Data and privacy
Privacy policy
What data Scelto handles, where it sits and who can see it.
The full policy is being drafted by a lawyer and will be published on this page. What you read below is a summary of how the system actually works, written to be understood: it is not the official document yet and does not take its place.
Who the data controller is
The Scelto service is provided by IDEA RICAMO S.R.L., Strada del Francese 117/11, 10156 Torino (TO), Italy — VAT and tax code no. 09241460014, Turin Business Register no. TO-1035892. It is the data controller for the data collected through this website and for the data of the companies that subscribe.
For anything concerning data, write to info@scelto.app.
Who handles which data
Two different things, worth keeping apart.
- The subscribing company's own data — who signs up, with which email address, VAT number, address, billing, sign-ins — we collect that ourselves, in order to sell the service and invoice it.
- The data the company puts in — its customers, their contacts, email addresses, photographs of business cards, signatures on deliveries — belongs to the company. We hold it and process it on its behalf and on its instructions, as a data processor.
Photographs of items are not personal data: they are pictures of products.
Where the data sits
- Database, sign-ins and server functions: Supabase, in Ireland.
- Photo storage, page proxy and DNS: Cloudflare (storage in the European Union).
- Sending email: Resend, in Ireland.
- Phone notifications: Expo, Apple and Google. Notifications carry numbers only, never a customer's name.
- Automatic reading of business cards: Anthropic, in the United States.
Having the artificial intelligence read business cards is the only point at which personal data leaves the European Union. It can be switched off company by company: where it is off, the sales reps fill the fields in by hand and no photograph leaves Europe.
Once online payment is switched on it will be handled by Stripe (Ireland): card details do not pass through us and we never see them.
Who can see what
Each company sees its own data and nothing else, and that separation is enforced by the database, not only by the app. Inside a company: the administrator sees the whole history, a sales rep sees his own selections and deliveries, an assistant sees only the QR codes and the item photos.
On our side, only the technical administrator can reach the production database.
How we protect it
- Traffic between the app, the web pages and the server is always encrypted.
- Passwords are held by the authentication service in a non-reversible form: we never see them and cannot recover them, only reset them.
- Photos live in private storage: they can only be reached through signed addresses that expire.
- The customer's photo page is protected by an address that cannot be guessed.
- Deletions are reserved to the company's administrator.
How long we keep it
Data stays as long as the company keeps it: today there is no automatic deletion. If a company closes its subscription and asks for its data to be erased, we erase it, photographs and signatures included. Retention periods will be set out in the final policy.
This website
The public pages of scelto.app use no cookies, have no analytics and load no third-party scripts. That is why there is no banner to accept. If we ever added an analytics service we would say so here and ask for consent.
Your rights
You can ask to see your data, to correct it, to have it deleted, or to receive a copy to take elsewhere. If you are the customer of a company that uses Scelto, the request goes to that company, which is the data controller: if it reaches us, we pass it on and help them answer.
For any question about data, write to info@scelto.app.
Page updated October 2026.