Privacy Policy
How we handle personal data on goglab.it, in the GOG Lab account and in every GOG Lab app.
This notice explains which personal data we process, why, for how long, and what your rights are. It covers the goglab.it website, the GOG Lab account and every GOG Lab app.
It has two parts. The general part (sections 1–13) always applies. The app part (sections 14–17) explains what each app does on top of that: read the one you use.
1. Who the data controller is
The data controller is GOG Lab — [to be completed: legal form, registered office, VAT number].
For any question about your data, or to exercise your rights, write to [email protected].
2. The goglab.it website
You can browse the site without registering and without giving us any data.
- Contact form. If you write to us we collect your name, email, phone number (if you give it), topic and message. We use them to reply and to handle any relationship that follows. Legal basis: your request and pre-contractual steps (Art. 6(1)(b) GDPR). We also send you a copy of your message.
- Technical data. Like any website, our servers log IP address, date and time, requested page and browser type. We use them for security and to track down faults. Legal basis: our legitimate interest in protecting the site (Art. 6(1)(f) GDPR). These logs are deleted automatically on a rolling basis.
- Cookies. Visitors receive no cookies. We only keep a few technical preferences in your browser’s storage. The details, measured on the live site, are in the cookie policy.
We send no newsletters and do not use contact form details for any other purpose.
3. The GOG Lab account
One GOG Lab account signs you in to all our apps and to the Account area of this site. You can sign in with email and password or with Google. Our iPhone apps also offer Sign in with Apple.
| Data | Why | Legal basis |
|---|---|---|
| Email, the name you choose, language | Creating the account, recognising you, sending service messages (email confirmation, password reset, account notices) | Contract (Art. 6(1)(b)) |
| Password | Signing you in. We never store it: we keep only a one-way fingerprint computed with purpose-built algorithms (scrypt, argon2id) | Contract (Art. 6(1)(b)) |
| Profile photo | Showing it in the apps. Only if you upload one or it comes from your Google account | Contract (Art. 6(1)(b)) |
| From Google or Apple: identifier, email and name | Signing you in without a password. We never receive your Google or Apple password and never post anything in your name | Contract (Art. 6(1)(b)) |
| IP address, device and browser type, date and time of sign-ins, failed attempts | Protecting the account from access that is not yours and from rapid-fire guessing | Legitimate interest in security (Art. 6(1)(f)) |
| Apps you use and version of the terms you accepted | Knowing which apps you have opened and being able to show what you agreed to | Contract and the duty to demonstrate compliance (Art. 6(1)(b) and (c)) |
When you sign in on the website, the connection to our server is made by the website itself: your session sits in a technical cookie that the browser does not let page scripts read. Google’s sign-in service loads only after you press the button.
Promotional messages: we send them only if you give specific consent, which you can withdraw at any time (Art. 6(1)(a)). Without it you receive service messages only.
4. Advertising in the apps
Some free apps show ads through Google AdMob. In Europe, Google’s consent message appears the first time you open the app: there you decide whether the phone’s advertising identifier and personalised ads may be used. On iPhone the app may also ask for Apple’s tracking permission: you can say no and the app works just the same.
- Legal basis: your consent (Art. 6(1)(a)), which you can change at any time. If you do not consent, Google may show only non-personalised or limited ads, under its own rules.
- Google processes this data as an independent controller: how Google uses data from partner apps.
- You can reset or delete the advertising identifier in your phone’s settings.
- If you buy ad removal, ads no longer appear.
We do not sell your data and do not use it to profile you.
5. Purchases
In-app purchases go through Google Play or the App Store. Payment and card details are handled by Google and Apple: we only receive the purchase code and the product bought, verify them with the store and unlock the feature on your account. Legal basis: contract (Art. 6(1)(b)) and tax obligations (Art. 6(1)(c)).
Payments that businesses collect through GogDesk use Stripe: see section 17.
6. Notifications and email
- Notifications. The apps send notifications only if you allow them on your phone. For those sent from our servers we use Google’s (Firebase Cloud Messaging) and Apple’s (Apple Push Notification service) services: we store the device’s notification token, its name, language and time zone, and delete them with the account.
- Email. Emails are sent from our own mail server, not by outside services.
7. Where the data is kept and who sees it
Account and app data is kept on our own servers in Italy. We do not sell it and do not hand it to anyone for marketing. Only we see it, when needed to run the service for you or to answer you.
