Privacy policy

Last updated: 4 August 2026

This notice describes how personal data of users of www.mandalo.it (the “Service”) is processed under Regulation (EU) 2016/679 (“GDPR”) and applicable Italian law.

1. Data controller

The data controller is FR Italy di Franco Ramonda, VAT 02976040044. Website: www.fr-italy.com. Email: privacy@fr-italy.com.

2. Types of data processed

Depending on use, we may process: account data (email, password hash, name, plan, email verification); Google OAuth data; transfer data (sender, recipients, title, message, file metadata, protection password hash, dates, guest-limit IP); temporarily stored uploaded files; payment/subscription data (PayPal/Pagami references, amounts, status); advertising data if you request a campaign; technical logs and cookies as described below.

3. Purposes and legal basis

Service delivery (upload, download, link email, account): contract performance (GDPR Art. 6(1)(b)). Security, abuse prevention, quotas: legitimate interest and legal obligations. Payments and subscriptions: contract performance. Google login: contract and, where required, consent to Google permissions. Tax compliance: legal obligation. Technical cookies: technical necessity. Future analytics/marketing cookies: consent where required.

4. Nature of provision

Data required to send a transfer or create an account is mandatory to provide the Service. Without it, those features cannot be used. Google Login is optional.

5. Processing and security

Data is processed with appropriate technical and organizational measures: HTTPS transmission; at-rest file encryption (XChaCha20-Poly1305) on non-public storage; passwords stored only as hashes; token links and expiries; secure sessions and security HTTP headers.

The controller is Italian and applies GDPR. Hosting is in the EU. We do not sell file contents for advertising. You remain responsible for credentials, links, and passwords shared with recipients.

6. Retention

Files and transfers: until set expiry, then deleted or unavailable (except Pro recovery if active). Account: for the relationship duration and longer for legal obligations. Technical logs: usually no more than 12 months unless security requires longer.

7. Recipients

Data may be shared with hosting, Aruba (SMTP), Google (OAuth), PayPal, Pagami, and professionals for legal compliance. Transfer recipients receive only what is needed to download (link and, if provided by the sender, password).

8. Transfers outside the EU

Some providers (e.g. Google, PayPal) may process data outside the EEA with GDPR safeguards (SCCs, adequacy decisions).

9. Cookies

We use technical session cookies (PHPSESSID, CSRF, download unlock). Google Analytics 4 for aggregate statistics. Third-party cookies on Google/PayPal during login or checkout. You can manage cookies in your browser; disabling technical cookies may block login and essential features.

10. Data subject rights

You may exercise access, rectification, erasure, restriction, portability, objection, and consent withdrawal by writing to privacy@fr-italy.com. Complaint to the Italian DPA: www.garanteprivacy.it.

11. Minors and changes

The Service is not intended for under-14s. This notice may be updated; the current version is on this page with the update date.