Privacy policy
Data controller
Stefano Rolando · Biella, Italia.
What we process
Account: email address and sign-in data; if you sign in with Google, also the name and profile picture Google shares with us. Searches: the text you type, the links you paste, the photos you upload and the results found. Payments: plan, payment status and Stripe identifiers; we never see your card details. Technical data: cookies, IP address in server logs and an operational activity log (time, outcome, errors, duration) that never contains the text, links or photos of your searches.
Why and on what legal basis
To provide the service you ask for: searches, history, account and subscription (contract, Art. 6(1)(b) GDPR). To keep the service secure, prevent abuse and fix faults (legitimate interest, Art. 6(1)(f)). To keep accounting and tax records (legal obligation, Art. 6(1)(c)). We do not sell data, show advertising or profile you for marketing.
Who receives the data
Only the providers needed to run the service, acting on our behalf: Cloudflare (hosting, image processing, Turnstile anti-bot check), Supabase (database, authentication and file storage in the EU, Ireland), SearchApi.io and, as a backup, SerpAPI (search in online stores and visual search: they receive the text of the search, the product data from a link or a copy of the photo), Stripe (payments) and Google (sign-in with Google, if you choose it, and, only where enabled, the Gemini AI models that recognise the product and look for offers: they receive the text of the search, the product data and, for photo searches, a copy of the photo, which on the paid service Google does not use to improve its products). Some of them are based in the United States: transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
Guest searches and operational job data: 7 days. Uploaded photos: accessible for 24 hours, and you can delete them at once. Account search history: until you delete the search or the account. Activity log: 90 days. Payment and accounting records: as long as tax law requires. Our providers' backups follow their own rolling retention.
Cookies
We use only technical cookies needed for the service: sign-in session, anonymous guest session (7 days), language and market preference, and Cloudflare Turnstile. No advertising or profiling cookies and no third-party tracking, so no consent banner is required.
Free trial and abuse prevention
Deleting or recreating an account does not renew the free trial. We keep a pseudonymous identifier derived from verified email addresses and a usage counter separately from search history, for 12 months after account deletion. Email changes do not reset this counter. These records contain no search content and expire automatically. They remain personal data; contact the operator to exercise your rights. Cloudflare Turnstile protects authentication against automated abuse.
Browser and network abuse prevention
When enabled, a signed HttpOnly security cookie recognizes this browser for up to 30 days without renewal. We use pseudonymous browser, verified-mailbox and exact network-address identifiers to assess repeated free-trial use. Admission records last 7 days, identifier-free aggregate counters 90 days, and operator exemptions at most 7 days. No raw IP, cookie, email or search content is stored in these admission records. They are pseudonymous personal data, separate from the 12-month email trial counter. Deleting an account removes exemptions; recent admission records expire on their original schedule. Existing backup retention applies.
Your rights
You can ask to access, correct, delete, restrict or port your data, and object to processing based on legitimate interest, by contacting us; we answer within one month. You can delete searches and your account yourself from the Account page. You also have the right to complain to a data protection authority, in Italy the Garante per la protezione dei dati personali (garanteprivacy.it).
Minors
WorthPeer is not intended for children under 14. Do not upload photos showing people, documents or other personal information.
Changes
Last updated: 15 October 2026. We will announce material changes on this page and, for account holders, by email.