Privacy and cookies

1. Data controller

The controller is WARE SRL, registered office at Via Provinciale 82, Albino (BG), Italy, VAT No. 04876650161. For data-protection enquiries, email privacy@ware.ly.

2. Data we process

Depending on how you interact with Loky, we may process:

• navigation and security data, such as IP address, date and time, browser, requests and technical logs;
• contract and contact data, such as name, email, company, billing address, VAT or tax number;
• subscription data, such as plan, payment status, Stripe identifiers and requested vault address;
• support data, meaning messages and information you choose to provide;
• vault content, entered by the user in the dedicated environment and stored encrypted.

Complete card details do not pass through Loky systems: payment is handled on Stripe’s secure pages.

3. Master password and encrypted content

The master password is not stored in a recoverable form. It is used to derive the key that unlocks the vault. During an unlocked session, the application processes the data needed to provide the requested functions; stored content is kept encrypted. WARE does not perform commercial analysis or profiling on vault content.

Where the Customer stores third-party personal data in the vault as part of its business, the Customer generally acts as controller and WARE as processor, limited to the technical delivery of the service. The applicable terms may also be set out in a data processing agreement available from WARE.

4. Purposes and legal bases

• Service delivery and management: vault creation, subscription management, support and operational communications; legal basis: performance of the contract and pre-contractual measures.
• Payments, accounting and compliance: accounting and tax management; legal basis: contract and legal obligation.
• Security and abuse prevention: protecting systems, diagnosis and defence of rights; legal basis: WARE’s legitimate interest and, where applicable, legal obligations.
• Marketing communications: sent only where permitted by law and with the right to object; legal basis: consent or legitimate interest where allowed.

5. Suppliers and recipients

Data may be processed by providers strictly necessary to deliver the service, including infrastructure and hosting, email and support services, administrative advisers and Stripe for payments, billing and fraud prevention. Providers receive only the data needed for their task and act under the applicable privacy role.

6. International transfers

The primary infrastructure is located in the European Economic Area. Some providers may process data outside the EEA; in those cases, transfers rely on an adequacy decision, standard contractual clauses or another mechanism under Chapter V of the GDPR.

7. Retention periods

• contract and tax data: for the period required by law, normally up to 10 years;
• subscription data: for the duration of the relationship and afterwards as needed for obligations or disputes;
• security logs: generally up to 90 days, unless investigation or protection requires longer;
• vault content: during the subscription and, after termination, for a technical period of no more than 30 days before deletion, unless different legal obligations or legitimate requests apply;
• support requests: for the time needed to handle them and protect the parties.

8. Cookies and technical tools

loky.app uses only cookies and technical tools required for security, sessions and checkout operation. We do not use advertising or profiling cookies on the Loky website. Technical cookies do not require prior consent. When you choose to pay, you are transferred to Stripe’s domain, which is subject to Stripe’s own notice and settings.

9. Your rights

You may request access, correction, deletion, restriction, portability and objection and, where processing is based on consent, withdraw that consent by emailing privacy@ware.ly. You also have the right to lodge a complaint with the competent supervisory authority; in Italy this is the Garante per la protezione dei dati personali.

10. Changes

This notice may be updated following legal or service changes. The date of the current version appears on this page; material changes will be communicated in an appropriate manner.