Privacy and cookie notice
Under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Article 122 of Italian Legislative Decree 196/2003.
Last updated: 16 September 2026.
This is a translation of the Italian notice. If the two differ, the Italian version prevails. It describes processing as it is actually implemented in the software, not a generic template. If you find a mismatch between what is written here and what the app does, tell us: it is a defect and we will fix it.
1 · Who processes your data
Data controller: Ingain — contact: info@ingain.it.
That address is the single channel for any request about your data, including the rights described in section 8. We reply within 30 days, as required by Article 12 GDPR.
2 · What data we collect, and when
Data you give us
| Data | When | Why |
|---|---|---|
| Email address | sign-up | to identify your account, service messages, password recovery |
| Password | sign-up | access. We do not store it in clear text: our authentication provider keeps it in encrypted form |
| Date of birth | sign-up | required: under 16 you cannot earn on Ingain (the minimum working age in Italy, Law 977/1967), and minors need extra safeguards (section 7) |
| Company name, VAT number, website, country | brand sign-up, or the contact form | contract, invoicing |
| Italian tax code (codice fiscale), name and surname, home address | the tax code when you request your first euro withdrawal, when you redeem a voucher and when you accept a Creator Post mission; name, surname and address for withdrawals and vouchers | two distinct purposes. (1) Legal obligation for withdrawals and, as a precaution, for vouchers: we pay you in our own name as withholding agent, withhold 20% and file the Certificazione Unica and form 770; and every year we file the DAC7 report with the Italian Revenue Agency (Legislative Decree 32/2023), which requires name, surname, tax code, date of birth and address. We take the date of birth from the tax code, without asking you again. We check that name and surname match the tax code. (2) Legitimate interest for Creator Post and, also, for vouchers: the tax code is the only piece of data that ties one person to one single account. Without it, someone running ten accounts multiplies what they take out by ten, and the other earners pay for it |
| IBAN | only when you request your first euro withdrawal | to make the payment. The one used for the last paid withdrawal of the year is part of the DAC7 report |
| Content you upload | when you complete a mission | verification screenshots, survey answers, comment texts. They are used to check that the mission was done and to pay you |
Data collected automatically
| Data | What it contains | Why |
|---|---|---|
| IP address | the address you connect from | three cases, and no others. (1) Anti-fraud signal: when the system detects anomalous behaviour it records the event together with the IP, so that networks used to create multiple accounts can be recognised. (2) A parent's consent for a 16-17 year old: we record the IP of whoever approves, because that is the proof the consent was actually given (GDPR art. 7.1). (3) Your cookie choices, for the same reason: consent without proof is worth nothing. Cases (2) and (3) are kept for 24 months, after which the address is removed and only the record of the choice remains. We do not use it for profiling or advertising, and the browser's automatic security reports do not keep it at all |
| Device fingerprint | a numeric code computed from: browser type, operating system, language, number of processors, memory, screen resolution, time zone. It is a shortened, non-reversible hash: the original characteristics cannot be recovered from it | to recognise the same device behind several accounts — the most common way to defraud a platform that pays |
| Activity on the platform | completed missions, approved or rejected verifications, balance, wallet movements, level and tier | to run the service: pay you, compute your tier, handle appeals |
| Device time zone | e.g. Europe/Rome | to choose the interface language when your device declares a language we do not offer. We use the time zone precisely so that we do NOT use your IP address: it is the less invasive option and it stays entirely in your browser |
What we do NOT do. We do not sell your data. We do not pass it to advertising brokers. We do not use third-party profiling cookies. We do not track your browsing on other sites. We do not infer your location from your IP address to show you content.