We use the following providers. Some work on our behalf (processors). Others, such as Google and Apple for sign-in, app stores and advertising, process data as independent controllers under their own notices.
| Provider | What for | When |
|---|---|---|
| Cloudflare | Network that carries traffic to the website and our servers and shields them from attacks. It sees the IP address and technical request data | Always |
| Sign in with Google, AdMob ads and consent message, Google Play (downloads and purchases), Google Maps, notifications, YouTube video | Only if you use that feature | |
| Apple | Sign in with Apple, App Store (purchases), iPhone notifications | Only on iPhone and iPad |
| Stripe | Payments that businesses collect from their customers with GogDesk | GogDesk only, if the business turns it on |
| Channex | Connection to booking portals for accommodation businesses | GogDesk only, if the business turns it on |
Where an app has artificial intelligence features, the model runs on our own servers: your text is not sent to outside AI services.
8. Transfers outside the European Union
Cloudflare, Google, Apple and Stripe are groups based in the United States and may process some data outside the European Union. Transfers take place with the safeguards required by the GDPR: the European Commission’s adequacy decision on the EU-US Data Privacy Framework for companies that have joined it, or the standard contractual clauses approved by the Commission. You can ask us for more information at [email protected].
9. How long we keep data
- Account and app data: as long as the account exists. When you ask for deletion we remove it on the timeline explained on the Account deletion page.
- Account security logs (sign-ins, failed attempts): as long as the account exists. When you delete it, the entries that must remain as a record of what happened are anonymised.
- Purchases: the data needed for accounting is kept for the period required by law (usually 10 years), no longer linked to you.
- Contact form messages: for as long as needed to handle the request; if a working relationship follows, for its duration and then for the legal retention periods.
- Backups: we take hourly and nightly copies so that nothing is lost if hardware fails. Backups overwrite themselves: deleted data also disappears from them within six months at most. Until then it is not used.
10. How we protect data
Traffic always encrypted (HTTPS), passwords kept only as a one-way fingerprint, services isolated from each other, restricted access, automatic checks that alert us to unusual activity, and backups on separate disks. The details are on the Security and data page.
11. Your rights
You can at any time ask to access your data, correct it, erase it, restrict its use, receive it in a machine-readable format (portability), and you can object to processing based on legitimate interest (Articles 15–22 GDPR). If you gave consent, you can withdraw it at any time without affecting what was done before.
Write to [email protected]: we reply within one month. Instructions for deleting the account or individual data are on the Account deletion and Data deletion pages.
If you believe we are handling your data improperly, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority of the EU country where you live.
12. Children
Our services are designed for adults and working people: professional exam preparation, land, auctions, business management. They are not aimed at children under 14, the age Italian law sets for online services. If we find that an account belongs to a child under 14, we delete it.
13. Changes to this notice
When something changes (a new app, a new provider, a new kind of data) we update this page and the date at the bottom. If the change is significant we also let you know in the app or by email.
14. App: Pronto Esame
Pronto Esame (Android com.goglab.esami, and iPhone) prepares you for professional exams with quizzes, mock exams and statistics. Status: coming soon to the stores.
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Quiz results, statistics, favourites | Saving your progress to your account so you find it again on another phone | Contract (Art. 6(1)(b)) | As long as the account exists or until you reset your statistics |
| Answers you type or dictate for the business plan, and the documents produced | Creating the business plan you ask for and letting you download it as Word and PDF. The text is processed by an AI model running on our own servers | Contract (Art. 6(1)(b)) | As long as the account exists or until you ask us to delete them |
| Purchase code (business plan unlock, ad removal) | Verifying the purchase with the store and unlocking the feature | Contract and tax obligations (Art. 6(1)(b) and (c)) | See section 9 |
| Advertising identifier and technical phone data | Showing ads (Google AdMob) | Consent (Art. 6(1)(a)) | Under Google’s rules |
- Without an account you can still use the quizzes: the data stays on your phone and never reaches us.
- Dictation. If you dictate, speech recognition is done by your phone’s voice service (Google on Android, Apple on iPhone) under its own rules. The app only receives the text.
- Study reminders. These notifications are prepared by the phone itself, not by our servers, and appear only if you allow them.
- Profile photo. If you pick one from your gallery, the app reads only the photo you chose.
