Privacy notice — App Drive

Under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

Last updated: 19 October 2026 — service version 1.5.0 (flows with conditions, flows that update records, incoming webhooks and access for AI agents)

This is a translation of the Italian Informativa privacy. If the two versions differ, the Italian text prevails.

1. Who processes your data

App Drive is a service for publishing and opening web platforms (web sites and web applications) from the iPhone and Android app and from the browser. It is provided by:

Somio S.r.l., Via Cadorna 141, 74014 Laterza (TA), Italy, VAT no. IT03403980737, e-mail tickets@somio.it, certified e-mail (PEC) somio@pec.poste.it — the "Provider".

Who decides about your data depends on how you use App Drive:

• If you use App Drive through your company or a customer organization (one of its administrators invited you), that organization is the controller: it decides who has an account, which platforms to publish and who may see them. The Provider processes the data on the organization's behalf, as a processor (Art. 28 GDPR), under a written agreement (DPA). To exercise your rights you may contact the organization or the Provider, who will inform it.
• For the data of the customers themselves (contacts, administration, invoices) and for the security of the service as a whole (access log, abuse prevention), the Provider is the controller.

2. What data we process

Account data

• e-mail address (it is also the user name);
• password, kept only as an irreversible hash (bcrypt): nobody, not even the Provider, can read it;
• role (member, administrator), organization and teams;
• date of creation and of the last sign-in; any limits on space or number of platforms; suspension status;
• if you turn on two-step verification: the key of the authenticator app (encrypted), the date it was turned on, the last code used (so that it is not accepted twice) and the recovery codes, as hashes only. They are deleted when you turn it off or delete the account.

Acceptance of the Terms of service and of this notice

• at sign-up, and at each new version of the documents: the account's e-mail, the versions of the Terms and of the notice accepted, date and time, IP address and browser, kept as proof of acceptance.

Invitations and codes

• for invitations: the recipient's e-mail, if given, a note chosen by the person inviting (e.g. the name), who created it, expiry and status;
• for password recovery: a one-time code, kept only as a hash, valid 1 hour if sent by e-mail or 72 hours if created by an administrator.

Content

• the files of the published platforms (the "builds"), with the previous versions, the name, the icon and the sharing settings;
• the logo, name and color chosen by the organization.

App Drive does not read or analyze the content of the platforms: it stores and publishes them. If a platform contains personal data of other people, whoever publishes it (or their organization) is responsible for it.

GitHub connection (only if you use it)

• your GitHub user name and the account (personal or organization) on which you installed the App Drive app;
• the linked repositories (name, branch, folder) and the status of the builds. App Drive neither receives nor stores your GitHub password; the keys GitHub issues to the service are stored encrypted.

Activity log (security) For relevant operations: date and time, type of event, account involved, IP address and a short description. For example: successful and failed sign-ins, access to private platforms, uploads, deletions, invitations, password changes, suspensions.

Technical data

• technical server logs (date, time, type of request, address called, result, duration): they do not contain the IP address or the password;
• for private platforms opened in the browser, a technical cookie (__Host-appdrive_access) that remembers for 30 days that you have already signed in to that platform. It is strictly necessary for the service you asked for and needs no consent (Art. 122 of the Italian Privacy Code); it is not used for anything else.

Reports ("Segnala" / "Report") If you send a report from a platform: its type (bug, change, other) and the text you write, with the platform and the page open, your e-mail, your role and your organization, and technical data of the device (screen and window size, browser or operating system, language, time zone, app version). You see them before sending. App Drive forwards it at once to the tool chosen by your organization (e.g. Slack, Trello, Linear, through a "webhook") or by e-mail to whoever manages the platform; the result of the last delivery remains and, in the activity log, the fact that a report was sent. If monitoring is on, App Drive also keeps type, text, page and author for 90 days, to link it to the platform's errors.

Monitoring of the platforms (if on) The platforms hosted by App Drive contain an App Drive script (not a third party's) that, so that whoever manages them knows whether they work, records when they are opened and the technical errors their pages show (error message, file and page, browser and operating system, platform version). To count visitors the browser keeps a random code (__appdrive_v in localStorage), which App Drive stores only as a hash; in platforms with a sign-in it is linked to your account. We do not store the IP address, we do not record what you type or click, and we do not use these data for anything else.

AI (if on for your organization) When someone in your organization presses an AI button (e.g. "Analyze with AI", "Fix", "Why?"), App Drive sends to Anthropic (Claude) the errors, reports or build log needed and, for a fix on GitHub, the project files. We do not send e-mails, passwords or the values of build variables. Anthropic does not use these data to train its models. Administrators can turn the AI off in Integrations › AI.

The Overview assistant (if whoever manages the Overview turns it on) proposes cards and flows from a written request: Anthropic receives only the request and the structure of the platforms (names of the platforms, lists, tables and fields, with their type), never the data they contain. Previews are computed by the service after the answer, and nothing is created without confirmation. Whoever writes the request is asked not to include personal data in it.

