TRAYSPrivacy Policy
Last updated · July 24, 2026
This privacy notice is provided pursuant to Articles 13 and 14 of EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the “Italian Privacy Code”), to describe how personal data of visitors to the trays.spacewebsite (the “Site”) is processed. It covers the website only — the TRAYSmacOS application is governed by its own Terms, accepted when you download the beta.
1. Data Controller
PINKY BRAINS S.r.l.
Registered office: Via Vicinale per Soleto, 73020 Cutrofiano (LE), Italy
Italian Tax ID / VAT: 05464010759
REA (Italian Business Register): LE-368923
Email: info@pinkybrains.com
A Data Protection Officer (DPO) has not been appointed, as the processing does not fall within the cases provided for by Article 37 GDPR. For any privacy request write to info@pinkybrains.com.
2. What data we collect
- Waitlist sign-up — the email address you enter, the fact that you gave consent, an approximate sign-up source (referrer or UTM parameters, no cookies), and the timestamp.
- Purchases / checkout — when you buy a plan, your name, email, billing details and payment data are collected and processed directly by Stripe in its embedded checkout. We do not receive or store your full card number; we receive the outcome, a customer/subscription identifier and billing email needed to issue your licence and invoice.
- Navigation data — necessary to serve the Site: IP address, browser type and version, operating system, pages viewed, date/time, referrer.
- Local storage (technical) — small values kept in your browser (cookie preference, launch/waitlist display state, and a marker if you already joined the waitlist). Details in the Cookie Policy.
The Site does not collect special categories of data (Art. 9 GDPR) or criminal-conviction data (Art. 10 GDPR), and performs no automated decision-making or profiling.
3. Purposes and legal basis
| # | Purpose | Legal basis (Art. 6 GDPR) |
|---|---|---|
| 1 | Register you on the waitlist and email you launch updates | Consent (Art. 6.1.a) |
| 2 | Process purchases/subscriptions and issue your licence | Performance of a contract (Art. 6.1.b) |
| 3 | Deliver and secure the Site (rendering, fraud/abuse prevention) | Legitimate interest (Art. 6.1.f) |
| 4 | Comply with legal obligations (invoicing, accounting) | Legal obligation (Art. 6.1.c) |
| 5 | Establish or defend a legal claim | Legitimate interest (Art. 6.1.f) |
Providing your waitlist email is optional; without it we simply cannot notify you at launch. You can withdraw consent at any time (see §8) — for example by asking us to remove you from the waitlist.
4. Recipients and processors
Data may be processed by the following third parties acting asdata processors under Art. 28 GDPR, under a Data Processing Agreement:
| Supplier | Service | Data | Location |
|---|---|---|---|
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payment processing & checkout | Name, email, billing & payment data | EU (Ireland) / USA |
| Contabo GmbH | Website & database hosting (server) | Navigation data, IP; waitlist (email, consent, source, timestamp) | Germany (EU) |
Data is never sold, rented or shared with third parties for their own marketing. Launch update emails, when sent, are delivered by us from our own mail server (self-hosted SMTP) — no third-party email provider — only to people who joined the waitlist.
5. Transfers outside the EU
Some suppliers (e.g. Stripe, Inc.) are based in or have parent entities in the United States. Such transfers rely on theEU-US Data Privacy Framework (adequacy decision (EU) 2023/1795 of 10 July 2023) where the supplier is certified, and otherwise on theStandard Contractual Clauses approved by Decision (EU) 2021/914.
6. Retention periods
| Data type | Retention |
|---|---|
| Waitlist email & consent | Until launch + 12 months, or until you withdraw consent / ask to be removed, whichever comes first |
| Customer, billing & invoicing data | 10 years (Art. 2220 Italian Civil Code — accounting records) |
| System logs (IP, user-agent) | Maximum 30 days, save requests from Authorities |
At the end of the retention period, data is irreversibly deleted or anonymized.
7. Cookies
The Site uses technical / strictly-necessary storage (plus Stripe’s functional cookies during checkout) and, only with your consent, our own first-party, cookieless analytics (no third parties; IP not stored). Full details are in the Cookie Policy, and you can review or withdraw your choice via “Cookie settings” in the footer.
8. Your rights
Under Articles 15-22 GDPR you may at any time:
- Access (Art. 15) — obtain confirmation and a copy of your data.
- Rectification (Art. 16) — correct inaccurate or incomplete data.
- Erasure (Art. 17) — have your data deleted in the cases provided.
- Restriction (Art. 18) — restrict processing in specific cases.
- Portability (Art. 20) — receive your data in a structured, common format.
- Object (Art. 21) — object to processing based on legitimate interest.
- Withdraw consent (Art. 7.3) — at any time, without affecting prior lawful processing.
To exercise any right, write to info@pinkybrains.com. We reply within 30 days, extendable up to 90 days in complex cases (Art. 12.3 GDPR).
9. Complaint to the Supervisory Authority
If you believe the processing infringes the GDPR you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): Piazza Venezia 11, 00187 Rome —garanteprivacy.it —protocollo@gpdp.it.
10. Governing law
This notice is governed by Italian law and the GDPR. The competent forum is theCourt of Lecce (Italy), without prejudice to any mandatory consumer-protection venue.
11. Changes
We may update this notice for legal, organizational or technical reasons. The version in force is always the one published here, with its “last updated” date; material changes will be highlighted on the Site.
12. Contact
PINKY BRAINS S.r.l.
Email: info@pinkybrains.com
Address: Via Vicinale per Soleto, 73020 Cutrofiano (LE), Italy