What we collect, and why.

Who processes the data

The data controller is Jugaad s.r.l. — registered office at Via Generale Luigi Reverberi 30/A, 42027 Montecchio Emilia (RE), Italy; operating office at Via Enrico Berlinguer 5, 42049 Sant'Ilario d'Enza (RE). VAT IT02905570350. For anything about this page write to keelops@jugaad.it: a person answers.

Which data, and only that

If you subscribe to the updates we collect your email address, the language of the page you wrote it from, and the date of the request and of the confirmation. Nothing else: we do not ask for your name, company or phone number, and we do not want them. Server logs keep the IP address of requests for a few days, as any web server does, to stop abuse.

Why

For one reason only: to tell you when the KeelOps code is published on GitHub and to point out essential technical releases. At most one message a month, and in practice far fewer. No offers, no invitations, no «have you seen our new article».

The legal basis is your consent (art. 6.1.a GDPR), which you give by clicking the confirmation link in the message we send: until you click it, your address joins no list. You can withdraw it whenever you like, and withdrawing has no consequences.

Cookies

Technical cookies make the site and the demo work, and by law they do not need your consent (art. 122 of the Italian Privacy Code): they are ours, they measure nothing and they leave your browser only to let you use the service. They are the language you pick by hand, your cookie choice — one cookie for both keelops.it and demo.keelops.it, so we do not ask again on every visit or when you move from one to the other — and, in the demo, the session cookie that keeps you signed in (without it you could not log in at all) and, if you ask for it, the one that keeps you signed in between visits.

Then there are two things that only start if you say yes, and that you can accept separately:

• Statistics — Google Analytics 4, on the site and in the demo. On the site: how many people come by, where from, which pages they read. In the demo: which features get opened and used — the page opened, with record identifiers stripped (we see «a project», never which one), and the operations called with their outcome and duration, together with the role of the demo user you signed in as. It tells us what interests people and what does not work. We do not collect content: no titles, names, texts or data you see or write in the demo, no email; the operations are reported to Google by our server, without your IP address.
• Advertising — Google Ads: it lets us measure campaigns and show a KeelOps ad again to someone who has already been here. It is the only purpose that follows you off this site, which is why we keep it separate from statistics.

To be precise, because this is the difference that matters: statistics cookies are not technical cookies and are not anonymous in the strict sense. Google gives your browser a random identifier (the _ga cookie, valid for keelops.it and for the demo) so it can tell that two pages belong to the same visit. It does not contain your name and does not identify you on its own — the data is pseudonymous, and we only read it in aggregate: numbers, not people — but it is precisely because there is an identifier that they only start with your consent. Google truncates the IP address, Google signals and ad personalisation stay off unless you also accept advertising, and the data stays in Analytics for the period set in our property, 14 months at most.

Until you choose, nothing loads: it is not the banner switching them off afterwards, it is the site not switching them on before (technically, Google's Consent Mode starts with everything denied). If you decline, they never load. There is one choice for the site and the demo: you make it in one and it applies in the other. If you change your mind — from «Manage cookies» at the bottom of this page, or from the demo's sign-in page — they stop at the next page load, and Google's cookies are deleted.

They are third-party cookies: Google writes them, not us. Collection and the IP lookup happen on European servers, and the IP is discarded before being logged; the processing, however, happens on Google's servers outside the European Union, and for Analytics and Ads there is no setting that keeps it in Europe. The transfer rests on the EU-U.S. Data Privacy Framework adequacy decision and, where that does not reach, on the standard contractual clauses. The controllers are Google Ireland Ltd. for the European Economic Area and Google LLC for the United States; Google sets the terms and the retention periods: policies.google.com/technologies/cookies. You can turn Analytics off for every site with Google's browser add-on.

We record your choice — it is an obligation, and it is what lets us prove it — whether you make it here or in the demo. Of the moment you accept, decline, choose in part or change your mind we keep: the date and time, what you chose (statistics yes/no, advertising yes/no), the version of this page you were shown, the language, the page you chose from, the kind of browser, and the truncated network address (the first three numbers for IPv4: it says «from here», not «you»). No name, no email address. There is also a random identifier, which lives in your browser and only serves to link a change of mind to the earlier choice. Alongside it we keep the fingerprint (a SHA-256 hash) of the choice exactly as it is saved in your browser: it serves to recognise, should it ever be needed, that the row in the register is really yours. The register is never erased or rewritten: withdrawing adds a row, it does not remove one — removing it would destroy the very proof we are required to keep.

Who else sees them

To send the messages we rely on Twilio SendGrid, which delivers them on our behalf (data processor; transfer outside the Union covered by the standard contractual clauses). If you consent to statistics or advertising, browsing data also reaches Google (Google Ireland Ltd. and Google LLC), as explained above. Nobody else. Your email address is never sold, given away or traded with anyone, for any reason, and it never reaches Google.

How long we keep them

A confirmed address stays until you unsubscribe: when you do, the row is deleted, not set aside. A request that is never confirmed expires and is deleted after seven days, on its own.

Where they live

The list is a file on our own servers, in Italy. There is no mailing-list provider in the middle: it is the same idea as the product — the data stays home.

Your rights

You can ask to see, correct, delete or receive your data, restrict or object to the processing, and withdraw your consent (arts. 15-22 GDPR). The quickest way is the «Unsubscribe» link at the bottom of every message: one click and you are out. Otherwise write to keelops@jugaad.it. If you think something is wrong you can complain to the Italian Data Protection Authority or to the one in your country.

If it changes

If this notice changes in a way that concerns you, we will say so in one of the messages you agreed to receive. Last updated: 18 September 2026.