three: your consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code). Nothing loads until you accept, and you can withdraw at any time with Cookie settings in the footer, without affecting what happened before.

Cookies

Besides two technical cookies of our own (language and cookie choice), Google Analytics, Microsoft Clarity and the Meta Pixel set cookies only with your consent. The cookie policy lists them.

Fonts and other sites

Our fonts are served from developpy.io itself, so your browser does not contact Google Fonts or any other font service. Pages load no third-party script other than the statistics and, with your consent, Google Analytics, Microsoft Clarity and the Meta Pixel described above, and no social media plugins.

Links to other sites, such as the Shopify App Store, the Shopify Partner Directory, LinkedIn, Calendly and the Partners portal, take you to services with their own privacy policies.

Who receives your data

• Cloudflare, Inc.: hosting, security and visit statistics.
• Cloudflare, Inc.: the Universe waitlist, stored in Cloudflare KV.
• Calendly LLC: call bookings.
• Google, through Google Workspace: our email.
• Google Ireland Limited: Google Analytics, with your consent.
• Microsoft Corporation: Microsoft Clarity, with your consent.
• Meta Platforms Ireland Limited: the Meta Pixel, with your consent (see above).

Inside our business, only the people who need your data to handle your request can see it. We may also share it with independent controllers when one of the purposes above requires it. We do not sell your data and do not publish it. Advertising data reaches Meta only if you accept marketing cookies, and we disclose data to public authorities only when the law requires it.

Transfers outside the European Union

These providers are based in the United States or process data there. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

Your rights

Under the GDPR you can ask us at any time to:

• tell you whether we hold data about you, which data and where it came from, and give you a copy;
• correct data that is wrong or incomplete;
• delete your data;
• limit how we use it;
• send it to you or to another provider in a common format;
• stop using it where we rely on our legitimate interest;
• stop using it where we rely on your consent, without affecting what happened before; for cookies, use Cookie settings in the footer.

Write to hello@developpy.io. We answer within one month, as the GDPR requires.

You can also lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali (the Italian data protection authority) (opens in a new tab), or the authority of the country where you live or work.

Automated decisions and children

We make no automated decisions that have legal or similarly significant effects on you. If you accept marketing cookies, Meta may use the Pixel data to decide which of our ads to show you.

The site is meant for businesses and is not directed at children.

Changes to this policy

We update this page when what we collect changes, and change the date at the top.