- The app does not use your location, contacts, microphone (except while you dictate) or other files on your phone.
15. App: GogTerre
GogTerre keeps your land in order: land registry parcels on the map, owners, groups of parcels, neighbouring parcels, photos, documents and deadlines. Status: coming soon. A GOG Lab account is required.
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Parcels, groups, notes, settings | Keeping your land records and calculating areas and perimeters | Contract (Art. 6(1)(b)) | Until you delete them or the account |
| Owners you enter (name, tax code or VAT number, notes) | Linking parcels to their owners | Contract (Art. 6(1)(b)) | Until you delete them or the account |
| Photos and documents you upload | Attaching them to parcels. Up to 25 MB per file and 500 MB per account | Contract (Art. 6(1)(b)) | Until you delete them or the account |
| Deadlines | Sending you reminders on the dates you choose | Contract (Art. 6(1)(b)) | Until you delete them or the account |
| Phone location | Showing where you are on the map and, if you ask, finding the parcel at that spot | Contract (Art. 6(1)(b)), only with your permission | Not stored |
- Land registry. Parcel boundaries and data come from the public service of the Italian Revenue Agency (Agenzia delle Entrate, CC BY 4.0 licence). They do not include owners’ names.
- Maps. The map is Google Maps: Google receives the technical data needed to display it (IP address, area viewed).
- Photos. Photos are saved as you upload them, including the information your phone adds (for example where the picture was taken, if you have that turned on). The camera is used only when you take a photo to attach.
- Other people’s data. If you enter data about other people (such as owners), make sure you are entitled to do so. We keep it only for you, do not use it for anything else and show it to no one.
- Ads and purchases work as explained in sections 4 and 5.
16. App: GogAste
GogAste brings public auctions of property and goods together in one place, with filters, a map and a card for every lot. Status: coming soon. A GOG Lab account is required.
- Location. If you search “near me” and grant permission, the app sends our server the point where you are, to find auctions within the radius you choose. The point is used only for that search and is not stored.
- Google Maps, ads and purchases as explained above (sections 4, 5 and 15).
- Auction documents. Notices, valuations and other papers are downloaded from the public portal through our server, which does not keep them.
Data in auction listings. Lot information comes from public sources: the Italian Ministry of Justice’s public sales portal (Portale delle vendite pubbliche), the State Property Agency (Agenzia del Demanio), the national agency for seized and confiscated assets (ANBSC) and municipal notice boards (albi pretori). An automatic filter discards data about the people involved, such as debtors, owners and tax codes. Only the professional contact details that the sources publish for the sale remain (custodian, delegated professional, receiver, notary), so that interested buyers can reach them.
- Legal basis: our legitimate interest in making information that is already public easier to consult (Art. 6(1)(f)).
- We keep it for as long as the source publishes it.
- If you are one of these professionals you can object or ask for a correction at [email protected].
17. Service: GogDesk
GogDesk is our business management suite: diary and bookings, online shop, accommodation, table ordering, document archive, document signing, cameras, stock and more. Status: coming soon.
Two different roles.
- For the account of people who work in GogDesk (the owner and colleagues invited by email), the subscription and the free trial, we are the controller, as explained in the general part.
- For the data a business enters or collects with GogDesk (its customers, appointments, orders, bookings, documents, signatures, camera images) the controller is the business. We process it only on its behalf and on its instructions, as a processor (Art. 28 GDPR), under the agreement we sign with it. If you are a customer of a business that uses GogDesk, contact that business first about your data.
How we handle this data on behalf of businesses:
- Payments: if the business turns them on, the payment page is Stripe‘s. Card details go straight to Stripe and never pass through our servers.
- Accommodation: bookings from portals arrive through Channex, if the business connects it.
- Document archive: files are encrypted with a separate key for each business. Deleted files stay in the bin for 30 days.
- Document signing: we store the signature image, its path (coordinates only, not speed or pressure), the signer’s name, the device and the time; the location only if the signer allows it. Signatures stay with the signed document because they serve as evidence.
- Cameras: video travels encrypted straight from the business’s own system to the phone and never passes through or stays on our servers. We only record who watched which camera and when. Viewing is enabled only after the business confirms it has put up signs and complied with the rules on remote monitoring of employees.
- Business websites: visits are counted without cookies and without storing IP addresses.