SpooqW

Privacy policy

Last updated: July 2026 · Version 2.0

This Privacy Policy explains how Aretè Tecnologia di Antonio Sambataro("Aretè", "SpooqW", "we", "us") — a sole proprietorship with registered office in Belpasso (CT) 95032, Italy, VAT number IT05945010873 — collects, uses, shares and protects personal data. It applies when you visit spooqw.com, create an account, or use the SpooqW data lakehouse platform in its hosted (cloud) form. It also explains our role for the business data you process through SpooqW, whether you use the cloud service or a self-hosted / on-premise deployment.

We process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR") and Italian Legislative Decree 196/2003 as amended (the "Privacy Code"). Any capitalised terms not defined here have the meaning given to them in our Terms of Service.

1. Data controller and contact

The data controller for the personal data described in this policy is Aretè Tecnologia di Antonio Sambataro, Belpasso (CT) 95032, Italy, VAT IT05945010873. We have not appointed a statutory Data Protection Officer, as we are not required to; for all privacy matters — including data-subject requests and questions about this policy — you can reach our privacy contact at asambataro@aretetecnologia.com.

2. Two roles: controller and processor

It is important to distinguish the two capacities in which we handle data:

  • We are the controller for the personal data you and your team members give us to create and manage your account and subscription — account data, billing data, usage/telemetry, and support correspondence. This policy describes how we handle that data.
  • We are a processor for the business data you ingest, transform, store and query through SpooqW pipelines and the lakehouse (your databases, files, streams and Iceberg tables, which may themselves contain personal data). You — the customer — remain the controller of that data. We process it only on your documented instructions to provide the service. The terms governing that relationship are set out in our Data Processing Agreement("DPA"), which forms part of your contract with us.

If you run SpooqW self-hosted / on-premise, your customer data (and, where you point AI features at your own inference endpoint, your AI prompts) never leave your own infrastructure, and we act as a processor only to the limited extent you send us diagnostic or licensing information.

3. Personal data we collect (as controller)

  • Account data — email address, password (stored only as a salted hash, never in clear text), name, company/organisation, role and team size you provide at signup or in your profile, plus workspace and membership details for users you invite.
  • Billing data — your selected plan, subscription status and invoicing details. Payments are handled by Stripe; we receive confirmation of payment and limited card metadata (e.g. brand, last four digits, expiry) but never see or store full card numbers.
  • Usage and technical data — actions taken inside the platform (projects, pipelines, connections and runs you create) recorded in per-tenant audit logs, together with technical logs such as IP address, browser and device type, and timestamps, kept for security and troubleshooting.
  • Support and sales data — the content of messages you send us and any information you volunteer when requesting a demo or contacting us.
  • Anti-abuse data — signals from Cloudflare Turnstile used to distinguish humans from bots on the signup and login forms.

We collect this data directly from you. We do not buy personal data from data brokers and we do not build advertising profiles.

4. Purposes and legal bases

We only process personal data where the GDPR gives us a valid legal basis (Article 6):

  • Performance of a contract (Art. 6(1)(b)) — creating and administering your account, providing the platform, enforcing plan limits, processing payments, and providing support.
  • Legitimate interests (Art. 6(1)(f)) — securing and monitoring the platform, preventing fraud and abuse, maintaining audit logs, and improving and developing the product. We balance these interests against your rights and freedoms.
  • Consent (Art. 6(1)(a)) — sending optional product or marketing communications where you have opted in. You may withdraw consent at any time without affecting prior processing.
  • Legal obligation (Art. 6(1)(c)) — meeting accounting, tax and other statutory retention and reporting duties under Italian and EU law.

5. Sub-processors and data sharing

We do not sell personal data. We share it only with carefully selected sub-processors who help us run the service, each bound by a data-processing agreement and permitted to use the data only as we instruct. Our current sub-processors for the cloud service are:

  • Stripe — payment processing and subscription billing.
  • Resend — sending transactional email (verification, password reset, billing and account notices).
  • OpenRouter — routing requests to AI models for the assistant / generation features. Customers on self-hosted or sovereign deployments can point AI features at their own on-premise inference, so no prompt data leaves their infrastructure.
  • Cloud / VPS hosting provider — the underlying infrastructure that hosts the cloud platform and lakehouse.
  • Cloudflare — DNS, network security, and the Turnstile anti-abuse challenge on signup/login.

An up-to-date list, including each sub-processor's role, is maintained in Annex II of our DPA. We may also disclose data where required by law, to enforce our terms, or to protect the rights, safety and property of SpooqW, our customers or the public.

6. International transfers

We prioritise EU data residency. The cloud platform and lakehouse are hosted in the European Union, and self-hosted deployments keep data entirely on your own infrastructure. Some sub-processors (for example, Stripe and Cloudflare) may process limited data outside the European Economic Area. Where that happens, the transfer is protected by an appropriate safeguard under Chapter V GDPR — typically the European Commission's Standard Contractual Clauses (SCCs), supplemented by additional technical and organisational measures, or reliance on an adequacy decision. You can request more detail on a specific transfer at the contact address above.

7. Retention

  • Account data — kept while your account is active and deleted or anonymised within 90 days of account closure.
  • Billing and invoicing records — retained for the period required by Italian tax and accounting law (generally 10 years).
  • Security and audit logs — kept for up to 12 months, then deleted or aggregated.
  • Support correspondence — kept for as long as needed to handle your request and a reasonable period thereafter.
  • Customer (pipeline / lakehouse) data — retained for the duration of your subscription and returned or deleted on termination as set out in the DPA.

8. How we protect data

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including:

  • Encryption in transit via TLS for all connections to the platform.
  • Encryption at rest for sensitive secrets — connection credentials are encrypted with AES-256-GCM.
  • Passwords stored only as salted one-way hashes.
  • Strict tenant isolation and role-based access controls, with access limited to authorised personnel on a need-to-know basis.
  • Regular backups and recovery procedures.
  • Monitoring, audit logging and anti-abuse controls.

No system is perfectly secure, but we work continuously to protect your data and to detect and respond to incidents. If a personal data breach is likely to result in a risk to your rights, we will notify the competent supervisory authority and, where required, affected users without undue delay.

9. Your rights

Subject to the conditions in the GDPR, you have the right to:

  • Access the personal data we hold about you and obtain a copy.
  • Rectify inaccurate or incomplete data.
  • Erase your data ("right to be forgotten") where the legal conditions are met.
  • Restrict processing in certain circumstances.
  • Data portability — receive data you provided in a structured, commonly used, machine-readable format.
  • Object to processing based on our legitimate interests, and to withdraw consent at any time.

To exercise any of these rights, email asambataro@aretetecnologia.com. We will respond within one month, as required by the GDPR. Where the request concerns business data for which you are the controller, we will assist you as processor under the DPA.

You also have the right to lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali; you may also complain to the authority in your EU country of residence or workplace.

10. Children

SpooqW is a business tool and is not directed at children. The service is not intended for anyone under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Cookies

We use only strictly necessary cookies and local storage — no advertising or cross-site tracking. See our Cookie Policy for the full list and your controls.

12. Changes to this policy

We may update this policy from time to time. For material changes we will notify registered users by email and/or an in-product notice before they take effect, and we will always update the "Last updated" date and version above.

13. Contact

Aretè Tecnologia di Antonio Sambataro — Belpasso (CT) 95032, Italy — VAT IT05945010873.
Privacy contact: asambataro@aretetecnologia.com.