Data controller
The controller of your personal data is currently Luca Paratore, a natural person and founder of the Sciame project (hereinafter also "Sciame", "we").
- Email: info@sciame.cloud
- Contact form: sciame.cloud/en/contact
- Operating address: c/o Incubatore d'Impresa POINT — Polo per l'Innovazione Tecnologica, via Pasubio 5 (corner of via Einstein), 24044 Dalmine (BG), Italy
At the commercial launch, the data controller will become the company that will be incorporated to operate Sciame. Data subjects will be informed with a prominent notice on the website and by email (for those who have provided a contact).
What data we collect today
We collect the data strictly necessary to present the project on the sciame.cloud website, manage the expressions of interest from the forms, and run the Sciame app.
sciame.cloud website
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email (newsletter form) | Informing you when we launch in your city and about project news | Consent (Art. 6.1.a GDPR) | Until withdrawal or commercial launch + 12 months |
| Name, city, phone, email (/tassisti form) | Contacting you back to discuss a possible collaboration as a partner taxi driver at launch | Pre-contractual measures (Art. 6.1.b) + consent | Max 24 months if not concluded |
| Name, organization, role, email, event type, city, notes (/eventi form) | Contacting you back to discuss a possible partnership as a Mobility Partner at launch | Pre-contractual measures + consent | Max 24 months if not concluded |
| Browsing data (IP, user agent, technical logs) | Technical security of the website | Legitimate interest (Art. 6.1.f) | Max 12 months |
Important: the "taxi drivers" and "events" forms collect a non-binding expression of interest for both parties. No service is owed and no contract is concluded simply by filling in the form.
Sciame mobile app
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, name, password, date of birth | Creating the Account to access the service | Performance of a contract (Art. 6.1.b) | Until the Account is closed |
| Phone number (if provided) | Anti-fraud verification of the Account | Performance of a contract + legitimate interest | Until the Account is closed |
| Profile photo (if uploaded) | Visual identification between verified sciameres | Performance of a contract + consent | Until Account closure or deletion |
| Device location (precise and approximate, foreground only) | Matching with other nearby sciameres, setting the departure point, calculating distances and price estimates. See the Geolocation section for details. | Consent (Art. 6.1.a GDPR, revocable from the device settings) | Only during active use |
| Chat messages between sciameres | Coordinating the shared ride (meeting point, time) | Performance of a contract | Until Account closure or deletion on request |
| Payment data (Stripe token, last 4 digits, card brand) | Processing payments for the shared ride | Performance of a contract. See the Payments section. | For accounting and tax purposes, 10 years |
| Rides and ride closure: departure, destination, time, participants, check-in, amount entered by the Creator, confirmations and disputes, and the reason given when a Passenger declines to pay an estimate | Organizing the shared ride, splitting the fare, handling confirmations, disputes and complaints (see section 5.4 of the Terms) | Performance of a contract (Art. 6.1.b) + legitimate interest in preventing abuse (Art. 6.1.f) | The ride itself: deleted 24 hours after departure, or up to 6 days while a payment is still open. Payment records, confirmations and disputes: 10 years for accounting and tax purposes |
| Device notification token and app language | Sending push notifications about your rides and payments, in your language | Performance of a contract (Art. 6.1.b) | Until the Account is closed or notifications are turned off |
| Ratings and feedback after a ride (score from 1 to 5 for the ride and, optionally, for each travel companion; tags; optional comment) | Service quality and reliability. The average of the scores a User receives, as Creator and as travel companion, is shown to other Users next to their name once there are at least 3 scores; individual scores and comments are not shown to other Users | Legitimate interest (Art. 6.1.f) | Until the Account is closed |
| Public copy of the profile: name, nickname, photograph, average score received and payout account activation status | Showing other Users who their travel companions are. This is the only part of the profile visible to other Users: the rest is accessible only to the data subject | Performance of the contract (Art. 6.1.b) | Until the Account is closed |
| Device and app integrity signals (Google Play Integrity on Android, Apple DeviceCheck on iOS) | Verifying that requests come from the genuine app and not from programs imitating it. Sciame receives only the outcome of the check, not device data | Legitimate interest in the security of the service (Art. 6.1.f) | Not retained by Sciame |
| Record of late cancellations and no-shows | Assessing the reliability of the service and deciding whether to reintroduce the penalties (section 6 of the Terms). While penalties are suspended there is no charge and no effect on the Account | Legitimate interest (Art. 6.1.f) | Until the Account is closed |
| Sciame Points, badges and invite code | Running the points program and the "invite a friend" bonus | Performance of a contract (Art. 6.1.b) | Until the Account is closed |
| Purchase and subscription history (RevenueCat) | Managing any in-app purchases and subscriptions through the stores | Performance of a contract. See the In-app purchases section. | Until the Account is closed |
| Advertising identifier (AAID/IDFA) | Serving advertisements via Google AdMob. See the Advertising section. | Consent (Art. 6.1.a GDPR), revocable | Until withdrawal / ID reset from the device |
| Diagnostic data and crash reports (Firebase Crashlytics) | Diagnosing errors, improving app stability | Legitimate interest (Art. 6.1.f) | 14 months |
What we do NOT do: we do not sell your personal data to third parties, we do not use it for behavioral profiling outside AdMob's standard advertising systems, and we do not transfer data to non-EU countries without adequate safeguards (see the section Who we share your data with).
