Privacy policy
What this site knows about the people who read it, why, for how long, and how to make it stop. In short: nothing you do not allow — statistics through Google Analytics if you switch them on in the cookie banner, and your e-mail address if you sign in, for one purpose that you switch on yourself.
The data controller
The data controller is Ivan Capponi, Piazza Fratelli Ruffini SNC, 18011 Castellaro (IM), Italy — VAT number IT01837890084, Italian tax code CPPVNI94R27D969T, business register (REA) IM-250007. There is no data protection officer, because the processing does not call for one: any question about this notice or about your data goes straight to the controller.
What this site does, and what it does not ask for
Aurum Feed is a comparator: it reads the prices that gold coin dealers publish on their own pages and puts them on a map. It can be read without registering and without leaving anything behind. Signing in with a Google or Microsoft account is optional and serves one purpose: joining the list for the premium alerts, which will arrive by e-mail.
The site carries no advertising and embeds no social networks. It loads nothing from third-party domains except Google Analytics, and that only if you allow it in the cookie banner: everything else the page shows is served from its own domain. There is no profiling, and no data is sold or passed on for anyone else’s purposes.
Browsing data
The site is hosted on Microsoft Azure (Static Web Apps) in the West Europe region, inside the European Union. Like any server, the platform notes in its technical logs what the browser sends to make the connection work: IP address, date and time, the page requested, browser and operating system. They serve to run the site and to defend it from abuse — the controller’s legitimate interest, art. 6(1)(f) GDPR — and are neither used to identify you nor matched with anything else. Microsoft keeps them for as long as its platform logs provide.
When a page breaks in your browser — an error stops it while it is drawn, or something it runs fails — it sends the site a short report, to the site’s own address and to nobody else: the error’s message and where in the code it happened, the path of the page you were on (without anything after the question mark), the language, and the browser’s user-agent string. No cookie, no identifier, nothing you typed. The site writes it into Microsoft Azure Application Insights, in the same European region, to find and fix the error — the controller’s legitimate interest, art. 6(1)(f) GDPR — and keeps it for 30 days.
Signing in with Google or Microsoft
If you choose to sign in, the hosting platform does it on the site’s behalf: you are taken to Google’s or Microsoft’s page, you authenticate there, and you come back to where you were. The site never sees your password. From the provider it receives four things: which provider you used, an identifier for your account, the e-mail address the provider vouches for and, when the provider gives it, your name.
On the first sign-in the site writes the address, the name, the provider and the account identifier into a list, with the dates of the first and the latest sign-in. Two accounts carrying the same address are one entry. The legal basis is the service you asked for by signing in, art. 6(1)(b) GDPR. The session is a technical cookie of the platform, described in the cookie policy, and ends with “sign out”.
The premium alerts
Beside your address, once you are in, there is a switch: the premium alerts. It is off until you turn it on. Turning it on is your consent, art. 6(1)(a) GDPR, to receive by e-mail at that address an alert when a coin’s premium falls into the lowest tenth of its month; the site records the moment you turned it on. Turning it off withdraws the consent at once, and nothing is ever sent to an address whose switch is off.
The alerts are being built: the list already exists, and sending will start when the feature is live. This notice will be updated then, with the name of the service used to send the e-mails.
Subscribing to the API
The prices can also be read by a program, through the API, on a paid plan. To sell it the site keeps, beside your entry on the list, a billing profile — whether you are a private person or a company, the country, the name, and for a company the VAT number, the address and, in Italy, the SDI code or the PEC address the electronic invoice goes to — the state of the subscription as the payment provider reports it, and the API key issued to you, stored sealed. The legal basis is the contract you enter by subscribing, art. 6(1)(b) GDPR, and, for what an invoice must carry, the legal obligation to issue one, art. 6(1)(c).
No card or bank detail ever reaches the site. Payment is taken by Stripe or by PayPal on their own pages, or — for a company with an Azure subscription — by Microsoft through its commercial marketplace, on the Azure invoice. Each is an independent controller for what it collects, under its own notice; from them the site receives only the state of the subscription and the identifiers needed to match it to you.
What is on an invoice is kept for the ten years Italian law requires (art. 2220 of the Civil Code), even after the subscription ends — apart from the account, under a key of its own that nothing derives from your address, so it cannot be matched to a later sign-in. The key and the subscription are deleted with the account; while a subscription is running, “delete my data” asks you to cancel it first.
Statistics, if you allow them: Google Analytics
If you switch statistics on in the cookie banner — and only then — the page loads Google Analytics 4, to count visits and see which pages are read. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, processes the data on the site’s behalf, as processor under Google’s data processing terms. It receives the address of the pages you open and when, the page you came from, your browser, device and screen size, and an approximate location derived from your IP address, which Google Analytics does not store; it tells a returning browser from a new one by a random identifier kept in a cookie, listed in the cookie policy. Google signals and every advertising feature are switched off.
The legal basis is your consent (art. 6(1)(a) GDPR and art. 122 of the Italian privacy code). You can withdraw it at any time from “Cookie settings”, at the foot of every page: Google Analytics stops and its cookies are deleted. The cookies last six months; the events are kept in Google Analytics for two months, then deleted. Google may process the data in the United States: Google LLC participates in the EU–US Data Privacy Framework, and Google’s data processing terms include the standard contractual clauses.
Your location
The “near me” button asks the browser where you are, and the browser asks you first. The coordinates stay in the browser: they sort the dealers by distance and centre the map on the country of the nearest one, they are neither sent to the site nor kept, and closing the page loses them.
Preferences kept in the browser
Language, theme, click sound, price source, the currency prices are shown in, the exchange-rate table that needs, whether the ranking shows shops in the EU or anywhere, the last snapshot of prices and your answer to the cookie banner are kept in your browser and never leave your device. They are listed one by one, with how long each lasts, in the cookie policy.
Where the data is, and who sees it
The list is kept in an Azure Table Storage table, in the same European region as the site. Microsoft is the processor for hosting, storage and the error reports, under the terms of its online services; Google and Microsoft are independent controllers for the authentication with their respective accounts, under their own notices. If you allow statistics, Google receives what Google Analytics collects, as described above. Nobody else receives the data.
The controller transfers no data outside the European Union. For Microsoft’s and Google’s services the safeguards the GDPR requires for transfers to third countries apply — the standard contractual clauses and, where it applies, the EU-US Data Privacy Framework — as documented in their notices.
For how long
Your entry on the list stays until you delete it or ask for it to be deleted. “Delete my data”, in the settings sheet, removes it at once along with the linked accounts: a later sign-in starts from nothing. Writing to the controller does the same. Coordinates are never kept; error reports are deleted after 30 days; the platform’s logs follow Microsoft’s retention periods.
Your rights
You have the right to obtain access to your data, rectification, erasure, restriction of processing and portability, and to object to the processing (arts. 15 to 22 GDPR). Consent to the alerts can be withdrawn at any time with the same switch, without affecting the lawfulness of what was done before. “Export my data”, beside “delete my data” in the settings sheet, gives you everything the site holds about you as one JSON file, at once. To exercise any other right, write to the controller at the addresses at the top of this page: the answer arrives within a month.
If you believe the processing breaches the GDPR you may lodge a complaint with the Italian supervisory authority, or with the authority of the country you live in.
Children
The site is not aimed at children under fourteen and does not knowingly collect their data. A parent who finds that a child has joined the list need only write: the entry is deleted.
Changes
This notice changes when the site does — for instance when the alerts start. The date of the last update is at the top of the page, and the version in force is always this one.