Data controller
The controller of your personal data is currently Luca Paratore, a natural person and founder of the Sciame project (hereinafter also "Sciame", "we").
- Email: info@sciame.cloud · paratoreluca0@gmail.com
- Phone: +39 328 203 5047
- Operating address: c/o Incubatore d'Impresa POINT — Polo per l'Innovazione Tecnologica, via Pasubio 5 (corner of via Einstein), 24044 Dalmine (BG), Italy
At the commercial launch, the data controller will become the company that will be incorporated to operate Sciame. Data subjects will be informed with a prominent notice on the website and by email (for those who have provided a contact).
What data we collect today
We collect the data strictly necessary to present the project on the sciame.cloud website, manage the expressions of interest from the forms, and run the Sciame app.
sciame.cloud website
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email (newsletter form) | Informing you when we launch in your city and about project news | Consent (Art. 6.1.a GDPR) | Until withdrawal or commercial launch + 12 months |
| Name, city, phone, email (/tassisti form) | Contacting you back to discuss a possible collaboration as a partner taxi driver at launch | Pre-contractual measures (Art. 6.1.b) + consent | Max 24 months if not concluded |
| Name, organization, role, email, event type, city, notes (/eventi form) | Contacting you back to discuss a possible partnership as a Mobility Partner at launch | Pre-contractual measures + consent | Max 24 months if not concluded |
| Browsing data (IP, user agent, technical logs) | Technical security of the website | Legitimate interest (Art. 6.1.f) | Max 12 months |
Important: the "taxi drivers" and "events" forms collect a non-binding expression of interest for both parties. No service is owed and no contract is concluded simply by filling in the form.
Sciame mobile app
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, name, password, date of birth | Creating the Account to access the service | Performance of a contract (Art. 6.1.b) | Until the Account is closed |
| Phone number (if provided) | Anti-fraud verification of the Account | Performance of a contract + legitimate interest | Until the Account is closed |
| Profile photo (if uploaded) | Visual identification between verified sciameres | Performance of a contract + consent | Until Account closure or deletion |
| Device location (precise and approximate, foreground only) | Matching with other nearby sciameres, setting the departure point, calculating distances and price estimates. See the Geolocation section for details. | Consent (Art. 6.1.a GDPR, revocable from the device settings) | Only during active use |
| Chat messages between sciameres | Coordinating the shared ride (meeting point, time) | Performance of a contract | Until Account closure or deletion on request |
| Payment data (Stripe token, last 4 digits, card brand) | Processing payments for the shared ride | Performance of a contract. See the Payments section. | For accounting and tax purposes, 10 years |
| Purchase and subscription history (RevenueCat) | Managing any in-app purchases and subscriptions through the stores | Performance of a contract. See the In-app purchases section. | Until the Account is closed |
| Advertising identifier (AAID/IDFA) | Serving advertisements via Google AdMob. See the Advertising section. | Consent (Art. 6.1.a GDPR), revocable | Until withdrawal / ID reset from the device |
| Diagnostic data and crash reports (Firebase Crashlytics) | Diagnosing errors, improving app stability | Legitimate interest (Art. 6.1.f) | 14 months |
What we do NOT do: we do not sell your personal data to third parties, we do not use it for behavioral profiling outside AdMob's standard advertising systems, and we do not transfer data to non-EU countries without adequate safeguards (see the section Who we share your data with).
Geolocation (location data)
Sciame collects and uses the device's location data (both precise location and approximate location) only while the app is in use (in the foreground). The app does not collect location in the background.
How we access your location
Through the device's location services (GPS, Wi-Fi, and mobile network), subject to your explicit permission: the first time you use the feature you are asked for permission, and you can deny or revoke it at any time from the device settings ("Permissions → Location" section). Revocation does not affect processing that has already taken place based on the permission previously granted.
Why we collect it
- Showing you the stops and shared rides near you on the map.
- Automatically setting the departure point of a ride.
- Calculating distances and price estimates for the ride.
Who it is shared with
Location data is processed to provide you with these features and is handled through our providers acting as data processors — in particular Google Firebase for the app's backend and Google Maps Platform for displaying maps. We do not sell your location data and we do not use it for advertising purposes.
Retention and deletion
Location data is used in real time while you use the app to provide the features described, and is not kept longer than strictly necessary for matching and ride creation. You can request the deletion of your account and all associated data at any time by writing to info@sciame.cloud (see also the section Your rights).
Advertising (Google AdMob)
The Sciame app contains advertisements provided by Google AdMob to support the development of the app in its initial phase.
What data AdMob collects
- Device advertising identifier (AAID on Android, IDFA on iOS)
- IP address and approximate location derived from IP
- Device information (model, operating system, language)
- Interactions with ads (views, clicks)
Personalized ads, consent and opt-out
For users in the European Union, before showing personalized ads AdMob requests your explicit consent via an in-app message (User Messaging Platform). You can:
- Change your personalization preferences at any time from the app settings;
- Reset your advertising ID or turn off personalization from the device settings (Android: Settings → Google → Ads; iOS: Settings → Privacy → Tracking);
- Refuse consent to tracking: you will still see ads, but non-personalized ones.
Who it is shared with
Advertising data is processed by Google Ireland Ltd for EU users as an independent data controller for advertising purposes, in accordance with its own privacy policy. We do not sell your personal data and we do not use sensitive data categories for advertising purposes.
