Privacy Notice

1. Data controller

The controller is Digital Point di Simone Malloggi, Via Ilio Barontini 36, Calcinaia (PI), Italy, VAT No. IT02540040504. Privacy contact: info.nettyra@gmail.com.

No Data Protection Officer (DPO) has been appointed.

2. Data we process

We process only data needed to provide, secure and improve Netyyra.

• Account data: display name, email, language, time zone and technical authentication identifiers.
• Care Circle data: Circle name, members, roles, invitations, tasks, appointments, updates, expenses and preferences.
• Care recipient data: preferred name, stated relationship and care information entered by users.
• Health-related data: for example medication information, recorded dosage, appointments and notes that may reveal health status.
• Billing and subscription data: plan, status, period, checkout references and required tax information; Netyyra does not store full payment card details.
• Technical and security data: logs, IP addresses, device/browser information, security events and anti-abuse data.
• Privacy choices and attestations: cookie choices, care-data consent/authority statement, date, language and accepted text version.

3. Purposes and legal bases

We process account and service data to perform the contract and provide requested features. We process technical and security data based on our legitimate interests in protecting the service, preventing fraud and maintaining reliability, subject to applicable law.

Health data is sensitive/special-category data. When a user creates a Circle for themselves, we request separate explicit consent. When a Circle is for another person, the user must state that they are authorized by that person or otherwise have valid authority to represent them. Where law requires consent from the care recipient or their representative, that consent must be valid under applicable law.

We process data needed for tax, accounting, legal and dispute-management obligations where required. Optional marketing technologies are used only after consent where required.

4. Recipients and service providers

Current key providers include AWS for infrastructure, authentication, databases, storage and processing; Shopify for the Netyyra Plus plan purchase flow; and Resend for service email.

With your marketing and analytics consent, Meta Platforms Ireland Ltd. receives browsing and purchase events for the Netyyra Plus plan (visits to public pages and checkout, add to cart, checkout started, payment and purchase, with product, price and currency). For purchases, Shopify also sends Meta, from its own servers, the email and phone number entered at checkout in hashed form, to measure ad performance. Meta also processes this data as an independent controller under its own privacy policy. Meta never receives Care Circle content, information about the person cared for or health data: the app area does not load Meta technologies.

We may disclose data to authorities or third parties where necessary to comply with law, protect rights or safety, prevent fraud or handle a corporate transaction subject to applicable law.

5. International transfers

Netyyra is operated by a controller established in the European Union. Some providers may process data outside the EEA. Where required, we use recognized safeguards such as adequacy decisions, Standard Contractual Clauses or other valid transfer mechanisms.

6. Retention and deletion

Automatic Aurora backups and application/worker logs are configured with 7-day retention. Mandatory retention for billing records, security and provider technical records remains separate.

We keep data for as long as necessary to provide the service and for additional periods required by legal, accounting, security or rights-protection obligations.

When deletion of a Circle or account is requested, Netyyra uses a 30-day window before removal from active systems. Residual copies in backups, logs or security systems may remain until normal rotation or for the minimum period necessary for legal and security purposes and are not used for ordinary service delivery.

Voice input and temporary files

When you use voice input, audio is sent to AWS when recording ends. Amazon S3 stores temporary files, Amazon Transcribe produces text and Amazon Bedrock processes text and the necessary context to prepare proposals. These contents may include health-related data if you mention it in the recording. Items are created in the Circle only after you confirm.

Netyyra attempts to delete the audio, transcript file and Transcribe job when processing ends, including on error. The temporary result, containing recognised text and proposals, remains available to handle retries. Temporary S3 files have an expiration rule configured after one day: AWS calculates expiration at the following UTC day boundary and removal is asynchronous, so deletion within 24 hours is not guaranteed. If immediate cleanup fails, remaining files are subject to the same rule.

Closing the screen or discarding proposals does not immediately delete temporary copies held on AWS. Confirmed information follows the retention periods for Circle data. Provider processing is subject to the applicable contracts, terms and service settings; S3 file cleanup does not mean that every technical record or copy potentially processed by the provider has been deleted.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object, port data, withdraw consent and complain to a supervisory authority. Withdrawal does not make prior lawful processing unlawful.

Use available account features or email info.nettyra@gmail.com. We may need to verify identity and, for requests made for someone else, authority to represent that person.

8. Security and incidents

We apply technical and organizational measures proportionate to the nature of the data, including access controls, role separation, authentication, logging and infrastructure protections. No system can guarantee absolute security.

If a personal-data or health-data breach occurs, we will assess it and notify users, regulators or others where and within the time required by applicable law.

9. Minors and legal capacity

Netyyra accounts are for adults or people who have reached the age required to enter a valid contract in their country. An authorized adult may create a Care Circle for a minor or a person unable to consent independently where they have the authority required by applicable law.

10. International users

Netyyra may be offered in multiple countries. GDPR applies because the controller is established in the European Union, and mandatory local privacy rights remain available where applicable.

Residents of jurisdictions with specific consumer-health-data rules should also read the separate Consumer Health Data Privacy Policy. Netyyra does not sell health data or use Care Circle content for behavioral advertising.

11. Changes and contact

We will update this notice when the service, providers or applicable obligations change. Material changes will be notified appropriately where required.

Questions and privacy requests: info.nettyra@gmail.com.