Geolocation (location data)
Sciame collects and uses the device's location data (both precise location and approximate location) only while the app is in use (in the foreground). The app does not collect location in the background.
How we access your location
Through the device's location services (GPS, Wi-Fi, and mobile network), subject to your explicit permission: the first time you use the feature you are asked for permission, and you can deny or revoke it at any time from the device settings ("Permissions → Location" section). Revocation does not affect processing that has already taken place based on the permission previously granted.
Why we collect it
- Showing you the stops and shared rides near you on the map.
- Automatically setting the departure point of a ride.
- Calculating distances and price estimates for the ride.
- Searching for an address or place when choosing where to depart or arrive: the text you type and the place you pick are sent, through our server and without your name or account, to Google Places to suggest matching places and get their position.
Who it is shared with
Location data is processed to provide you with these features and is handled through our providers acting as data processors — in particular Google Firebase for the app's backend and Google Maps Platform for displaying maps, calculating routes and searching for addresses. We do not sell your location data and we do not use it for advertising purposes.
Retention and deletion
Location data is used in real time while you use the app to provide the features described, and is not kept longer than strictly necessary for matching and ride creation. You can request the deletion of your account and all associated data at any time by writing to info@sciame.cloud (see also the section Your rights).
Advertising (Google AdMob)
The Sciame app contains advertisements provided by Google AdMob to support the development of the app in its initial phase.
What data AdMob collects
- Device advertising identifier (AAID on Android, IDFA on iOS)
- IP address and approximate location derived from IP
- Device information (model, operating system, language)
- Interactions with ads (views, clicks)
Personalized ads, consent and opt-out
For users in the European Union, before showing personalized ads AdMob requests your explicit consent via an in-app message (User Messaging Platform). You can:
- Change your personalization preferences at any time from the app settings;
- Reset your advertising ID or turn off personalization from the device settings (Android: Settings → Google → Ads; iOS: Settings → Privacy → Tracking);
- Refuse consent to tracking: you will still see ads, but non-personalized ones.
Who it is shared with
Advertising data is processed by Google Ireland Ltd for EU users as an independent data controller for advertising purposes, in accordance with its own privacy policy. We do not sell your personal data and we do not use sensitive data categories for advertising purposes.
Payments (Stripe)
The app uses Stripe as its payment service provider to handle the transactions for the shared ride and other paid features. Stripe is certified PCI-DSS Level 1, the highest security standard for processing payment card data.
What data Stripe handles
- Card number, expiry date, CVV (collected in tokenized form)
- Cardholder name, email, country
- Transaction data (amount, date, identifier)
- Fraud detection data (IP address, device fingerprint)
What is NEVER sent to Sciame
Your full card details never pass through Sciame's servers: they are sent directly to Stripe via a certified SDK. Sciame receives and stores only a reference token, the last 4 digits, and the card brand, for billing and support purposes.
Who it is shared with
Payment data is processed by Stripe Payments Europe Ltd (based in Ireland, with transfers to Stripe Inc. in the USA governed by Standard Contractual Clauses) as a data processor. See Stripe's privacy policy.
In-app purchases and subscriptions (RevenueCat)
The app uses RevenueCat to manage in-app purchases and subscriptions made through the App Store (Apple) and Google Play (Google).
