Privacy notice

Controller and contact details

The data controller is Help3D di Andrea Pirazzini, VAT number 05673830286. For information and requests about your data, use the Help3D contact details or call 049 7294357.

This notice covers tools.help3d.it. The main Help3D website and services reached through links have their own privacy notices.

Data and purposes

Browsing and security. To deliver pages, the infrastructure may process your IP address, request date and time, requested address, browser information, response status and security events. This data supports website availability, error diagnosis and abuse prevention. The legal basis is the controller’s legitimate interest in operating and securing the service (GDPR Article 6(1)(f)). Technical communication data is necessary to receive the pages.

Requested preferences. The site remembers your theme and language only when you use the corresponding controls. Preferences are stored in your browser and are not automatically sent to the server as cookies. Their sole purpose is to respect your display choices; the legal basis for the related processing is the legitimate interest in providing the requested functionality. You can browse the directory with this storage blocked.

Search and filters. These are processed in your browser, without sending them to an analytics service. They appear in the address so that a search can be shared: when an address containing filters is loaded, its parameters may appear in technical server logs. Do not enter personal information in the search box.

Public browsing of the directory has no accounts, registration forms, purchases or file uploads. It is separate from the private administration area reserved for the owner. Its code includes no third-party analytics, advertising pixels, advertising profiling or automated decision-making affecting users. Optional first-party statistics are described below. Images and fonts do not require content to be loaded from external services.

Aggregate click and page-view counts

When enabled, the internal counter records clicks on card previews and App, Website, GitHub and Download buttons to highlight the most clicked tools. Requests contain only the tool ID and link type; the database stores totals by tool, day and link type. A separate counter records catalog page openings, reloads and completed category changes. Requests contain only a page code for validation; the database retains only site-wide daily totals shared between Italian and English. Search, filters, sorting and pagination do not add page views. The footer shows this total as views, separately from unique visitors estimated with consent. These aggregate-count records do not store IP addresses, visitor identifiers, browsers, individual browsing paths or individual event timestamps. This count uses no cookies, persistent browser storage or fingerprinting, and does not connect visits with each other or with other sites.

Transmitting requests still involves technical network data being processed by the hosting provider and Cloudflare, as described above. The purpose is to improve browsing of this directory through aggregate statistics; the legal basis for any necessary technical personal data is the controller’s legitimate interest (GDPR Article 6(1)(f)). Counts do not represent people or unique visitors, do not create profiles and are not shared with advertising services. Rankings reflect recorded clicks and may be affected by repeated requests, network blocking and abuse protection.

Aggregate totals are kept for historical statistics and rankings during the lifetime of the directory. Site updates do not reset them. Abuse controls store only aggregate counters and time windows per tool or for the directory, updated over time, without visitor data.

Optional statistics with your consent

If you accept optional statistics, our server uses a random identifier for this browser to estimate unique and returning visitors, group browsing into sessions and understand which categories, subcategories, activities and tools are viewed. The legal basis is consent (GDPR Article 6(1)(a)). Refusing does not restrict the directory. Before you choose, after refusal or after withdrawal, these identifiable events are not collected; the aggregate counts without identifiers described above remain separate.

We retain pseudonymous identifiers derived from the cookie, event date and time, page or category code, the selected subcategory or activity code and, when you open a tool, its code, link type and any active subcategory or activity filter. A session ends after 30 minutes without events. This data allows us to link views and tool openings from that browser: it is not anonymous data. Our analytics records do not collect IP addresses, user-agent strings, referrers, search terms or full URLs. We do not link these identifiers to accounts, reviews, suggestions, data from other sites or the administration cookie. We do not use fingerprinting or reconstruct deleted identifiers.

The purpose is to assess and improve the directory, without personalised advertising or automated decisions affecting individuals. Statistics are processed on the directory’s server and accessible to the controller in the restricted administration area; only aggregate results may appear publicly. Aruba Business and Cloudflare remain infrastructure providers with the roles and limitations described below: not using an external analytics service does not exclude their technical processing of requests.

“Unique visitors” estimates browsers that have consented within the stated period, not all individual people. Different browsers and devices, expired or cleared cookies, blocking and withdrawals affect the count. Sessions, pages per session and tool-opening metrics cover this same set of visits only; general totals may also include people who have not consented. Adding daily unique counts does not give monthly unique visitors.

