Privacy Policy

1. Data controller

BCrypto (company in formation), founder Pavel Ivanov, operational office Torino, Italia. Privacy contact: info@q-audion.com.

Note: the company is being formally incorporated. Once registration with the Italian Companies Register is complete, VAT, REA number and registered office will be published on this page and in the Legal Notice.

A Data Protection Officer has not been designated, as current data processing activities do not meet the criteria of Art. 37 GDPR. The privacy contact above handles all data protection inquiries.

2. Data we collect

• Contact data voluntarily provided via forms: name, email, organisation, message, request subject.
• Newsletter subscription: email and subscription/confirmation timestamp (double opt-in).
• Anonymous browsing data (only with analytics consent): anonymized IP, browser, pages visited, time on page, referrer.
• Strictly necessary cookies: session, language preference, cookie-consent choice.

3. Purposes and legal bases

Purpose	Legal basis	Retention
Respond to contact requests, deliver requested documents	Art. 6(1)(b) GDPR — pre-contractual measures	24 months from request
Newsletter	Art. 6(1)(a) GDPR — consent (double opt-in)	Until unsubscribe + 30 days
Aggregate stats (Google Analytics 4, Vercel Speed Insights)	Art. 6(1)(a) GDPR — consent	14 months (GA4 limit)
Security, abuse prevention	Art. 6(1)(f) GDPR — legitimate interest	90-day logs

4. Third-party processors

Data may be processed by the following processors, each under a GDPR-compliant DPA:

• Vercel Inc. (hosting + edge) — California, USA. Standard Contractual Clauses 2021/914.
• Google Ireland Limited (Analytics 4) — Ireland, EU. IP anonymization enabled. Google Privacy.
• Resend Inc. (optional, newsletter audience) — Delaware, USA. SCCs 2021/914. Only consented subscriber emails.
• SMTP provider (transactional email delivery): EU servers.
• MySQL database: European hosting provider, data encrypted at rest.

5. Transfers outside the EU

Transfers to third countries (USA for Vercel/Resend) rely on Standard Contractual Clauses approved by EU Commission Decision 2021/914 and, where applicable, the EU-US Data Privacy Framework.

6. Your rights (GDPR Arts. 15–22)

• right of access;
• right to rectification;
• right to erasure ("right to be forgotten");
• right to restriction of processing;
• right to data portability;
• right to object;
• right to withdraw consent at any time (does not affect lawfulness of processing before withdrawal).

To exercise these rights, email info@q-audion.com. We respond within 30 days (Art. 12 GDPR).

You may also lodge a complaint with the Italian Data Protection Authority (Garante).

7. Cookies and analytics

See Cookie Policy for details. Consent can be withdrawn at any time via the "Cookie preferences" link in the footer.

8. Security

We apply appropriate technical and organisational measures (Art. 32 GDPR): TLS 1.3 in transit, password hashing where applicable, least-privilege DB access, access logs, encrypted backups.

9. Q-Audion mobile application

This section applies to users of the Q-Audion app for Android. The full Application policy (account data, end-to-end encryption of communications, recipients, retention, rights) is published at bcrypto.com/legal/qaudion-privacy; the following describes the processing tied to contact discovery and to the app's optional features.

Purpose	Legal basis	Retention
Contact discovery: when the User starts the address-book import, the address-book numbers are hashed on the device with SHA-256 and a server-provided pepper (or, if the pepper is unavailable, with plain SHA-256) and only the hashes are sent to match already-registered users; names and plaintext numbers never leave the device. The User's own number, if provided, is stored only as a SHA-256 hash with pepper, as account data	Art. 6(1)(a) GDPR — consent	Address-book hashes are not retained beyond the matching
Usage telemetry and operational diagnostics, only if the User enables "Encrypted operational diagnostics" ("Diagnostica operativa cifrata") in Settings > Privacy (off by default): anonymised usage events (app start, login outcome, call start/end, group events — only the event type and a few technical fields, filtered of identifiers, e-mail and phone numbers) sent over TLS to the Controller's servers, and encrypted operational diagnostics (call-pipeline metrics, WARN-level and above logs) readable only server-side; in addition, only if the User separately enables "Real-time diagnostic logs" (also off by default), redacted application logs (tags, sizes, truncated fingerprints — never keys, tokens or message content) sent over TLS to the Controller's diagnostics backend while the app is in use; all of this to detect bugs and improve the service	Art. 6(1)(a) GDPR — consent	For the time strictly necessary for diagnostics (usage events in a fixed-capacity store where the oldest entries are overwritten)
Optional WireGuard-based VPN tunnel, enabled only by the User: the device's traffic is routed through the Controller's relay nodes, which transiently process connection metadata (IP address, connection timestamps, per-node aggregate traffic volume) for routing and abuse prevention; no browsing content is inspected or logged	Art. 6(1)(b) GDPR — contract; Art. 6(1)(f) — legitimate interest (abuse prevention)	Transient; the public IP is not persistently recorded by the VPN service. The central server keeps the peer registration (WireGuard public key, node, internal tunnel address) for 24 hours, with automatic removal on expiry, and a register of session tokens (identifier, user, issue and expiry times, no IP) for audit purposes, automatically deleted within 24 hours of each token's expiry. Deleting the account immediately removes the User's VPN entitlement, peer registration, tokens and contact fingerprints (hashes)

If the User uses Q-Audion through Android Auto or on a Wear OS smartwatch, those surfaces only render data already present on the phone (contacts, conversations, call state) through Google's Car App Library and Wearable Data Layer on the User's own devices; the Controller collects no additional data through them. Google processes the projection and data-layer transport as an independent controller under its own privacy policy.

iOS app

The above also applies to the Q-Audion app for iPhone, with the following differences. Notifications and incoming calls are delivered through the Apple Push Notification service and PushKit: the Controller stores the device's notification token and Apple Inc. processes the notification transit as an independent controller under its own policy. The iOS app contains no Firebase Cloud Messaging, Firebase Crashlytics or Google Play Integrity: diagnostics are handled by in-house components and leave the device only if the User enables "Diagnostics" in Settings > Privacy (off by default). The optional Siri and CarPlay integrations process contact names and call state exclusively on the device through Apple's system APIs; nothing is sent to the Controller for those features. Registration "with extension and email" requires an email address, used for verification and account recovery. The phone number, if provided, is transmitted in plaintext once to send the SMS verification code and stored only as a hash. If the User pairs the optional Q-Audion earbuds, the accessory identifier is associated with the account for key custody. Reporting a contact, message or group ("Report") sends the Controller, in encrypted form, the chosen category and the reported identifiers; reports are reviewed within 24 hours. Account deletion is available in the app (Settings > Account > Delete account) and on the account deletion page.

10. Changes

This notice may be updated. Material changes will be notified via banner and, for newsletter subscribers, by email. The "consent version" is bumped when changes require renewed consent.