What data RevenueCat collects
- Anonymous user identifier (User ID) linked to your Sciame Account
- History of in-app purchases and subscriptions
- Status of active subscriptions (active, expired, cancelled)
- Basic device information to validate store receipts
In-app transactions are processed directly by Apple Inc. or Google LLC under their terms and privacy policies. RevenueCat acts as a server-side management tool to validate receipts and manage subscription status.
Who it is shared with
The data is processed by RevenueCat, Inc. (based in the United States) as a data processor, with EU→USA transfers governed by Standard Contractual Clauses. See RevenueCat's privacy policy.
Evolution of the service
The app is under continuous development. We will update this notice whenever new data processing activities are introduced and, where required by law, we will ask for your renewed consent.
When the company that will commercially operate Sciame is incorporated, the data controller will be updated and data subjects will be informed with a prominent notice on the website and by email.
Who we share your data with today
Your data is processed directly by Luca Paratore as data controller. The external providers involved, acting as data processors (or independent controllers where indicated), are:
| Provider | Service | Registered office |
|---|---|---|
| Aruba S.p.A. | Hosting of the sciame.cloud website | Italy (EU) |
| Google LLC (Google Workspace) | Email + Google Apps Script and Google Sheets for collecting leads from the forms | USA (with EU SCC) |
| Google Ireland Ltd | Firebase Analytics and Crashlytics for the app · Google Play distribution | Ireland (EU) |
| Google Ireland Ltd / LLC | Google Analytics 4 on the website (only with your consent) | Ireland (EU) / USA (with EU SCC) |
| Google Ireland Ltd | Google AdMob — serving advertisements in the app | Ireland (EU) |
| Stripe Payments Europe Ltd / Stripe Inc. | Card payment processing | Ireland (EU) / USA (with EU SCC) |
| RevenueCat, Inc. | Management of in-app purchases and subscriptions | USA (with EU SCC) |
| Apple Distribution International Ltd | App Store distribution | Ireland (EU) |
| Google Ireland Ltd | Firebase App Check with Google Play Integrity — app integrity verification on Android | Ireland (EU) |
| Apple Inc. / Apple Distribution International Ltd | Apple DeviceCheck — app integrity verification on iOS | USA (with EU SCCs) / Ireland (EU) |
Some providers (Google, Apple) transfer data outside the European Economic Area. In such cases, the Standard Contractual Clauses (SCC) approved by the European Commission (Decision 2021/914/EU) are applied.
Your rights
Under Articles 15-22 GDPR, you can at any time:
- Access the data we process about you
- Rectify inaccurate data or update it
- Request deletion (right to be forgotten)
- Restrict processing
- Receive your data in a structured format and port it to another controller
- Object to processing based on legitimate interest
- Withdraw consent at any time
To exercise these rights, write to us at info@sciame.cloud. We will respond without undue delay and in any case within one month of the request, a period that may be extended by a further two months for particularly complex requests (Art. 12(3) GDPR).
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it).
Cookies
On the sciame.cloud website we use two categories of cookies:
Technical cookies (always active)
Necessary for the website to function (session, language preference). They do not require consent and cannot be disabled.
Analytics cookies (with consent)
We use Google Analytics 4 (GA4) to understand how users interact with the website (pages visited, duration, device, aggregated country). These cookies:
- are activated only after your explicit consent via the banner;
- collect data with anonymized IP address;
- are used only for aggregate metrics, not to profile you individually;
- may involve a transfer of data to Google LLC in the United States, governed by the Standard Contractual Clauses approved by the European Commission.
You can withdraw your consent at any time by clicking "Cookie preferences" in the footer of every page. Withdrawal does not affect processing that has already taken place based on the consent previously given.
Data controller for Google Analytics: Google Ireland Limited (for EU users).
Sciame app
The app uses Firebase Analytics and Firebase Crashlytics in aggregated and anonymized form to identify bugs, monitor stability, and optimize the user experience. For the advertising data collected by AdMob, see the dedicated Advertising section.
Security
We adopt appropriate technical and organizational measures to protect your data. In the event of a breach affecting you, we will inform you within 72 hours as required by the GDPR.
Minors
Sciame is reserved for people aged 18 or over, for both the website and the app. We do not knowingly collect data from minors.
Changes to this notice
We may update this Privacy Policy to reflect changes to the service or to the law. Changes related to the commercial launch will be notified with at least 30 days' notice by email (for those who have provided a contact) and with a prominent notice on the website and in the app.
Contact us
- Email: info@sciame.cloud
- Contact form: sciame.cloud/en/contact
- Website: sciame.cloud