Retention. Events and sessions remain for at most 90 days; reports use only the data still available and do not maintain a permanent analytics archive. Withdrawal deletes analytics data linked to the receipt, including identifiers renewed under that same choice. Minimal evidence of the choice remains until its original six-calendar-month expiry to document consent and withdrawal (GDPR Article 7(1)); at expiry, any remaining linked analytics data is also deleted. Technical receipts preventing the same submission from being counted twice last 24 hours; abuse limits use per-receipt counters and a site-wide one-minute window, without IP addresses. Deletion runs during writes and through service cleanup. Backups follow the infrastructure’s retention cycle: deletions and expiries must be reapplied before restoring public service. General counts without identifiers are not deleted by withdrawal.

You can change or withdraw consent through the dedicated footer control, as easily as you gave it. Withdrawal stops optional collection and does not affect the lawfulness of earlier processing. The Cookie Policy describes the cookies, their duration and how your choice is managed. To exercise other rights, use the controller’s contact details; do not send cookie values.

Community ratings and moderation

When the feature is enabled, you can give 1 to 5 stars and add an optional comment and name or nickname, without an account or email. A name is not required: you can use a nickname, up to 60 characters. We retain the tool ID, rating, submitted text and optional name, dates, moderation status and reasons, any reports and a pseudonymous browser identifier. This is not anonymous data: your name or content may identify you. Do not include contact details, sensitive information or other people’s personal data.

A dedicated technical cookie lets this browser retrieve, update or remove its rating and helps limit repeated submissions. The ratings database stores only the cookie’s hash and does not record IP addresses, user-agent strings or device fingerprints. The Cloudflare Turnstile check described below separately processes technical browser signals. The cookie and identifier are not used by the counters, to reconstruct browsing or for advertising. Technical data processed by the infrastructure remains separate. The legal basis is the controller’s legitimate interest in providing the requested rating service, protecting its integrity and handling abuse and reports (GDPR Article 6(1)(f)). Participation is optional; you can browse without rating.

Valid ratings contribute to the average and rating count. Comments and the optional name or nickname become visible to everyone only after approval; the name, text, associated rating and date may be read and copied by others. The name appears alongside the comment. If you submit only stars, the optional name is retained with the rating but is not published. Identifiers and internal moderation notes are not published. Community stars are separate from Piraz Tested and Piraz Approved. We do not verify identity or actual use of a tool: clearing the cookie or using another browser may allow another rating.

Participation rules. Describe a relevant experience, including a negative one, using respectful language. Spam, unrelated promotion, insults, threats, illegal content, contact details, sensitive information, other people’s personal data and text copied without permission are excluded. Comments have a maximum of 1,000 characters, without HTML or attachments. Changes to the name or comment return to the review queue. Rejecting text does not automatically remove a genuine rating; a suspicious rating may be excluded from the average. A review is not removed merely for being negative.

Management and reports. Use Rate to view and manage the rating recognised in your browser. You can report a comment using its reporting control; reporting does not automatically remove it. To request reconsideration, report potentially illegal content or make a request after losing the cookie, use the Help3D contact details, identifying the tool, comment and reason without sharing the cookie value. The controller assesses the request and may ask for only the information needed to locate the content and handle your rights.

Retention. The cookie lasts 180 days from activation or renewal through a feature control. On expiry, the browser association with reviews is removed; published reviews may remain. Expiring or clearing the cookie does not delete a rating. Valid ratings, approved comments and any associated names remain while relevant to the directory or until removed. A name retained with a rating without a comment follows the same period and is not published. Removal requested from the recognised browser immediately clears the rating, name and text. Pending, rejected or spam names and text, excluded ratings and minimal removal records are deleted after 90 days; resolved reports and moderation logs after 90 days. Submission tokens expire after 15 minutes; technical receipts preventing duplicate submissions remain for at most 24 hours. Individual cases may be retained separately where necessary for legal obligations or disputes. Backups follow the service’s retention cycle and deletions must be reapplied before restoring public service.

Suggesting new tools

You can suggest a tool by providing its required public link and, optionally, your name or nickname (up to 80 characters). No account or email is required. Do not submit private links, credentials, sensitive information or personal contact details: a web address may itself contain personal data. We retain the link, optional name, dates, review status and internal notes to assess and manage suggestions. The legal basis is the controller’s legitimate interest in maintaining the directory, handling voluntary suggestions and preventing abuse (GDPR Article 6(1)(f)).

Suggestions are accessible in the restricted administration area and are not published automatically. The submitter’s name is not published; adding a tool is a separate editorial decision following checks of the link and information. You can browse without suggesting anything. To request correction or deletion of a suggestion, use the Help3D contact details, identifying the link and the information needed to locate it.

