Ayo · Artetecha
Privacy policy
Updated: 2026-10-30 · [email protected]
Who is responsible
The data controller is Vincenzo Russo, trading as Artetecha (sole trader, VAT number IT07061230483). For any privacy question or request, email [email protected]. Artetecha has not appointed a data protection officer because it is not required to. This policy covers the Ayo app, the ayo.artetecha.com website and email support.
Your mail stays under your control
Ayo is an independent PEC mail client. Artetecha does not operate a mailbox backend or receive your mailbox password, email content, attachments or address book through Ayo. Data the app processes only on your device is not collected by Artetecha. The app has no advertising, analytics SDKs or tracking.
Purchases
Apple processes Ayo Plus payments as an independent controller, under its own terms and privacy policy. Ayo reads Apple-verified transaction information locally to unlock features; Artetecha receives no payment-card details through the app and operates no receipt-validation server. Apple gives Artetecha only sales reports that do not identify you. The app retains no separate purchase-unlock flag. The first mailbox’s opaque account identifier is stored locally to restrict background checks to Free access when Plus is unavailable.
Mail and credentials
Ayo connects directly to the servers selected for your provider over encrypted IMAP and SMTP connections. Your email address, optional server usernames and mail-program password authenticate these connections. In manual setup, use only server names supplied by a provider you trust: Ayo sends your credentials to those servers. Messages, recipients and attachments are transmitted to your provider when you use mail features; sending mail shares it with the recipients you choose. Your provider handles this data under its own terms and privacy policy. Ayo stores credentials in the device Keychain and keeps account server settings, a protected local mail index, downloaded originals, drafts and pending Sent copies. These app caches are excluded from device backups.
Recipient suggestions and Contacts
Suggestions use the selected mailbox’s indexed Inbox and Sent headers. Contacts access is optional. With permission, Ayo reads names and email addresses only from allowed contacts, holds them in memory and does not upload the address book. Selecting a recipient and sending a message transmits that selected address as part of the email. You can change Contacts access in iOS Settings.
Authenticator and app lock
Optional app lock uses Face ID, Touch ID or the device passcode. iOS handles authentication; Ayo does not receive biometric data. App switcher previews are concealed. The separate TOTP authenticator always requires device authentication. Its keys and account labels are stored in a device-only Keychain vault requiring user presence and a device passcode, without cloud sync or backup. QR scanning uses the camera locally; images are not stored or uploaded. Keys are not sent to Artetecha or to your mail provider. Copied codes use a device-only clipboard item expiring with the code. The vault locks after two minutes, on leaving its screen or on backgrounding. Delete individual entries in the authenticator before uninstalling; uninstalling does not guarantee Keychain deletion. Losing the device or removing its passcode can make keys unrecoverable. Keep service recovery codes separately. App lock does not stop background mail or notifications.
Receipt signature checks
Signature verification runs locally on the downloaded original. Ayo does not upload receipts, certificates or verification reports and does not contact certificate-authority, OCSP or CRL services. The bundled certificate anchor is updated with the app. Results are recalculated when opening a message and are not stored as a historical validation record.
Optional notifications
Local background checks connect directly to the IMAP server configured for each account. Enabling them stores a separate credential and a limited header cache accessible while locked after the first device unlock; they remain device-local and excluded from backup. iOS controls when checks run. Notifications are created on the device; this version does not send your address, credentials or mailbox data to a notification server.
Data on your device: retention and deletion
Local mail data is kept until reconciled during sync or until you remove the account. In Settings, removing an account deletes its local cache, drafts, pending Sent copies and credentials; server mail is unchanged. Save any unresolved local drafts or sent copies first. Turning off local notifications deletes their separate background credential and staged headers. Uninstalling the app does not guarantee removal of Keychain items; remove accounts first. Files you export or share remain wherever you saved or sent them.
Email support
If you email [email protected], Artetecha processes your email address and whatever you choose to send in order to answer your request. The legal basis is providing the service you ask for (GDPR Article 6(1)(b)) or, for general questions, our legitimate interest in replying (Article 6(1)(f)). Artetecha’s email is handled by Google Workspace (Google Ireland Ltd). Conversations are deleted 12 months after the last message, unless they are needed longer to establish or defend a legal claim. Do not include passwords, pairing keys, private email content or identity documents.
This website and external links
ayo.artetecha.com uses no cookies, analytics, advertising or forms. To serve and protect the pages, the hosting provider Upsun (Platform.sh SAS, France), with servers in the European Union (Sweden), and the Cloudflare network (Cloudflare, Inc.) receive normal connection data: IP address, requested page, date and time, and browser information. The legal basis is our legitimate interest in running the site securely (GDPR Article 6(1)(f)). Server logs are overwritten automatically when they reach their size limit, and Artetecha does not use them to profile visitors. Opening provider portals or other links from the app sends normal web requests to the chosen site under its own policy; Ayo does not pass its saved mail password to those pages.
Who receives data
The PEC provider you choose and Apple process data as independent controllers under their own policies. Upsun, Cloudflare and Google process data on Artetecha’s behalf as processors, under a written agreement. Cloudflare and Google may process data in the United States; those transfers rely on the EU–US Data Privacy Framework adequacy decision and the European Commission’s standard contractual clauses. Artetecha does not sell data or use it for advertising.
Your rights
You can ask Artetecha for access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest (GDPR Articles 15–22). Email [email protected]: we reply within one month and may ask you to confirm your identity. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority in the EU country where you live or work. Giving data to support is optional, and we make no automated decisions about you.
Your choices and questions
You can use Ayo without Contacts or notifications. Change permissions in iOS Settings and remove mailboxes from Ayo Settings. Requests about mail stored by your provider should be directed to that provider. Changes to this policy will be published here with an updated date.