Payments (Stripe)
The app uses Stripe as its payment service provider to handle the transactions for the shared ride and other paid features. Stripe is certified PCI-DSS Level 1, the highest security standard for processing payment card data.
What data Stripe handles
- Card number, expiry date, CVV (collected in tokenized form)
- Cardholder name, email, country
- Transaction data (amount, date, identifier)
- Fraud detection data (IP address, device fingerprint)
What is NEVER sent to Sciame
Your full card details never pass through Sciame's servers: they are sent directly to Stripe via a certified SDK. Sciame receives and stores only a reference token, the last 4 digits, and the card brand, for billing and support purposes.
Who it is shared with
Payment data is processed by Stripe Payments Europe Ltd (based in Ireland, with transfers to Stripe Inc. in the USA governed by Standard Contractual Clauses) as a data processor. See Stripe's privacy policy.
In-app purchases and subscriptions (RevenueCat)
The app uses RevenueCat to manage in-app purchases and subscriptions made through the App Store (Apple) and Google Play (Google).
What data RevenueCat collects
- Anonymous user identifier (User ID) linked to your Sciame Account
- History of in-app purchases and subscriptions
- Status of active subscriptions (active, expired, cancelled)
- Basic device information to validate store receipts
In-app transactions are processed directly by Apple Inc. or Google LLC under their terms and privacy policies. RevenueCat acts as a server-side management tool to validate receipts and manage subscription status.
Who it is shared with
The data is processed by RevenueCat, Inc. (based in the United States) as a data processor, with EU→USA transfers governed by Standard Contractual Clauses. See RevenueCat's privacy policy.
What will change in the next phases
Sciame is progressively activating its commercial features. We will update this notice as new data processing activities are introduced and, where required by law, we will ask for your renewed consent.
The processing activities that will be introduced include:
- Sciame Card — single-use virtual card via Apple Pay / Google Pay, with transaction data linked to the ride group
- Identity document (optional Verified Profile verification)
- Polline Rewards — history of Polline earned and rewards redeemed
- Feedback system between users after rides
When the company that will commercially operate Sciame is incorporated, the data controller will be updated and data subjects will be informed with a prominent notice on the website and by email.
Who we share your data with today
Your data is processed directly by Luca Paratore as data controller. The external providers involved, acting as data processors (or independent controllers where indicated), are:
| Provider | Service | Registered office |
|---|---|---|
| Aruba S.p.A. | Hosting of the sciame.cloud website | Italy (EU) |
| Google LLC (Google Workspace) | Email + Google Apps Script and Google Sheets for collecting leads from the forms | USA (with EU SCC) |
| Google Ireland Ltd | Firebase Analytics and Crashlytics for the app · Google Play distribution | Ireland (EU) |
| Google Ireland Ltd / LLC | Google Analytics 4 on the website (only with your consent) | Ireland (EU) / USA (with EU SCC) |
| Google Ireland Ltd | Google AdMob — serving advertisements in the app | Ireland (EU) |
| Stripe Payments Europe Ltd / Stripe Inc. | Card payment processing | Ireland (EU) / USA (with EU SCC) |
| RevenueCat, Inc. | Management of in-app purchases and subscriptions | USA (with EU SCC) |
| Apple Distribution International Ltd | App Store distribution | Ireland (EU) |
Some providers (Google, Apple) transfer data outside the European Economic Area. In such cases, the Standard Contractual Clauses (SCC) approved by the European Commission (Decision 2021/914/EU) are applied.
Your rights
Under Articles 15-22 GDPR, you can at any time:
- Access the data we process about you
- Rectify inaccurate data or update it
- Request deletion (right to be forgotten)
- Restrict processing
- Receive your data in a structured format and port it to another controller
- Object to processing based on legitimate interest
- Withdraw consent at any time
To exercise these rights, write to us at info@sciame.cloud. We will respond within 30 days of the request.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it).
Cookies
On the sciame.cloud website we use two categories of cookies:
Technical cookies (always active)
Necessary for the website to function (session, language preference). They do not require consent and cannot be disabled.
Analytics cookies (with consent)
We use Google Analytics 4 (GA4) to understand how users interact with the website (pages visited, duration, device, aggregated country). These cookies:
- are activated only after your explicit consent via the banner;
- collect data with anonymized IP address;
- are used only for aggregate metrics, not to profile you individually;
- may involve a transfer of data to Google LLC in the United States, governed by the Standard Contractual Clauses approved by the European Commission.
You can withdraw your consent at any time by clicking "Cookie preferences" in the footer of every page. Withdrawal does not affect processing that has already taken place based on the consent previously given.
Data controller for Google Analytics: Google Ireland Limited (for EU users).
Sciame app
The app uses Firebase Analytics and Firebase Crashlytics in aggregated and anonymized form to identify bugs, monitor stability, and optimize the user experience. For the advertising data collected by AdMob, see the dedicated Advertising section.
Security
We adopt appropriate technical and organizational measures to protect your data. In the event of a breach affecting you, we will inform you within 72 hours as required by the GDPR.
Minors
Sciame is reserved for people aged 18 or over, for both the website and the app. We do not knowingly collect data from minors.
Changes to this notice
We may update this Privacy Policy to reflect changes to the service or to the law. Changes related to the commercial launch will be notified with at least 30 days' notice by email (for those who have provided a contact) and with a prominent notice on the website and in the app.
Contact us
- Email: info@sciame.cloud
- Phone: +39 328 203 5047
- Website: sciame.cloud