Privacy policy

1. Data controller

The controller of your personal data is EDLU S.R.L.S., owner of the DREAO brand, Via Eutropio 19, 00136 Roma (RM), Italia, VAT number 16361711001. Contact: hello@dreao.com · PEC edlu@legalmail.it.

This policy explains what data we process on dreao.com, why, and what your rights are under the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Italian Privacy Code (Legislative Decree 196/2003).

2. Data we collect

• Orders: email address, full name, country, the works bought, amounts, payment method type (card, Apple Pay, Google Pay), the Stripe payment reference, and the date and time you accepted the terms and the withdrawal acknowledgement.
• Invoice details, only if you ask for an invoice: for private persons address, city, postal code, province and, for Italy, tax code (codice fiscale); for companies company name, VAT number, address and, for Italy, SDI code or PEC.
• Payment: card data are entered directly into Stripe's fields and processed by Stripe; we never see or store them. Stripe also receives your name and email with the payment.
• My Art account: email, a password stored only as a secure hash (if you choose one), saved billing details, and security data such as failed sign-in attempts and the one-time sign-in links we email you.
• Downloads: date and time of each download, a shortened IP address (the last part removed) and the browser family (e.g. Chrome, Safari), to protect the files from abuse.
• Newsletter, only if you subscribe: email, language, date of subscription and, if you leave, date of unsubscription.
• Messages you send us at hello@dreao.com.
• Browsing data: technical logs kept by our hosting provider, anonymous visit statistics without cookies (Vercel Web Analytics), and analytics and marketing cookies only with your consent (see the Cookie policy).

3. Why we use them and on what legal basis

• To sell and deliver the files, manage My Art, send order and account emails and provide support: performance of the contract (art. 6(1)(b) GDPR).
• To keep accounting and tax records and issue invoices: legal obligation (art. 6(1)(c) GDPR).
• To protect the site, the payments and the files from fraud and abuse, and to defend our rights: legitimate interest (art. 6(1)(f) GDPR).
• To send the newsletter, and to use analytics and marketing cookies: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time.

The data needed for an order are required: without them we cannot complete the sale. Invoice details are only needed if you ask for an invoice. We do not make decisions about you based solely on automated processing; Stripe may run automated fraud checks on payments.

4. Who processes the data for us

We use trusted providers who act as processors under a data processing agreement, or as independent controllers where stated:

• Stripe (Stripe Payments Europe Ltd., Ireland): payments. Stripe is an independent controller for its own fraud-prevention and legal duties.
• Vercel Inc.: website hosting, on servers in Frankfurt, Germany.
• Neon: database, hosted in Frankfurt, Germany.
• Cloudflare, Inc.: domain and DNS, storage of the image files (R2) and routing of email sent to hello@dreao.com.
• Resend: sending of order and account emails, from the EU region (Ireland).
• Google: mailbox where messages sent to hello@dreao.com are received; Google Analytics and Google Tag Manager, only with your consent. Stripe's payment fields load a font from Google Fonts on the checkout page.
• Meta Platforms Ireland Ltd.: Meta Pixel for ad measurement, only with your consent. For the data collected through the pixel, Meta and we are joint controllers within the limits set by Meta's terms.

Our accountant and tax advisers receive order and invoice data when needed for our tax obligations. We do not sell your data.

5. Transfers outside the EU

Some providers (Stripe, Vercel, Neon, Cloudflare, Resend, Google, Meta) are, or belong to, groups based in the United States, so data may be accessed from there. These transfers rely on the EU-U.S. Data Privacy Framework, where the provider is certified, and on the European Commission's Standard Contractual Clauses (art. 45 and 46 GDPR). You can ask us for a copy of the safeguards.

6. How long we keep data

• Orders, invoices and accounting records: 10 years, as required by Italian law (art. 2220 of the Civil Code).
• My Art account and saved billing details: until you ask us to delete them. You can remove saved billing details yourself in My Art.
• Download records: for as long as we keep the related order.
• Sign-in, confirmation and reset links: they expire between 15 minutes and 7 days.
• Newsletter: until you unsubscribe.
• Support messages: for as long as needed to handle your request and any related claim.
• Cookies: see the Cookie policy.

When you ask for erasure, we delete or anonymise your personal data, but we keep the order records that tax law requires.

7. Your rights

You can ask us to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format (articles 15–22 GDPR). Where processing is based on consent, you can withdraw it at any time, without affecting what was done before.

To exercise your rights, write to hello@dreao.com. We answer within one month.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the EU country where you live or work.

8. Security and minors

The site uses encrypted connections, private storage for the files, signed download links, hashed passwords and limits on sign-in attempts.

The site is not meant for children under 14, and we do not knowingly collect their data.

9. Changes

We may update this policy. The date at the top shows the latest version.