Privacy Policy
Last updated: 2026-10-22
This policy explains which personal data pcbmate processes, why, and your rights under the EU General Data Protection Regulation (GDPR) and the Italian Privacy Code.
Who is responsible
The data controller is Davide Turrini, Località Mandolara 1, 37060 Sona (VR), Italy, VAT IT04808820239; email dt.turrini@gmail.com, PEC dt.turrini@pec.it.
What we process and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Account: name, email, password (stored only as a hash), sign-in with Google or GitHub | To create and protect your account | Contract (Art. 6(1)(b)) | While you have an account |
| Your projects, libraries, datasheets and their history | To provide the service | Contract | While you have an account; backups up to 14 days more |
| Organizations, members and invitations (names and emails of the people you invite) | To share work with your team | Contract; for invited people, our and your legitimate interest (Art. 6(1)(f)) | While the organization exists; invitations until they expire |
| Billing: plan, Stripe customer and subscription identifiers, invoices | To sell subscriptions and keep accounts | Contract; legal obligations (Art. 6(1)(c)) | Invoices 10 years (Italian law) |
| Anthropic API keys you add | To run the AI features with your key | Contract | Until you remove them; stored encrypted, nobody can read them back |
| AI usage and activity: tokens, estimated cost, the steps of each AI task | Budgets, cost reports, and to let you see what the AI did | Contract | Usage while you have an account; activity 90 days |
| Problem reports you send: description, pages visited, errors (secrets removed) | Support | Legitimate interest | As long as needed to solve the problem; ask us to delete them at any time |
| Messages from the website's contact form | To answer you | Pre-contractual steps / legitimate interest | In our mailbox, as long as needed to answer and follow up |
| Server logs: IP address, browser, requests | Security and fixing faults | Legitimate interest | A short time: logs are rotated and overwritten |
| Visit statistics, without cookies (see the Cookie Policy): pages, referring site, campaign, a code valid for one day | To understand how the service is used | Legitimate interest | Page views 90 days; the day's code cannot be linked to you once the day is over |
We do not sell personal data and do not use it for advertising. pcbmate does not make decisions about you based solely on automated processing.
The AI features
The AI assistant and the other AI features send what they need (your request, parts of the open project, the datasheets they search) to Anthropic PBC (United States), using the API key of your account or of your organization. Anthropic processes it under its own terms with the key's owner; under its commercial terms, data sent through the API is not used to train its models. Do not put personal data of other people in your projects or requests unless you need to.
Who else processes the data
We use these providers, bound by data processing agreements:
- OVH SAS (France): servers and backups, in the European Union.
- Stripe (Ireland and United States): payments; your card details go to Stripe only.
- Resend, Inc. (United States): sending emails (verification, password reset, invitations, notices).
- Anthropic PBC (United States): the AI features, as described above.
- GitHub, Inc. (United States): problem reports, when you send one; and sign-in with GitHub if you choose it.
- Google (Ireland): sign-in with Google, if you choose it.
Transfers outside the European Economic Area rely on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses.
Your rights
You can ask to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format (your projects can also be exported as KiCad, Eagle and Gerber files from the app). Write to dt.turrini@gmail.com: we answer within one month. To delete your account, write from its email address. You can also complain to the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
Security
Connections are encrypted (HTTPS), passwords are stored as hashes, API keys are encrypted, and the servers are reachable only for the service. Backups stay on our servers in the EU.
Changes
If this policy changes in a way that matters, we tell you by email or in the app before the change applies.