Privacy Policy

Last updated 5 September 2026

The short version. We do not store what your users type. Address queries are answered from memory and never written to disk. What we keep is your account details and a per-request metering record in which the IP address and the session identifier are hashed, not stored in the clear.

1. Who is responsible

ParvaSoft S.p.A.
Via XX Settembre 33/10, 16121 Genova (GE), Italy
VAT / Codice fiscale 02985080999 · REA GE-524956
info@parvasoft.eu

Two different roles apply, and they are worth keeping apart:

For your account — your email address, your keys, your usage and billing records — we are the data controller.
For the lookups your end users make through your integration, we act as a processor on your instructions. You are the controller for that processing and are responsible for telling your own users about it. A data processing agreement is available on request.

2. What we collect, and why

Your account (we are controller)

Data	Why	Legal basis
Email address	To identify your account, send password resets and service notices	Performance of the contract
Password, stored only as an scrypt hash	To sign you in. We never hold your password in a recoverable form	Performance of the contract
API keys and their restrictions	To authenticate and scope your requests	Performance of the contract
Sign-in session records: IP address and browser user agent	To keep you signed in, show you your active sessions, and let you revoke them	Legitimate interest in account security
Administrative audit records: who did what, when, from which IP	To investigate misuse and to make administrative access to an account accountable	Legitimate interest in security and accountability
Billing records	To invoice you and to meet tax obligations	Contract and legal obligation

API requests (we are processor)

For each API request we record a metering row containing: the account and key used, a timestamp, which endpoint was called, response latency, how many results were returned, whether the result was empty, the country the request was scoped to, a hashed session identifier and a hashed IP address.

We use it to meter and bill your usage, to show you your own analytics, to detect abuse, and to find and fix quality problems such as queries that return nothing.

What is not in that list: the text of the query. What your user typed is used to compute the answer and is then gone. It is not written to a database, and the application writes no request log. The IP address is stored only as a hash, so a metering row cannot be read back to a person or a device.

3. Cookies and local storage

We use no analytics, no advertising and no third-party tracking of any kind. There is nothing here to consent to, so we do not ask you to dismiss a banner. For completeness, this is everything this site stores in your browser:

One third party, and only if you ask for it. If you click the coordinates on a record in the demo on our home page, we show the location using a map embedded from OpenStreetMap, which means your browser requests that map from openstreetmap.org and they will see your IP address. Nothing is loaded from them until you click, and closing the map stops it again. No other page on this site requests anything from anyone but us.

Name	Type	Purpose
`places_session`	Cookie	Keeps you signed in. Set only after you sign in, and cleared when you sign out.
`places_csrf`	Cookie	Protects the sign-in, registration and password forms against cross-site request forgery.
`wayfindnow.counter.v1`	Local storage	Remembers how far the counter on the home page had advanced, so it does not restart on every visit.
`wayfindnow.intro-seen.v1`	Session storage	Remembers that you have already seen the opening animation, so it plays once per visit.

The two cookies are strictly necessary for a service you asked for, and the two storage entries hold no identifier and are never sent to us. None of them requires consent under the ePrivacy Directive or the GDPR.

We do not sell personal data and we do not share it for anyone else's marketing. We use a small number of service providers acting on our instructions:

Hosting. Our servers and database are located in Germany, within the EU.
Email delivery, for password resets and service notices.

We also disclose data where the law requires it, or to establish or defend legal claims.

5. Where the data is

Personal data is processed on servers in Germany, inside the European Economic Area. Where a provider processes data outside the EEA, we rely on the European Commission's standard contractual clauses.

6. How long we keep it

Account data is kept while your account is open.
Usage and metering records are kept while your account is open, so that you and we can see your history. They contain no query text and no readable IP.
Billing records are kept for as long as tax law requires, which in Italy is normally ten years.
When you close your account we delete your account data and keys. Ask us and we will confirm when it is done.

7. Your rights

Under the GDPR you may ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or provide it in a portable form. Where we rely on legitimate interests you may object, and we will stop unless we have compelling grounds not to. Write to info@parvasoft.eu and we will answer within one month.

If you think we have got it wrong you may complain to your local supervisory authority. In Italy that is the Garante per la protezione dei dati personali.

8. Security

Passwords are stored as scrypt hashes, never as recoverable text.
Changing your password revokes every other signed-in session.
IP addresses and session identifiers in metering records are hashed.
Administrative access to an account is time-boxed, read-only and recorded in an audit log visible to us and to the account.

9. Children

The Service is a developer tool sold to businesses. It is not directed at children and we do not knowingly collect their data.

10. Changes

We will update this policy when what we do changes. The date at the top changes with it, and we will email account holders about anything significant.

11. Contact