Privacy notice
Last updated: 17 October 2026
Corda Rossa is an adult ads and dating site. We process little data, protect it with encryption and don't sell it to anyone. Here you'll find what we collect, why, for how long and what your rights are (arts. 13 and 14 of Regulation (EU) 2016/679, “GDPR”).
1. Data controller
Shack S.r.l. a Socio Unico
C.da Oliva snc, 97014 Ispica (RG)
VAT no. 05391181210
Email:info@cordarossa.it
No data protection officer (DPO) has been appointed.
2. What data we process
- Account: email address (stored encrypted, never visible to others), password (only in non-reversible form, Argon2id), nickname, date of birth (used to verify you're an adult: we keep only month and year), consents with date and time.
- Google login, if you choose it: we receive from Google only your email address and an account identifier; your name and photo are not read.
- Profile (optional): who you are and what you're looking for, region and province, description, photos.
- Content: ads, stories, photos and albums, contacts you decide to share, chat messages and photos. Contacts, messages and photos are stored encrypted.
- Stories: the star ratings you give and the series you decide to follow (to notify you of new chapters). To count only one read per day, we remember for 24 hours who has already opened a story; who reads what is never shown to anyone.
- Location, only if you use “Near me”: we read it from your phone when you press the button, move it to the centre of its square of about 2 km and discard the exact point. Others see only a distance band (for example “3–5 km”).
- Public board, only if you choose it for an ad: title, text, category and province become visible to everyone and to search engines; nickname, age, photos and contacts remain private.
- Relationships: friendships, blocks, album access requests.
- Reports and moderation: the reports you make or receive, decisions and appeals; the outcome of automated checks on ads, stories, descriptions and photos. If you report a chat message, we keep an encrypted copy of it together with the report: it's the only part of the conversation the moderator sees.
- Accounts closed for violations: to prevent people who have been excluded from signing up again, we keep an encrypted (non-reversible) fingerprint of their email address and Google account.
- Web server logs: like any site, the server records for 14 days the IP address, page requested, date and time and browser type of each visit, for security and to diagnose faults. These logs are not used for statistics or matched with accounts.
- Technical data: IP address and device type in security events (logins, password changes, reports), stored encrypted; technical cookies (see the cookie page).
- Two-step verification, if you turn it on: the app secret is encrypted, and recovery codes are stored only as a fingerprint.
Special categories of data. Your profile, ads, albums and messages may reveal your sex life or sexual orientation (art. 9 GDPR). We process them only because you enter them, with the explicit consent you give when signing up.
3. Why we process them and on what basis
| Purpose | Legal basis |
|---|---|
| Providing the service: account, ads, stories, albums, chat, notifications, account emails | Contract (art. 6.1.b) |
| Data concerning sex life and sexual orientation | Explicit consent (art. 9.2.a), withdrawable by deleting the content or the account |
| Checking content before publication, reports, protection of minors, prevention of scams and paid services | Legitimate interest (art. 6.1.f) and obligations under Regulation (EU) 2022/2065 “DSA” (art. 6.1.c) |
| Security of accounts and the service (security events, limits on attempts, checking that your password isn't among stolen ones) | Legitimate interest (art. 6.1.f) |
| “Near me”: showing you nearby members and showing you to them | Explicit consent (arts. 6.1.a and 9.2.a), withdrawable with “Hide me” |
| Ad on the public board | Explicit consent (arts. 6.1.a and 9.2.a), withdrawable by unticking the box or deleting the ad |
| Preventing new sign-ups by people excluded for violations | Legitimate interest (art. 6.1.f): protecting other members |
| Anonymous visit statistics | Legitimate interest (art. 6.1.f) |
| Requests from authorities and other legal obligations | Legal obligation (art. 6.1.c) |
We don't use your data for advertising, we don't pass it on to third parties and we don't do any profiling.
