Privacy notice
What this account service stores, why, and how to make us stop.
Who is responsible
Officine Generative is the data controller for the account itself. Contact: [email protected].
Each Officine Generative application is responsible for what it stores about you inside that application. This notice covers the account only.
What we store
- Your email address, and whether it has been confirmed — it is how you sign in and how we reach you about the account.
- A hash of your password, using Argon2id. The password itself is never stored and cannot be recovered from the hash, by us or by anyone who obtains the database.
- Your sessions — one record per browser you are signed in from, so that you can end them, and so that a stolen session can be revoked.
- Short-lived tokens for confirming your address and resetting your password. Each is single use and expires.
We do not use advertising or analytics cookies, and we do not track you across sites. The only cookies set are the ones that keep you signed in.
Why we are allowed to
To provide the account you asked for — performance of a contract — and, for the parts that exist to keep the account from being taken over, our legitimate interest in security.
Who else sees it
When you sign in to an application, it is told a stable identifier for you, and your email address if you agreed to share it. That is the whole handover.
Beyond that: our hosting provider, and the service that delivers confirmation and password-reset emails. We do not sell anything to anyone, and there is nobody else.
How long we keep it
For as long as the account exists. An account whose address is never confirmed is deleted after 30 days. Sessions expire on their own, and end immediately when you sign out.
What you can ask for
A copy of your data, a correction, or deletion of the account. Write to [email protected] and we will act within 30 days. If you are in the EU or the UK you may also complain to your national data protection authority.
See also the about page and the terms of use.