Privacy notice

1. Data controller

The data controller is Alberto Di Gioacchino, a freelance professional with VAT number (partita IVA) 02332500442, based at Via Raffaele Tombolini 50, 63822 Porto San Giorgio (FM), Italy. You can contact him at ciao@cerchia.app. No Data Protection Officer (DPO) has been appointed.

2. The service

Cerchia (https://cerchia.app) is a tool for Italian creators who run paid Telegram groups. This notice covers the waiting list (sections 3 and 4) and Verifica (sections 5, 6 and 7).

Verifica lets fans who already support a creator on Twitch, Patreon or YouTube join the creator's Telegram group without paying again: the fan proves the membership by signing in with the platform, and Cerchia's bot lets them into the group and removes them when the membership ends. Verifica handles no payments: the fan keeps paying the creator on the platform.

3. Waiting list: what data we collect

Through the waiting list form we process:

• your email address (required);
• only if you choose to answer the optional questions after signing up: what kind of creator you are, the platform where your biggest audience is, your public profile there (username or link), how many people follow you and how many already pay you (in ranges);
• the date and time of your consent and the version of the consent text you accepted;
• technical data about the visit: UTM parameters, referrer (the page you came from) and which form on the site you signed up with.

To tell people from bots we use Cloudflare Turnstile, which processes your IP address and browser signals. We don't store IP addresses in our database.

4. Waiting list and website: purposes and legal bases

• Waiting list and launch updates: managing your sign-up, sending the confirmation email (double opt-in) and updates about Cerchia's launch. Legal basis: your consent (Art. 6(1)(a) GDPR).
• Founding creator programme: contacting creators on the list to offer the founding creator programme. Legal basis: your consent (Art. 6(1)(a) GDPR).
• Security and abuse prevention: protecting the form from bots and abuse with Turnstile. Legal basis: the controller's legitimate interest (Art. 6(1)(f) GDPR).
• Aggregate statistics and improving the website: measuring use of the website in aggregate and recording browsing sessions (pages viewed, clicks, scrolling) to find errors and unclear steps, with PostHog (EU cloud), without cookies, without storing IP addresses and without profiling. Recordings are not linked to your account and hide what you type in fields and all text in the fan and creator areas. Legal basis: the controller's legitimate interest (Art. 6(1)(f) GDPR).

Your email and consent are needed to join the list; without them we can't complete your sign-up. The other data is optional.

5. Verifica: what data we process

If you are a fan and you verify that you are a creator's member, we process:

• the ID of your account on the platform you verify with: your Twitch user ID, your Patreon user ID or your YouTube channel ID;
• the membership tier you hold with the creator and, for Patreon, the ID of your membership of the creator's page (member ID);
• the Telegram user ID of the account you link to Cerchia's bot;
• YouTube only: a Google access token, with its refresh token, stored encrypted, which we use for the daily check (section 7);
• the status of your access to the group (active, in grace period or ended), the dates of the checks and the log of when you joined and were removed from the group.

For Twitch and Patreon we use your sign-in only once, when you verify, and we don't keep it: later checks use the creator's access. We don't collect your email, name, Telegram username or phone number, watch history or your other memberships. While you verify, your browser keeps a signed technical cookie with these IDs and your account name for at most 2 hours, only to show you the steps.

If you are a creator and you connect your Twitch or YouTube channel or your Patreon page to Verifica, we process: the ID and name of the channel or page; the membership tiers, with name and price, and the Telegram group each one unlocks; for YouTube, the IDs of some members-only videos used for the check; your platform access tokens, stored encrypted; your Verifica settings, such as the grace days. With your access we check whether a fan who verifies is your subscriber or member and at what tier.

All tokens are encrypted (AES-256-GCM) and never appear in logs or error messages.

6. Verifica: why and how we use the data

We use Verifica data only to:

• verify that you are the creator's member and check it again once a day;
• let only the Telegram account you linked into the creator's Telegram group;
• when the membership ends or your tier no longer unlocks the group: warn you through the bot one day before and remove you from the group after the grace period set by the creator;
• show the creator how many members are verified.

Legal basis: performance of the service you ask for (Art. 6(1)(b) GDPR); for fans, access to the creator's group with Verifica; for creators, the service described in the creator terms.

Every call to the platforms is read-only: we never post, edit or delete anything on your accounts. We don't use this data for advertising or profiling.

7. Verifica with YouTube and Google user data

Verifica uses YouTube API Services. When you verify with YouTube you sign in with your Google account and grant the "youtube.force-ssl" permission, which Google describes as "See, edit, and permanently delete your YouTube videos, ratings, comments and captions". It is the only permission with which YouTube lets an app check a channel membership.

We use it only for that: once a day we ask YouTube whether your account can access the comments of one of the creator's members-only videos. It is a read-only call that doesn't read the content of any comment. We never post, comment, read or delete anything, and we don't access any other data in your Google account.

Of your Google data we store only your YouTube channel ID and the Google access token, with its refresh token, encrypted. We don't store your email, name, picture or any other data from your Google account.

