Privacy Policy

Data actually used

Accounts use email, a generated username, a WordPress password hash, verification and membership status, single-use token hashes and a post-login return preference. Othalon does not store plain-text passwords.

When signed in, Favorites, My Devices, Recently Viewed, Saved Comparisons and Repair Checks are stored against the internal user ID. Repair checks include the device, issue, entered repair quote and replacement cost, decision inputs, derived results and timestamp.

The chosen language is held in a first-party cookie after selection; a Pro plan display preference is held in browser localStorage. Login and abuse-control counters use short-lived hashed email/IP-derived transient keys. Raw IP addresses may also appear in hosting or WordPress access logs; that configuration is not yet verified.

Contact form data is emailed to the configured WordPress administrator mailbox for a reply and is not saved in an Othalon contact database. Mailbox and delivery-provider retention must be verified. No analytics, advertising or marketing service is installed by this plugin; other active plugins and hosting remain to be audited.

Purposes and lawful bases

Account and saved-service processing is proposed under performance of the service agreement or pre-contractual steps. Security and abuse prevention are proposed under legitimate interests, subject to a documented balancing assessment. Replying to a support request is proposed as necessary to address that request. The controller must confirm these bases before launch; consent is not used as a blanket basis.

Retention and deletion

Saved items remain in the active Othalon database until the account owner removes them or deletes the account. Verification links expire after 24 hours and reset links after 45 minutes; used and expired token rows are scheduled for daily cleanup. Hosting backups, security logs and contact email periods remain unresolved and must be set before launch.

Your rights

You may request access, correction, deletion, restriction, portability or object when applicable. You may withdraw a non-essential tracking consent if such tracking is introduced. Download your Othalon data or initiate account deletion in My Othalon; for requests not handled there, use the privacy contact above. You may complain to your competent supervisory authority, including the Italian Garante where applicable.

Billing is not active

No payment provider, checkout or active paid subscription exists in this phase. The database is prepared for future subscription identifiers but no card data is stored. Before paid Pro launches, this notice must identify the real provider, fields, recipients, retention and any transfers.

Purpose / legal basis / retention matrix

The basis assignments marked for review are proposals, not claims of a completed controller assessment.