Privacy policy

Garanti is an app that helps you keep your proofs of purchase and track your warranties. The data controller is Gesmo srl, publisher of Garanti (full details in the legal notice). Gesmo srl decides why and how your data is used.

Gesmo srl, Rue Monceau du Berger 10, 1470 Genappe, Belgium — CBE BE 0443.999.682 — support@gesmo.be

Gesmo srl has not appointed a data protection officer, as this appointment is not currently mandatory given its activity. For any question about your data: support@gesmo.be

Account: your email address, needed to sign in.

Purchases: the information you enter or that is read from your proofs of purchase (product, seller, date, price, warranties).

Documents: the receipts and invoices you import. They are stored in a private space that only you can access.

Voice memo: Garanti does not keep the audio recording in your dossier. It is sent to the transcription service; the transcript prepares the memo and may be saved with the draft or purchase. This does not guarantee the absence of technical retention by the provider.

Usage statistics: some account-linked events (for example "purchase added"), activity dates and technical reading measurements, without purchase contents. Account-linked data is not anonymous; the console may display aggregated counts.

Public pages without an account: the card tool, the guide and the help forms only record the names of anonymous events (for example "card viewed"), without the chosen card or any data about you. To limit abuse, the forms temporarily keep an encrypted, non-reversible fingerprint of the IP address, never the address itself.

Only to provide the service: organise your proofs of purchase, calculate your warranties and send you the reminders you chose. We do not sell your data and do not use it for advertising.

Accounts, dossiers, requested transcription, document reception and chosen reminders perform the requested service (GDPR Article 6.1.b). Security, abuse prevention, support and limited technical measurements rely on our legitimate interest in maintaining and improving a reliable service (Article 6.1.f), respecting your rights and right to object. Statutory invoicing obligations fall under Article 6.1.c; Paddle handles sales as Merchant of Record. The Gmail connection and notifications rely on your consent (Article 6.1.a), withdrawable at any time. Your data is not used for advertising.

Your receipts and invoices are read automatically to fill in the fields of your purchases. This reading is for your use only. The detected information may be inaccurate: you can always correct it.

Your purchases and documents are private by default. A team member can only access them with your explicit permission (time-limited help access, revocable at any time) and every access is logged.

Your data is kept as long as your account exists. You can delete your account from settings: purchases, documents and personal data held in Garanti are erased upon successful account deletion. For copies of emails received at Resend, see “Forwarding documents by email”.

Successful account deletion erases the data and files managed by Garanti. It does not prove immediate erasure of technical copies or backups at providers. Exact retention periods for Lovable Cloud backups, AI processing and received Resend emails remain to be confirmed; no provider deletion period is guaranteed here.

You have the right of access, rectification, erasure, portability and objection. Most of these actions can be done directly in the app (edit a purchase, export or delete your account). For any other request: support@gesmo.be or the Help page.

You may also request restriction of processing, withdraw consent where processing relies on it, and lodge a complaint with the Belgian Data Protection Authority (APD/GBA). APD/GBA: www.autoriteprotectiondonnees.be. Contact Gesmo srl at support@gesmo.be, via Help or at its registered office. We normally respond within one month, with a reasoned extension where permitted by the GDPR.

Each user can only access their own data, a rule enforced by the database itself. Traffic is encrypted (HTTPS) and data is encrypted at rest by the host. Proofs of purchase sit in private storage, opened only through temporary links. The Gmail access key is encrypted. Administration is restricted to authorised accounts and every action is logged.

In the event of a data breach, Gesmo srl notifies the APD/GBA within 72 hours where required by law, and informs you directly if it poses a high risk to your rights.

Database and documents: accounts, purchases, warranties and proofs of purchase are stored by Lovable Cloud, in a data centre located in Ireland (European Union), on Supabase / Amazon Web Services infrastructure. Proofs of purchase (receipts, invoices, warranty documents, attachments received by email or Gmail) are kept in private storage per user, in the same data centre in Ireland.

Automatic reading and voice memo: the document or recording you send is passed, at the time of reading, to Lovable's artificial intelligence service, which relies on an OpenAI model. This processing may take place outside the European Union, to perform reading and transcription. Technical retention periods for documents, audio and text at the providers have not been confirmed for our configuration; we do not promise immediate deletion.