Supabase back end (if your organization connects it) Some platforms use a Supabase project of your organization as their back end. If an administrator connects it to App Drive:

• App Drive stores the Supabase access token given, encrypted, and uses it only for the actions the organization asks for (deploying functions, setting secrets, reading the project's status). The values of the secrets go to Supabase and are not stored by App Drive.
• with automatic sign-in on, when you open that platform from App Drive your e-mail is sent to the organization's Supabase project, which creates your user if it does not exist and lets you in without a second sign-in.

App Drive neither reads nor moves the data of the Supabase database: they stay in the organization's project, which it manages with Supabase under its own agreements.

Payments If you pay a pre-order from the site or your organization's subscription, payment takes place on Stripe's pages: card data are processed only by Stripe and the Provider never sees them. The Provider keeps the reference of the Stripe customer and subscription, the plan, the status of payments and, for the pre-order, date and amount; company name, address and VAT number given in the payment are used for invoicing and kept for the time required by tax law (10 years).

Partner agencies (Become a partner) If an organization's administrator makes it a partner agency: company name, VAT number, registered office, name of the contact person and billing e-mail, with the signature of the partnership agreement (signed text, date, name and e-mail of the signer, IP address and browser). The VAT number is checked on the European Commission's VIES service, which receives only the number (no personal data of App Drive users). They are used to manage the relationship with the agency, invoicing and proof of signature.

Monthly report (agencies' clients) If the agency that manages your platforms turns it on, every month it receives and sends to the client's administrators (or to the address it gives) a report with totals only: openings, distinct devices, new versions, errors, reports and issues solved. It contains no names, e-mail addresses or other data of the people using the platforms. The report stays in the app, with the client's comment if any, as long as the organization exists.

Overview and flows between platforms (if the organization turns them on) The Overview shows cards with data read at that moment from your organization's platforms (from their Cloud data or, if the organization authorizes it, from the chosen columns of the tables of its Supabase project): no copy is kept, and everyone sees only the cards of the platforms they can open. With flows, when something happens in a platform (e.g. a new order in its data or a new row in a Supabase table), another one receives the fields chosen by whoever manages the organization (e.g. customer and delivery date): as a new item in its Cloud data or a new row in a Supabase table of the organization (never deletions; if the organization turns on flows that update records, also the change of only the chosen fields of the matching records), or, for the platforms that allow it, in the page or at a webhook of their back end. Those fields pass through the service's server: they wait in a queue encrypted with a key of the organization and are deleted as soon as they are delivered, at the latest after 24 hours. So that an item delivered while a page is open is not lost, a copy of it stays next to the Cloud data for at most 24 hours. The flow log keeps for 30 days only date, flow, result, attempts and size, never the content. For flows that start when a field changes, only encrypted hashes of the records and of the value followed are kept, not the data, as long as the flow exists. A flow can have conditions: in that case the records that do not meet them do not leave the platform. No AI and no new external provider processes these data.

If the organization turns them on, a flow can also start from an external service chosen by the organization (e.g. the contact form of its site or Stripe), which sends the data to a secret address: only the declared fields are taken and processed as above. With access for AI agents (MCP) whoever manages the organization can authorize an AI agent of their choice (e.g. Claude) to read the data of the platforms indicated and, if allowed, to add new records: the data read are sent to the AI service chosen by the organization, which is responsible to it for them. The service keeps no copy; it records the creation and revocation of the accesses and the records added, without their content.

Waiting list (site) If you ask for an invitation from the site: the e-mail and, if you give them, name, company, role, number of clients, how you deliver web apps today and the answer to the question on the beta price, with the date of the request. The IP address is not stored. We use these data only to send you the invitation, to ask you a few details about the request and, in aggregate form, to understand who the service is for. The site uses no profiling, marketing or analytics cookies: only technical tools, described in the Cookie policy.

Notifications (web version) If you turn on notifications on a device, we keep the delivery address your browser gives us (an identifier of the browser's notification service: Google for Chrome, Apple for Safari, Mozilla for Firefox, Microsoft for Edge), the keys to encrypt the messages and the type of browser. The content of the notification (e.g. "Build failed: CRM") is encrypted for your device: the browser's service delivers it without being able to read it. You can turn them off whenever you want (Account › Notifications on this device, or from the browser's settings).

On your phone the app keeps the session credentials in the system's protected keychain (Keychain on iPhone, Keystore on Android), the latest list of platforms and any offline copies you choose to download. You can delete them by uninstalling the app or from the app's menu.

What we do not do: no advertising, no profiling, no third-party cookies or analytics or tracking tools in the app or in the pages of the service, no sale or transfer of data.

3. Why, and on what legal basis

Giving the e-mail is necessary to have an account; without it the service cannot be used. There are no automated decisions and no profiling.

