Privacy notice

Last updated 16 September 2026.

Who is responsible

The controller of your personal data is Portrait – Simone Pasqua, Via Marco Celio, Bologna, Italy. For anything concerning your data, write to [email protected].

What we collect and why

When you register for a licence, we keep your name, institution, email address and country, and the licence key we issue, to provide and support the licence. The basis is the contract between us; without these data we cannot issue a licence. We use your email address to send you the key and reminders before the licence expires; if you ask only to be told when PORTRAIT is released, we use it for that alone, with your consent, and delete it afterwards. From the second year, payments are processed by Stripe; we do not receive your card details. To protect registration from automated abuse we process your IP address and use Cloudflare Turnstile, on the basis of our legitimate interest in keeping the service secure.

When you use PORTRAIT, the licence is bound to your computer through a code derived from its hardware, and the software contacts our licence server when the licence is activated, near and after its expiry, when you check for a renewal, and when an account is created or a password is recovered. To recover a forgotten password we keep the email address and name of each account; addresses of colleagues are entered by the laboratory's administrator. The basis is the contract. Passwords are never sent to us.

PORTRAIT sends basic technical diagnostics and crash reports, linked to a code derived from your licence key, on the basis of our legitimate interest in keeping the software working. You can switch them off in Settings › About › Privacy. Information about which features you use is sent only if you agree to share it, on the basis of your consent. Diagnostics never include your images, measurements, results, file names or location.

Your images, measurements and results stay on your computer. If your laboratory connects PORTRAIT to its own database server, your laboratory is responsible for the data on it.

How long we keep it

Registration and licence data are kept while the licence is active and for 24 months after it last expired. Emails you send us are kept as long as the registration or request they concern. Diagnostics are kept for up to five years, or deleted earlier with your registration. Invoices are kept for ten years, as Italian law requires. IP addresses used against automated registrations are kept for at most 48 hours, and server logs for at most seven days.

Who receives it

We do not sell your data. It is processed on our behalf, under data processing agreements, by Cloudflare (website, licence server, security checks), Amazon Web Services (email delivery, Ireland), PostHog (diagnostics, European Union), Google (our email), Anthropic (IT services) and, from the second year, Stripe (payments). Transfers outside the European Economic Area are covered by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses, a copy of which you can request.

Your rights

You can access your data, have it corrected or deleted, restrict its processing, receive it in a portable format, and object to processing based on our legitimate interest, including diagnostics. You can withdraw consent at any time, without affecting earlier processing. Deleting your registration ends your licence. Write to [email protected]; we reply within one month. You can also complain to a supervisory authority; in Italy, the Garante per la protezione dei dati personali.

Cookies

This website sets no cookies and uses no analytics or advertising. On the registration pages, Cloudflare Turnstile stores one technical entry in your browser, strictly necessary for the registration you request.

We make no decisions about you based solely on automated processing. If this notice changes, we update this page and its date.