Skip to content

Privacy Policy

Last updated: November 1, 2026

This Privacy Policy explains how Alacam IT (“we”, “us”), a sole proprietorship operating alacam.it and the PrintPilot desktop application, handles personal data. We designed our products to keep the amount of personal data we process to the minimum necessary to deliver the service and comply with EU GDPR and comparable US state privacy laws.

1. Data controller & contact

Alacam IT — sole proprietorship. Questions, access, deletion, or GDPR/CCPA requests: contact@alacam.it.

2. What we collect

  • Account data: email address, and — if you sign in with Google — your Google account email, name and profile picture URL provided by Google.
  • License data: your active plan, license key, subscription period, and monthly usage counter (number of print jobs sent). We do *not* keep a per-document history.
  • Device data: a hashed device identifier (SHA-256) for each machine you install PrintPilot on, used to enforce the one-trial-per-computer rule and the per-plan device limit.
  • App-health & setup telemetry: PrintPilot automatically sends us app-health and diagnostic data keyed to your hashed device ID — for example counts of successful/failed print jobs, installation-progress milestones, and (when a setup step fails or an error occurs) a short report that can include your account email, Windows/app version, and relevant log excerpts (passwords, tokens, and most file paths are removed before sending). This is on by default and cannot be turned off on Free or Trial plans; paid plans can disable it in PrintPilot's settings. A separate, shorter-lived “first-time setup” telemetry (which screen or button you used while getting started) can be turned off by anyone on any plan and stops automatically after your fifth successful send.
  • Diagnostic reports you send: if you press “Send setup report,” or attach your recent logs when submitting the Feedback form, inside PrintPilot, that report (and, if you chose to attach them, your last 7 days of logs) is emailed to us at that moment.
  • AI usage data (only if you use the optional AI feature, see section 6): request ID, hashed device ID, page count, provider, model, token counts and status. No document text.

3. Google sign-in and Google API data

When you choose “Sign in with Google” in PrintPilot or on alacam.it, we request basic OAuth scopes (openid, email, profile) to authenticate you and create your account. Additionally, if you enable PrintPilot's automated email sending feature via Gmail, the desktop application requests the restricted Google OAuth scope https://www.googleapis.com/auth/gmail.send (gmail.send) solely to transmit printed PDF documents as email attachments directly from your own Gmail account without storing email message contents or inbox data on our servers. Alacam IT's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, do not use it for advertising, and do not allow humans to read it except with your explicit consent, for security investigations, or where required by law.

4. Google Workspace APIs Limited Use Disclosure

PrintPilot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  • We do not use, transfer, or sell Google user data (including raw, aggregated, or derived data) to create, train, or improve any foundational or generalized machine learning or artificial intelligence (AI/ML) models.
  • We do not share, transfer, or disclose Google user data to any third-party services.
  • PrintPilot operates as a local Windows service. All document processing, rule evaluation, and queue management happen entirely locally on the user's machine. Document contents and email recipient data are never transmitted to our cloud servers. Exception: if you use the optional AI feature (section 6), the document text passes through our server to an AI provider without being stored; no Google user data is sent.

5. What we do NOT collect

  • We do not upload, read or store the contents of the documents you print. Exception: if you use the optional AI feature (section 6), the text passes through our server to an AI provider but is not stored by us.
  • We do not store the recipient email addresses you configure inside PrintPilot.
  • We do not track your Google Drive, Gmail, Contacts, or any other Google service.

6. Optional AI email drafts (paid plans)

PrintPilot offers an optional AI feature that suggests a recipient, subject and message for a printed document. It is off by default, available only on paid plans, and runs only after you have given your consent and start an analysis.

When you use it, the content of your document leaves your computer and is processed by third-party AI providers. PrintPilot extracts the text on your computer (using local OCR only for pages without readable text) and sends it via alacam.it, without storing it, to the Lovable AI gateway, which forwards it to an AI model provider (currently Google Gemini). Older PrintPilot versions may send page images instead of text.

  • We do not store the document text or the AI suggestion. We keep only the usage data needed to count your AI pages: request ID, account, hashed device ID, page count, provider, model, token counts and status.
  • The AI providers process the text under their own terms and may retain requests for a limited time, for example for abuse monitoring. Do not use the feature for documents you are not allowed to share with such providers.
  • The AI only suggests a draft. It never sends an email by itself; you check and send it.
  • If you do not use the feature, no document content is sent to any AI provider.

7. How we use the data

  • Provide the service: authenticate you, issue and validate license keys.
  • Enforce plan limits (device count, monthly email quota, free trial per machine).
  • Send transactional emails (sign-up confirmation, password reset, receipts).
  • Check that our account emails arrive: our email provider Amazon SES tells us whether an email was delivered, bounced, opened or a link in it was clicked. We use this only to fix delivery problems and improve these emails, and we do not combine it with advertising. Tips and reminders can be turned off with the unsubscribe link in each of them.
  • Respond to your support requests.

8. Legal basis (GDPR)

Performance of the contract with you (Art. 6(1)(b)) for account, license and usage data; our legitimate interest (Art. 6(1)(f)) in preventing abuse for the device hash and email blocklist, and in diagnosing failures and improving reliability for the automatic app-health and setup telemetry described in section 2 (you may opt out on paid plans); and your consent (Art. 6(1)(a)) for the reports you send yourself and for optional setup diagnostic emails. For the optional AI feature, the legal basis is your consent (Art. 6(1)(a)); you can withdraw it at any time by turning the feature off.

9. Sub-processors

We use a small set of trusted vendors under Data Processing Agreements:

  • Lovable Cloud / Supabase — hosting, authentication, database (EU region).
  • Resend — transactional email delivery.
  • Amazon Web Services (Amazon SES) — delivery of account emails (EU region).
  • Paddle — payment processing and merchant-of-record for EU/US sales tax.
  • Google LLC — only when you actively use Google sign-in.
  • Lovable AI gateway and the AI model provider it uses (currently Google) — only when you use the optional AI feature.

10. Retention

Account and license records are kept for as long as your account is active. If you delete your account, the record is marked as deleted and permanently erased no later than two (2) years afterwards. If an administrator hard-deletes the account, all associated data is removed immediately.

11. Your rights

You have the right to access, rectify, delete, restrict or export your personal data, and to object to processing. EU users may lodge a complaint with their national supervisory authority. California residents have equivalent rights under the CCPA/CPRA. To exercise any right, email contact@alacam.it. You can also delete your account at any time from your Alacam IT dashboard.

12. Security

Data is transmitted over TLS and stored in an EU-hosted managed Postgres database with Row-Level Security. Passwords are hashed by our identity provider. Device identifiers are only stored as SHA-256 hashes.

13. International transfers

Where personal data is transferred outside the EEA (for example to Google in the United States), we rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

14. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the latest version. Material changes will be communicated by email to registered users.

Optional website analytics

With your analytics consent, we store a temporary session ID in sessionStorage. It expires after 30 minutes of inactivity. We record the approximate country, browser language, displayed content language and its selection source, public page category, language changes and PrintPilot download-link clicks. We do not store raw IP addresses, email addresses, account IDs or URL query strings in these records. Our existing nightly maintenance removes records older than 90 days when it runs. Withdrawal in Consent Preferences stops new collection and removes the session ID. Google tags are managed separately through the same consent preferences.