Controller and contact details
The controller for diskivo.app, the licence service and Diskivo support is Worksdem S.R.L., VAT number IT06072590877, with its registered office at Via Concordia, 124, 95018 Riposto (CT), Italia and operating office at Via Agostino da Montefeltro, 2, 10134 Torino (TO), Italia. For personal data requests and to exercise your rights, write to help@worksdem.com.
Analysis on your Mac
Analysis of files, caches, applications, duplicates, images, browsers and Trash takes place on your Mac. Diskivo does not send Worksdem file contents, paths, browser history or scan results. The app’s activity history stays local.
macOS permissions serve the features you select. The location request used to display Wi-Fi network information is handled on the device: coordinates are not transmitted to the licence service. Operations on iCloud files may involve Apple services associated with your account.
Trial, licence and device data
To start a trial, activate or check a licence, we process its code and status, plan, expiry dates, seat allowance, a hashed installation identifier, Mac name, and macOS and app versions. The Mac name may contain your name if you chose it that way. The hash is a pseudonymous identifier, not anonymous data.
We need this data to provide the features requested and manage plan limits, based on pre-contractual steps or performance of a contract under GDPR Article 6(1)(b). Without required data, we cannot activate or verify Pro; you can still use the available free local features.
Purchases and Stripe
To prepare a purchase, we collect email, name if provided, plan, quantity and language. Stripe sends customer and payment references, amounts, currency, taxes, billing address, any tax identifiers and purchase, subscription and refund status. We use these for licences, orders and accounting and tax obligations under GDPR Articles 6(1)(b) and (c). Stripe/Link handles receipts, transaction tax documents and payment support for Managed purchases. Worksdem retains its own accounting and tax obligations.
Stripe processes the data needed for payments and tax calculations under the applicable agreements and its privacy policy; for some activities, such as fraud prevention and regulatory obligations, it acts as an independent controller. Worksdem does not receive your full card number or security code. Requests about Stripe’s independent processing can be addressed directly to Stripe.
Support and licence recovery
We process your email address and the details you enter in a support request, including topic, message, and app or macOS versions if supplied. The form does not accept attachments. Avoid unnecessary personal data, licence codes, file paths and scan contents. For recovery, we use email to verify the licence and send a temporary link.
The legal basis is answering pre-contractual requests or performing our relationship under GDPR Article 6(1)(b); for other communications, it is our legitimate interest in responding under Article 6(1)(f). Resend processes the addresses and content needed to send emails on our behalf. These forms do not subscribe users to newsletters.
Browsing, security and cookies
The website and server process IP addresses, browser details, requests and their times to serve pages, manage sessions, prevent abuse and diagnose errors. The website uses technical session and request-protection cookies. We do not integrate advertising tools on the website.
Payment takes place on a Stripe-hosted page, which may use its own cookies and tools under its policy. Necessary technical processing relies on providing the service or our legitimate interest in security under GDPR Articles 6(1)(b) and (f). Blocking necessary cookies may prevent sessions and purchases.
We use Sumetrika to measure how the website is used. Its script does not use analytics cookies, but uses sessionStorage and pseudonymous identifiers derived from browser details. It records page visits, referrers, visit duration, scrolling and link clicks. The service also receives technical connection data. The script is included on the website’s HTML pages; browser events are disabled on pages with private identifiers, URL parameters or referrers that could reveal them. Confirmed purchases and refunds are measured separately by the server using the plan, amount and a generic path, without payment identifiers, licence keys or signatures from access links. We do not send form fields. The script applies its own Do Not Track check; Global Privacy Control does not prevent its inclusion on pages.
Connections from the app
Diskivo contacts the licence service and update channel at diskivo.app. Servers receive normal technical connection data. Checks for updates to other apps may query publishers’ feeds and Apple’s catalogue, sending Apple the identifier of the app being checked. The connection test uses the macOS tool and transfers a data sample when you start it.
These features do not send Worksdem the results of file analysis. Contacted providers process data under their own policies; external links you open are subject to the destination site’s rules.
Providers and transfers
Diskivo servers are hosted by OVHcloud in France. We make daily backups of the database and project to Amazon S3 in the Europe (Frankfurt, Germany), eu-central-1 region. Authorised staff and hosting, backup, email and support providers may process data where needed, with obligations appropriate to their roles. Diskivo does not currently use Cloudflare.
Stripe, Resend and their subprocessors may process data outside the EEA, including in the United States. Processing on our behalf is subject to data processing agreements and, where required, safeguards such as European Commission standard contractual clauses. Provider policies explain their independent processing. Contact us for details of the safeguards.
Data retention
We retain licence and purchase data to manage the relationship and subsequently to the extent needed for legal obligations, disputes and protection of rights. Support requests are retained to handle them and document their resolution; data no longer needed is deleted or anonymised unless continued retention is justified.
Server logs are retained for 30 days. Daily S3 backups are retained for 30 days. Deletions from active systems may therefore remain in backups until those copies are replaced; backups are not used for ordinary purposes and, after a restore, deletion requests must be applied again. Stripe’s independently held data is subject to its own terms and obligations.
Your rights
Where the GDPR provides, you may request access, rectification, erasure, restriction, portability and object to processing, particularly on grounds relating to your situation where legitimate interests are the basis. You can withdraw any consent without affecting earlier processing. Write to help@worksdem.com; we may ask only for information needed to verify your identity.
You may complain to the Italian Data Protection Authority or the competent authority where you live, work or believe an infringement occurred. Erasure may be limited by legal obligations or the need to establish or defend a right.
Automatic checks and changes
We do not carry out advertising profiling. The service automatically checks licence validity, trials and device limits, which may prevent an activation outside the plan. Contact support for a review if you believe a check is wrong.
This policy concerns Diskivo. Updates will be published here with their date, and further notices will be provided where required when processing changes. The linked provider policies describe processing for which those providers are responsible.