The form does not create an identifying cookie or record IP addresses, user-agent strings or device fingerprints in the suggestions database. Technical request hashes are retained for 24 hours to prevent duplicate submissions; they are not used to recognise you while browsing. Suggestions, including names and internal notes, are deleted after 180 days from their last update. Editorial data for a tool subsequently added to the directory remains separate. Backups follow the service’s retention cycle and deletions must be reapplied before restoration. Infrastructure logs and technical signals used by the Cloudflare check described below are separate processing activities.

Protection against automated submissions

The rating and tool suggestion features use Cloudflare Turnstile to limit automated submissions and abuse. Its script loads only when you choose Start verification in the rating, management, reporting or suggestion flow, not when browsing the directory or reviews. Your browser connects to Cloudflare, which processes signals such as IP address, TLS characteristics, User-Agent, widget key and origin; the check also receives the tool ID for ratings or just a feature code for suggestions. Our server validates the token without adding the visitor’s IP address, name, review text or suggested link. The check may run without a visible challenge: Cloudflare displays the widget when interaction is required. A saved rating does not immediately start another check; a further submission requires a new check.

Cloudflare acts as a processor to provide the check and as an independent controller to improve bot detection, as described in its Turnstile Privacy Addendum. The check protects the requested feature and does not feed the directory counters. If you do not start it or it fails, you can still read the directory and reviews; for assistance, use the Help3D contact details.

Private administration area

Only the owner has an administrator account; visitors cannot register. Sign-in uses a username and password, stored on the server only as a hash. The session contains a random technical identifier, authentication state, access times and data needed to prevent unauthorised requests. This data is used only for security and the requested access, under the controller’s legitimate interest in operating the website. It is not used to measure visitors or connect their browsing activity.

The session expires after inactivity and a maximum lifetime; initial settings are 30 minutes and 8 hours. Signing out and replacing credentials invalidate previous access. Credentials remain until replaced or the account is deactivated; expired session files are removed by server cleanup, which must be verified in the deployment environment. The sign-in limit keeps a single counter with a 15-minute window, overwritten in subsequent windows, without submitted names, IP addresses or visitor identifiers. Infrastructure logs remain separate and follow the criteria described in this notice.

Providers and recipients

Aruba Business provides hosting. Cloudflare is used in the domain infrastructure: when traffic passes through its proxy, it may process request data to deliver pages and protect the site. DNS alone does not imply use of the proxy or every Cloudflare product.

Data may be accessible to the controller, authorised maintenance personnel and technical providers for their assigned tasks, under the relevant data processing agreements. It may be disclosed to authorities where required by law. The directory does not sell this data. The community content described above and aggregate statistical results are public; identifiers and individual analytics events are not published.

Provider information: Aruba Business and the Cloudflare Data Processing Addendum.

International transfers

Cloudflare operates an international network; processing may involve countries outside the European Economic Area, including the United States. Its data processing agreement describes transfer safeguards, including standard contractual clauses where applicable. You can ask the controller about the safeguards applicable to the service and how to obtain a copy. Italian hosting does not mean that all processing takes place in Italy.

Retention

Local preferences remain until changed, cleared with site data or removed by the browser; they have no automatic expiry. Without a saved preference, the theme follows your device settings.

Technical logs are retained for the time needed for operations and security, considering service settings and the time required to detect and investigate anomalies. Data relating to incidents or authority requests may be retained for as long as necessary to handle them or meet legal obligations.

Your rights

Where applicable under the GDPR, you can request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. Contact the controller using the details above. You can also lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority.

Links and updates

Tool cards and social links are ordinary links: an external service opens when you choose to follow one and applies its own terms and notices. This notice will be updated if functions or providers change. The date above refers to this notice and is separate from the directory’s content update date.

External tools and websites: limits of our checks

Help3D Tools is an informational directory. Its maintainers undertake a brief preliminary review of the available pages and information before listing a tool. This is not a comprehensive check of the service’s security, functionality or reliability, nor is it continuous monitoring.

A listing does not guarantee the tool or its operator: we cannot rule out scams, harmful content, inaccurate information or changes after the review. Piraz Tested and Piraz Approved badges also reflect personal experience or opinion, not a security certification or guarantee.

Before registering, paying, downloading software or sharing data, independently check the service and its terms. You can report problems through the Help3D contact details. This notice does not exclude or limit any liability that cannot be excluded or limited by law.