Privacy policy

Last updated: October 2, 2026

This policy explains how Keepsy Studio handles your personal data when you visit the store keepsy.studio, buy from it, or use the app app.keepsy.studio. It is written under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and also covers the rights of customers outside the European Union.

1. Who is responsible for your data

The controller is Digital Bloom Studio, sole proprietorship of Marcello Marinelli, Via Paradiso 8/a, 61048 Sant'Angelo in Vado (PU), Italy, VAT IT02857850412, REA PS-309125, email hello@keepsy.studio, certified email marcello.marinelli@pec.fiscozen.it. Keepsy Studio is a brand of Digital Bloom Studio.

2. What data, why, and on what legal basis

Order and payment (name, email, billing address, country, amount, order number): to conclude and perform the contract (Art. 6(1)(b) GDPR) and to meet tax and accounting obligations (Art. 6(1)(c)). Card details are handled only by the payment provider; we never see or store them.
Key delivery: we use your email only to send you your license key and the user guide (Art. 6(1)(b)). Your email is not saved in our license register.
License register: for each purchase we keep only the key, the Shopify order number, the date, the plan and up to 5 random codes for the devices where you opened the app. No name, email, address or IP. This makes your license work and stops it from being shared publicly (Art. 6(1)(b) and 6(1)(f), our legitimate interest in protecting the service).
Security: to block abuse, your IP address is used as a temporary attempt counter and deleted automatically after 2 minutes; it is never logged or linked to your license (Art. 6(1)(f)). The store platform also uses device and connection data to prevent fraud and keep checkout secure (Art. 6(1)(f)).
Your photos and text: they are processed only in your browser and are never uploaded to our servers. In your browser the app stores only your key, the device code, your language and a few choices from your last cone.
Browsing the store (pages viewed, device, browser, approximate location from your IP, how you reached us): essential data to run the store and the cart (Art. 6(1)(b) and 6(1)(f)); analytics and advertising data only with your consent (Art. 6(1)(a)).
Support: if you write to us, we use the data in your message to reply (Art. 6(1)(b) or 6(1)(f)).
Reviews: if you leave a review, we publish the name you give and your text, with your consent (Art. 6(1)(a)).
Email marketing: only if you sign up, and you can unsubscribe with one click in any email (Art. 6(1)(a)).

Providing your order data is necessary to buy; without it we cannot deliver your key. We make no decisions based solely on automated processing that produce legal effects for you.

3. Cookies

Essential cookies keep the cart and checkout working. Analytics and marketing cookies (Shopify Analytics, Meta and, when active, Google) are used only if you accept them in the banner, and you can change your choice at any time with the "Cookie settings" link at the bottom of every page. Details are in the Cookie Policy.

4. Who we share it with

We do not sell your personal data. We share it only with the providers we need to run the service, appointed as processors or acting as independent controllers for their own services:

Shopify: store platform, checkout and payments (see Shopify's privacy policy);
Cloudflare: hosting of the app and the license server;
Twilio SendGrid: sending the email with your key;
Judge.me: collecting and publishing reviews, when active;
Meta Platforms and, when active, Google: measurement and advertising, only with your consent;
our accountant, for tax obligations;
public authorities, only when the law requires it.

5. International transfers

Some of these providers are based in the United States or other countries outside the European Economic Area. Transfers rely on the EU-US adequacy decision (Data Privacy Framework) for certified companies or on the European Commission's standard contractual clauses.

6. How long we keep it

order data and tax records: 10 years, as required by Italian law;
license register: as long as the service runs, so your key keeps working; then it is deleted;
IP-based abuse counter: 2 minutes;
support emails: up to 24 months after our last contact;
email marketing: until you unsubscribe;
cookie data: for the periods stated in the Cookie Policy.

7. Security

We use providers with recognised security standards, encrypted connections (HTTPS) and access limited to what each task needs. No system is completely secure, so please keep your license key private and tell us at once if you think it has been exposed.

8. Your rights

You may ask us at any time for access, rectification, erasure, restriction or portability of your data, and object to processing based on legitimate interest or for direct marketing; you may withdraw consent without affecting processing already carried out. Write to hello@keepsy.studio: we reply within 30 days and may ask you to confirm your identity. You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali) or the authority of the country where you live.

Residents of the United States (including California, Colorado, Connecticut, Virginia and other states with privacy laws): you have the right to know what personal data we hold about you, to access it, correct it and delete it, and to opt out of targeted advertising. We do not sell personal data. Where our advertising cookies may count as "sharing" under your state's law, you can opt out by rejecting marketing cookies in the banner or with "Cookie settings"; we also honor the Global Privacy Control signal. We will not treat you differently for exercising these rights. To make a request, email hello@keepsy.studio; an authorized agent may act on your behalf with proof of authorization.

9. Children

The store is meant for adults. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, write to us and we will delete it.