4. How long

If a customer organization ends the contract, its data are returned on request and then deleted as provided by the DPA.

5. Who can see the data

• If you use the same account in several organizations, each one sees only your presence in it (role, platforms, activity there); its administrators know that the account is also used elsewhere, not where.
• Inside App Drive: your organization's administrators see the list of users (e-mail, role, space used, last sign-in) and manage invitations and suspensions; the members of your teams see your e-mail and the platforms you share with them. Organizations are separate: nobody sees users or platforms of another one.
• The Provider, as technical administrator of the server, only to run the service, the support requested and security.
• Technical providers (sub-processors), only as far as their task needs and under contracts compliant with Art. 28 GDPR (table below).

The service runs in two separate regions, each with its own servers, database and backups: the EU region (https://drive.somio.cloud) and the US region (https://drive.us.somio.cloud [to be confirmed]). Each organization is in one region only, chosen when it signs up; its data stay there and do not move to the other (see §6). Organizations in the European Union are normally in the EU region.

The following receive no personal data: the European Commission's VIES service (it receives only a partner agency's VAT number, to check it), Let's Encrypt (it issues the HTTPS certificates and receives only domain names) and UptimeRobot (it checks that the server is up by calling a page without personal data). Downloading the app from the App Store or Google Play is governed by Apple's and Google's notices.

The Supabase project connected by an organization (back end of its platforms and, with automatic sign-in, the e-mail of whoever opens them) is chosen and managed by the organization with Supabase: it is not a provider of the Provider, and it processes the data under the agreements between Supabase and the organization.

Notifications go through the service of the browser you use (Google, Apple, Mozilla or Microsoft), which delivers them to the device: the content is encrypted and only you read it. The service is chosen by the browser, not by the Provider.

Reports go to the tool your organization has connected (webhook) or to the e-mail of whoever manages the platform: the organization chooses it, and that tool processes the data under its terms with the organization.

Data may be disclosed to the authorities only where the law requires it.

6. Transfers outside the EU

EU region. The service and the data stay in the European Union. The only exceptions are the optional features described below.

US region. The data of the organizations signed up in the US region are stored in the United States, with the providers of §5. It is meant for organizations outside the European Union. If an EU organization chooses it, the transfer takes place under the European Commission's Standard Contractual Clauses (Decision 2021/914) concluded with the provider, or on the basis of the EU-U.S. Data Privacy Framework if the provider takes part in it, and with the measures of §7 (data encrypted in transit and in the backups). The two regions do not exchange data. The Provider's technical support, from Italy, accesses the US servers only to run the service. Service e-mails are sent by Aruba (Italy) for both regions.

Optional features, in both regions. The optional connection to GitHub (USA): if you use it, GitHub processes your user name and your repositories under its own terms. GitHub takes part in the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) and adopts the Standard Contractual Clauses. The same applies to the AI (Anthropic, USA), used only if on and only when an AI button is pressed, with the Standard Contractual Clauses of its data processing agreement. If you do not connect GitHub and do not use the AI, no data of the EU region leaves the EU through the Provider. An organization's Supabase project is in the region that organization chose when it created it: that is where, with automatic sign-in, the e-mails of whoever opens its platforms arrive. For payments, Stripe Payments Europe (Ireland) may transfer data to Stripe, Inc. (USA), which also takes part in the Data Privacy Framework and uses Standard Contractual Clauses.

7. How we protect the data

Connections always encrypted (HTTPS), passwords kept only as bcrypt hashes, short sessions with renewal and automatic revocation on password change, limits on sign-in attempts, separate organizations, permissions by role, private platforms open only to those entitled, encrypted secrets, checks on uploaded files, daily backups, security reviews. The full list is in Annex C of the DPA.

8. Your rights

You can ask at any time to:

• access your data and get a copy (Art. 15);
• correct them (Art. 16);
• erase them (Art. 17) — also by yourself, from the app;
• restrict their processing (Art. 18);
• receive them in a machine-readable format, portability (Art. 20): the platforms can be downloaded at any time;
• object to processing based on legitimate interest (Art. 21).

Write to tickets@somio.it (or by PEC to somio@pec.poste.it). We answer within one month. If you use App Drive through an organization, we also forward the request to it.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the EU country where you live or work.

9. Published content and public platforms

A public platform can be reached by anyone who knows its address (https://<name>.apps.somio.cloud). If it contains personal data, make it private (access with an account only) and publish them only if you have a legal basis for doing so. In case of abuse the Provider or the organization's administrator may suspend the account and take its platforms offline.

10. Children

App Drive is meant for companies and professionals and is not intended for children under 14.

11. Changes

If the notice changes in a relevant way, we tell users before the changes apply. The version in force is always available at https://drive.somio.cloud/privacy (Italian) and https://drive.somio.cloud/en/privacy (this translation).