Creators connect their channel with the read-only "youtube.readonly" permission: we read the channel ID and name and the list of its members-only videos.

Cerchia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular: we use Google user data only to verify the membership; we don't sell it; we don't use it for advertising, to determine creditworthiness or to develop or train artificial intelligence models; we don't transfer it to third parties except to the providers we need to deliver the service (section 8) or when the law requires it; no human reads it, except with your explicit consent, for security purposes or when the law requires it.

You can revoke Cerchia's access to your Google account at any time at https://myaccount.google.com/permissions. Google's processing of your data is governed by the Google Privacy Policy (https://policies.google.com/privacy). By verifying with YouTube you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms).

8. Recipients and processors

To provide the service we use the following providers, which process data on our behalf as data processors:

• Supabase: database, with servers in Frankfurt (EU).
• Cloudflare: hosting, DNS, email forwarding and Turnstile; global network, with transfers outside the EU covered by Standard Contractual Clauses (SCC) and/or the Data Privacy Framework (DPF).
• Resend: sending emails, region eu-west-1 (Ireland); Resend Inc. is based in the United States, with SCC and/or DPF safeguards.
• PostHog: statistics and session recording, EU cloud (Frankfurt).
• Sentry: error monitoring, EU region (Germany).

For Verifica we also exchange data with these platforms, which process it as independent controllers under their own privacy policies: Google and YouTube for the membership check (https://policies.google.com/privacy), Twitch (https://legal.twitch.com/legal/privacy-notice/), Patreon (https://privacy.patreon.com/) and Telegram for joining and removal from the group and the bot's messages (https://telegram.org/privacy). We only share what is needed: for example, with Telegram, the approval or removal of your account from the group.

Your data is not sold or shared with third parties for marketing purposes.

9. Transfers outside the EU

Data is hosted in the European Union. Some providers (in particular Cloudflare and Resend) may involve transfers to countries outside the EU, which take place only with adequate safeguards: Standard Contractual Clauses or certification under the EU-US Data Privacy Framework.

Google, Twitch, Patreon and Telegram may also process data outside the EU, as independent controllers and under their own privacy policies.

10. How long we keep data

• Waiting list, unconfirmed sign-ups: deleted after 30 days.
• Waiting list, confirmed sign-ups: until you unsubscribe or until 24 months after the product launches, whichever comes first.
• Verifica, fans' Twitch and Patreon tokens: not kept, we use them only once while you verify.
• Verifica, fans' Google tokens: as long as Verifica gives you access to a group. We delete them when that access ends or, if you revoke access earlier, as soon as we notice, at the next daily check.
• Verifica, fans' YouTube data (channel ID, tokens, tier, Telegram ID and related access): deleted within 7 days of your access to the group ending, of you revoking access or of you asking for deletion at ciao@cerchia.app (if verifying gives you access to no group, within 7 days of verifying). After you revoke, your access to the group ends within 6 days.
• Verifica, fans' Twitch and Patreon data (account IDs, tier, Telegram ID): until 90 days after your access to the group ends (or after verifying, if it gave you access to no group), so if you renew in the meantime you don't have to link Telegram again. If you ask for deletion at ciao@cerchia.app, we delete it within 7 days.
• Verifica, creator data (channel or page, tiers, tokens): as long as the platform stays connected or until you close your Cerchia account.
• Browsing session recordings (PostHog): deleted after 30 days.

After these periods the data is deleted.

11. Your rights

You have the right to obtain at any time:

• access to your data;
• correction of inaccurate data;
• erasure of your data;
• restriction of processing;
• data portability;
• to object to processing based on legitimate interest;
• to withdraw your consent, without affecting the lawfulness of earlier processing.

To withdraw your consent to the waiting list, use the unsubscribe link in every email or write to ciao@cerchia.app. You can exercise your other rights at the same address.

Verifica with YouTube: you can revoke Cerchia's access at https://myaccount.google.com/permissions; we delete the tokens at the next daily check, and your access to the group ends within 6 days of the revocation. For Twitch and Patreon we don't keep your sign-in, but you can still disconnect Cerchia from Twitch under Settings › Connections (https://www.twitch.tv/settings/connections) and from Patreon under Settings › Apps (https://www.patreon.com/settings/apps). To have your Verifica data deleted, write to ciao@cerchia.app. Creators can revoke Cerchia's access from the same pages: checks stop and nobody is removed from the group until they reconnect the platform.

You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (https://www.garanteprivacy.it).

12. Cookies

The website uses no profiling cookies. Statistics are collected without cookies. Cloudflare Turnstile may use technically necessary storage to run the security check.

The Verifica pages and the creator area use only technical cookies the service needs: a signed cookie, valid for at most 2 hours, remembers the verification in progress; while you sign in with Twitch, Patreon or Google a cookie protects the connection; the creator area uses a session cookie to keep you signed in.

13. Minors

The waiting list and Verifica are only for people aged 14 or over (the age of digital consent in Italy). If you think a child under 14 has given us their data, write to ciao@cerchia.app and we will delete it.

14. Changes to this notice

We may update this notice, for example when the product launches. The date and version of the latest update are shown at the top of the page.