App and emails: the app's pages and the emails (sign-in, reminders) go through Lovable's services. These services may rely on servers located outside the European Union.

Notifications: if you enable them, Google Firebase (Cloud Messaging) delivers notifications to your device using a technical device identifier.

Audience measurement: the host Lovable measures page traffic (pages viewed, device type, approximate country) through its provider Tinybird, without the content of your purchases or documents; basis: legitimate interest (6.1.f).

Subscriptions are sold by Paddle.com, Merchant of Record, which processes the data needed for the sale, subscription management, payment, taxes and invoices. Garanti never receives or stores your card number: only the state of your subscription (plan, status, dates).

To spot the protections linked to your cards, Garanti only keeps the network, the issuing bank, the commercial name of the card, an optional custom label and, if you provide it, the expiry year. Garanti keeps no card number, not even the last digits, no expiry month, no security code and no access to your bank account. A full card number is automatically rejected.

Emails forwarded to your personal Garanti address pass through Resend, our receiving provider: email addresses, message and attachments are processed to route your documents to your private account.

Deletion in Garanti concerns data held by Garanti; it does not confirm deletion of received copies at Resend. Resend stores received emails and allows retrieval through its service. The exact retention period for received emails and attachments has not been confirmed for our configuration; we therefore do not promise immediate deletion by this provider. See Resend’s receiving documentation.

If you connect your Gmail account, Garanti gets read-only access from Google. Garanti cannot send, change or delete your emails. It only searches for order or invoice emails with an attachment and shows you just the subject, sender, date and file names, without storing them. Only the emails you choose to add are copied to your account and read by the AI service.

Garanti’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This data is used only to import your proofs of purchase: it is not sold, not used for advertising and not used to train AI models. You can revoke access at any time with “Disconnect Gmail” or in your Google account. The encrypted access key is erased on disconnection and when your account is deleted.

If you subscribe to new articles, we keep your email address, chosen language, subscription and confirmation dates, and the last article sent. Basis: your consent (Article 6.1.a), given through an unticked box and confirmed by email. Emails are sent through Resend. Each email contains a one-click unsubscribe link; after unsubscribing, no further articles are sent and the address is kept only to respect that choice.

Some providers process data outside the European Economic Area, notably in the United States: Lovable and some of its subprocessors (including the AI service), Resend (email receiving, primary processing in the US) and Google Firebase (notifications). These transfers are governed by the European Commission’s standard contractual clauses (Decision 2021/914) and, where applicable, the EU–US Data Privacy Framework. These providers act as processors for Gesmo srl.

Paddle, the official seller of subscriptions, processes your payment data as a separate controller under its own privacy policy. Data may also be disclosed to professional advisers or authorities where required by law.

The periods below match the standard practices each provider publicly announces. Written confirmation has been requested from them; this section will be updated as soon as their replies are received.

Lovable Cloud (database, storage, app): your data and files are kept until they are deleted in the app or your account is deleted; they are then removed immediately from the live database. Copies may remain in daily backups for a limited time (about 14 days according to Lovable's documentation) before being permanently erased. Deleted proofs and files immediately become inaccessible to everyone, including you, and are permanently erased within a maximum of 30 days; they are not included in backups. Technical and security logs are kept as long as needed to run and secure the service, then deleted or anonymised on a rolling basis, under Lovable's privacy policy (section 13, lovable.dev/privacy; contact: privacy@lovable.dev). Lovable does not publish a fixed period for these logs.

Resend (emails): the content and metadata of received or sent emails are kept for 30 days by default, then purged. Unsubscribe and bounce lists are kept until manually deleted, in order to respect your choice not to receive further emails.

Google Firebase (notifications): your device's technical identifier is kept until you turn notifications off or delete your account.

Paddle (payment): keeps sales data according to its own legal invoicing obligations, as a separate data controller.

Garanti does not use advertising cookies. Your browser only keeps technical elements: the sign-in session, the chosen language, a few display preferences (for example messages already seen) and a copy of the app for fast start-up. The host's audience measurement is described in section 8 bis.