4. Automated checks and decisions
Ads, stories, profile descriptions and photos go through an automated check using artificial intelligence before they're published: it can approve them, reject them while explaining why, or pass them to a person. A possible minor leads to immediate suspension of the account pending a check; three rejections in 30 days for requests for payment lead to suspension. You can always ask for a person to review the decision, express your point of view and appeal it from the Decisions page (art. 22 GDPR). How it works in detail: Artificial intelligence page. Chat messages and photos are never checked: the moderator sees only the individual message you report to us.
5. Who we entrust data to
- IONOS SE (Germany): servers (data centre in Spain, database copy in Germany) and email, as processor (art. 28).
- Google, paid Gemini API service: receives the text of ads and descriptions and the photos to be checked, as processor. It doesn't use them to improve its products; it keeps them for 55 days solely to detect abuse of its policies and, in those cases, they may be examined by authorised Google staff.
- Google, Google login: if you choose it, Google processes your login as an independent controller, according to its own privacy notice.
- Have I Been Pwned: when you choose a password we send only the first 5 characters of its fingerprint (not the password, not your email address) to find out whether it's among stolen ones.
- Authorities: only where required by law, for example in the case of content involving minors.
6. Transfers outside the European Union
Our servers are in the European Union. The automated check with Google Gemini may involve processing in the United States, with GDPR safeguards: the “EU-US Data Privacy Framework” adequacy decision and the European Commission's standard contractual clauses.
7. For how long
| Data | Retention |
|---|---|
| Account, profile, albums, contacts | For as long as you have the account. Accounts inactive for 12 months are deleted, with an email warning about a month beforehand. |
| Ads | Published for 30 days, renewable; after that they remain visible only to you until you delete them or delete your account. |
| Chat messages | For as long as the conversation or account exists; conversations with no messages for 12 months are deleted automatically, together with their photos. |
| Stories, ratings and followed series | For as long as you keep them or have the account. |
| Story reads | 24 hours (only to count them once a day). |
| Approximate “Near me” location | 24 hours, or until you press “Hide me”. |
| Copy of a reported message | Same as the report (see below). |
| Fingerprints of email addresses and Google accounts of excluded accounts | 5 years from closure. |
| Notifications | 90 days. |
| Security events (with encrypted IP) | 12 months. |
| Web server logs | 14 days. |
| Outcomes of automated checks | 12 months. |
| Reports and decisions | As long as necessary to handle them and allow appeals (at least 6 months, as required by the DSA) and to respond to the authorities. |
| Login sessions | 30 days at most, 14 days without using the site. |
| Visit statistics | Only aggregated, anonymous data, without IP addresses. |
When you delete your account, we immediately delete your data and your files. The server's backups contain the data already encrypted and are overwritten on rotation.
If one of your ads was on the public board, after deletion a copy may remain for some time in the memory of search engines, which they manage themselves: you can also ask them to remove it (for Google, with the outdated content removal tool).
8. How we protect data
Always-encrypted connections (HTTPS); email addresses, contacts, messages and photos encrypted in the database and on disk; passwords with Argon2id; optional two-step verification (mandatory for moderators and administrators); no tracking tools and no resources loaded from external sites.
9. Your rights
You can request access to your data, rectification, erasure, restriction and portability, object to processing based on legitimate interest and withdraw your consent at any time (arts. 15–22 GDPR). You can do many things yourself from the Account page: download all your data in a file, edit it, delete your account. For anything else, write to the controller (section 1). You have the right to lodge a complaint with the Garante per la protezione dei dati personali, the Italian data protection authority (www.garanteprivacy.it).
10. Minors
The site is for adults only. If we discover that an account belongs to a minor, we close it and delete their data, except for what must be kept for the authorities.
11. Visit statistics
We count page views without cookies and without storing your IP address: to estimate unique visitors we use a fingerprint that changes every day and cannot be traced back to you. From the IP address and browser we derive only country, region and device type, then discard them.
12. Changes
If we change this notice, we update the date at the top; for important changes we'll let you know on the site or by email.