Legal

Privacy policy

Last updated: 10 October 2026

Data controller

Riccardo Mores, sole trader, Italian VAT no. IT14587480964, based at Via Fratelli Rosselli 25/2, 20139 Milan, Italy, who provides the Trovavio service (the “Service”). For any question about the processing of your personal data you can write to riccardo@trovavio.com.

Data we collect

Account: email address and a hash of the password (never stored in clear text).
Profile: display name, business name (both optional), line of work, chosen avatar, main site.
Usage data: the addresses of the sites you check, scan results, SEO/GEO scores, the list of things to improve.
Payments: handled by Stripe. Trovavio receives only the customer ID and the subscription ID, never the card details.
Site connection (optional): the site's domain, the channel chosen, the date of the last contact, the corrections you approve (titles, descriptions, structured data and the like) and the platform the site is built with, recognised from its public home page.
Technical: IP address for security purposes, access logs.

Connecting sites and the visitors of your sites

If you connect a site to Trovavio, you paste a code on the site (a script, a PHP file, a Cloudflare Worker or a Node middleware) that reads the corrections you approved and applies them to the pages. We don't ask for passwords or access to the site's files.

What the code reads: it downloads the list of the site's corrections and looks up the page's one in the browser: the page address is not sent to Trovavio. It doesn't use cookies, doesn't store anything in the browser and doesn't read personal data of whoever visits the site.
What we keep in our database: no IP address and no data of whoever visits the site.
With the script: the browser of whoever visits the site contacts Trovavio's servers to download the corrections. The server sees the IP address in order to respond and to limit abuse (in memory, for one minute); these requests are not written to the server's technical logs and the address is not kept. The address of the page being viewed is not even sent.
With PHP, Worker and Node: the request comes from the site's server, at most once an hour, without data of whoever visits the site.

For the IP address of whoever visits the site, which Trovavio's server sees in order to respond, Trovavio acts on the instructions of the customer who connected the site. If you use the script, consider naming it among the external services in your site's privacy notice.

Purposes of processing

Providing the SEO + GEO audit service.
Sending transactional emails (welcome, password reset, weekly report, reactivation, team invitation).
Automatic weekly monitoring of sites (for users on a paid plan).
Account security (authentication, fraud prevention).

Legal basis

Performance of the contract (art. 6.1.b GDPR) for providing the service. Explicit consent (art. 6.1.a GDPR) for any marketing communication (we currently send no marketing email). Legitimate interest (art. 6.1.f GDPR) for account security.

Data retention

Data is kept until the account is deleted. You can delete your account at any time from the “Danger zone” section of your profile. Deletion is immediate and cannot be undone.

If you disconnect a site, the code stops working immediately and the corrections stay saved, so you can reactivate them; deleting the account also deletes the connections and the corrections. The server's technical logs, which do not include the site-connection requests, are kept for up to 14 days.

Your rights

Under the GDPR you have the right to: access, rectification, erasure, restriction, portability (export all your data as JSON from the “Data and privacy” section of your profile), and objection. To exercise any of these, write to us at riccardo@trovavio.com.

Data shared with third parties

Anthropic (USA): for generating AI content (titles, descriptions, schema). We send only the audit data that is needed, never passwords or personal information.
Stripe (Ireland/USA): for handling subscriptions and payments.
Resend (USA): for sending transactional emails.

All providers meet the GDPR standards for transfers outside the EU (standard contractual clauses).

Frequently asked questions

What personal data does Trovavio collect?

Your email and a hash of your password, optional profile details, the addresses and results of your scans, and technical data such as the IP address for security. Payments are handled by Stripe: Trovavio receives only the identifiers, never the card details.

What happens to my site's visitors if I connect it to Trovavio?

Trovavio doesn't keep data of whoever visits the site and the code doesn't use cookies. With the script, the server sees the IP address in order to respond but does not record or keep it, and doesn't receive the page being viewed; with PHP, Worker and Node whoever visits the site never contacts Trovavio.

Can I delete or export my data?

Yes. You can delete your account at any time from the Danger zone section of your profile (immediate and irreversible) and export all your data as JSON.

Does Trovavio share my data with third parties?

Only with the providers the service needs: Anthropic for AI generation, Stripe for payments and Resend for emails, all meeting the GDPR standards for transfers outside the EU.