Privacy notice
Last updated: 7 September 2026
This notice, provided under Regulation (EU) 2016/679 (“GDPR”), explains how personal data is processed when you use Boring Customs.
Data controller
Federico Ventura SRLS, VAT No. IT04000010134, Via Tagliamento 6, 22063 Cantù (CO), Italy. Email: hello@boringcustoms.app. Certified email (PEC): federicoventurasrls@pec.it.
Data we process
We may process technical connection and security data, IP address, selected language, configuration data, content you upload, random link identifiers, order and export data and, when you purchase, your email address and transaction status received from the payment provider. We neither receive nor store full card details.
Purposes and legal bases
We process data to provide the configurator, create links and QR codes, generate and deliver exports, manage payments and support, and prevent abuse or fraud. The legal bases are performance of a contract or steps requested by you, compliance with legal obligations, and our legitimate interest in security and proper operation of the service. We do not use data for behavioural advertising.
Data stored on your device
The current project, language, tour status, certain preferences, and creative content may be stored in your browser’s localStorage or sessionStorage. This data remains on the device until you clear it through your browser settings. Creating a QR code or shareable link instead sends the configuration to the server.
Design links and QR codes
When you request a link or scan a QR code to continue on another device, the configuration is stored in a database with a random token. A design link normally expires after 7 days. Anyone who has the link can open the configuration until it expires, so do not share it if it contains material you want to keep private.
Exports and temporary files
The free preview is generated in your browser. Protected exports are generated on the server and may be stored temporarily on Cloudflare R2. A file-sharing link provided by QR normally remains available for approximately 30 minutes; other technical export records may be retained longer for delivery, security, support, and legal obligations.
Payments
When payments are enabled, Stripe and Link process the data required for checkout, payment, fraud prevention, receipts, transaction support, disputes, refunds, and tax compliance. Stripe or a Link group entity may act as merchant of record for enabled transactions. We receive only the data needed to verify payment and deliver the product.
Google Analytics
Only with your consent, we use Google Analytics 4 to measure visits, page usage, and interactions in aggregate. The tag is not loaded before consent, and we do not enable advertising features. You can withdraw your choice at any time under Info → Cookie preferences. The legal basis is consent.
Providers and recipients
Depending on the feature used, data may be processed by hosting and delivery providers, Turso for the database, Cloudflare for storage and infrastructure, Stripe and Link for payments, and advisers or authorities where necessary. Each provider processes data according to its contractual role and applicable law.
International transfers
Some providers may process data outside the European Economic Area. In those cases, transfers rely on an adequacy decision, standard contractual clauses, or another mechanism recognised by the GDPR, as stated by the relevant provider.
Retention
We retain data for as long as needed for the purpose for which it was collected. Links and temporary files follow the expiries stated in the service; order, payment, and tax records may be retained for legally required periods; security records may be kept for a period reasonably necessary to prevent abuse.
Your rights
Where provided by the GDPR, you may request access, correction, deletion, restriction, portability, or objection and withdraw any consent without affecting processing already carried out. You may also lodge a complaint with the Italian Data Protection Authority or the competent authority in your country.
Contact
For support and personal data requests, write to hello@boringcustoms.app. For formal communications by certified email (PEC): federicoventurasrls@pec.it.