3 · Legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing the account, letting you do missions, paying you | Performance of a contract — Art. 6(1)(b) GDPR |
| Tax withholding, Certificazione Unica, form 770, reporting obligations (including DAC7, with the request and the two reminders the law provides when details are missing), accounting retention | Legal obligation — Art. 6(1)(c) GDPR |
| Age verification and protection of minors | Legal obligation — Art. 6(1)(c), and Art. 8 GDPR |
| Anti-fraud and security (device fingerprint, IP on suspicious events, rate limits) | Legitimate interest — Art. 6(1)(f): protecting advertisers' money and honest users' earnings. The balancing test is documented and you can object to it (section 8) |
| Promotional communications | Consent — Art. 6(1)(a). It is optional, the box is not pre-ticked, and you can withdraw it at any time without affecting the service |
| Choosing the interface language | Performance of a contract — Art. 6(1)(b): showing you the service in a language you understand. No data leaves your device for this purpose |
4 · How long we keep it
| Data | Retention |
|---|---|
| Account and activity | for as long as the account exists. You can close it yourself, right away, from Settings: we delete or anonymise everything the law does not require us to keep (see the next row), remove your verification screenshots and remove your access. There is no waiting period and no one to write to. If you have a withdrawal in progress, verifications still under review or active campaigns we tell you and ask you to wait: deleting mid-way would throw away someone's work. You can still write to info@ingain.it |
| Tax code, name, surname, address, IBAN, earnings, withholdings | 10 years — the retention period for accounting and tax records (Art. 2220 of the Italian Civil Code and tax rules). We cannot delete them earlier, even on request, and they remain even if you close your account after accruing euro earnings: without them, the Certificazione Unica and the DAC7 report cannot be filed |
| Verification screenshots and proofs | 12 months, so that appeals and disputes can be reviewed. Twelve months applies even if the verification was never reviewed: a mission left pending is not a reason to keep your screenshot for longer |
| Anti-fraud events (IP, device fingerprint) | 12 months |
| IP and browser of the approving parent, and of your cookie choices | 24 months, after which the address and browser are removed: what stays is the record of which choice was made and when, which is the proof required by GDPR art. 7.1. Twenty-four months is how long a consent can reasonably be disputed |
| Automatic browser security reports | the IP address is not kept. The browser type stays, because it is what tells us whether a report comes from an extension you installed or from a mistake of ours |
| IP address and browser in the activity log | 12 months, then removed: the record of the operation stays, without the data that identifies the device |
| Consent to promotional communications | until withdrawn |
| Contact form and waiting-list data | 24 months from submission |
5 · Who we share it with
We do not sell or transfer data. It is processed on our behalf, as processors (Art. 28 GDPR) and only for the purposes described here, by the providers that let us operate:
- Website hosting and contact forms — our hosting provider;
- Database and authentication — the provider that stores accounts, balances and movements;
- Payments — the payment service provider that collects from advertisers and the one that makes withdrawals to you;
- Email delivery — the service that delivers service messages.
Support test: what the brand sees
When you complete a Support test you write yourself, directly, to the brand's customer support: the brand receives the address you write from, as it would from any customer. We tell you this before you start, inside the mission. Ingain does not pass on your name or contact details: the brand only receives your survey answers. And we do not collect the name of whoever replies to you — that field does not exist, because a service rating must not be usable against an individual employee.
We disclose data to the Italian Revenue Agency when the law requires it (Certificazione Unica, form 770, DAC7 reporting), and to judicial or police authorities on a lawful request. With DAC7, every year by 31 January, we report name and surname, tax code, date of birth, address, IBAN and, quarter by quarter, earnings, number of activities and tax withheld: it applies from the first euro, and the Agency may share this data with the tax authorities of other European Union countries.
Transfers outside the European Union
Some providers are based in the United States. In those cases the transfer relies on the standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR) and/or the provider's participation in the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards in place by writing to info@ingain.it.
6 · Cookies and browser storage
Ingain does not use profiling cookies and hosts no third-party advertising trackers. It uses your
browser's local storage (localStorage), which stays on your device and is not sent to us
automatically.
| What we keep in your browser | Nature |
|---|---|
| Login session, balance and profile state, completed missions | Technical — the app does not work without it. Exempt from consent (Art. 122 Legislative Decree 196/2003) |
| Chosen language, sorting and display preferences, dismissed notices, tutorials already seen | Preferences — so we do not ask you the same thing twice. Exempt from consent |
| A campaign payment in progress, until it completes | Technical — when a brand pays for a campaign they are sent to the payment provider's site, and on their return this is the only thing that lets the campaign they just paid for come into existence. It is deleted as soon as the campaign exists, and in any case after 14 days |
The invite code of the link you arrived from (ingain.it/r/…) | Technical — it lets the friend who invited you receive the bonus you chose to activate by opening their link. It lasts only for the visit (it is deleted when you close the tab) and, if you sign up, travels with your registration; it contains nothing about you |
| Your choice on the privacy banner | Technical — remembers that you already answered. It expires after 13 months, then we ask again |
| Anonymous, aggregate statistics | Only with your consent, which you can give or refuse from the banner and change at any time in Settings |
You can erase all of this at any time by clearing the site data in your browser settings. You will lose the saved login and preferences, but not your account or your balance.
7 · Minors
To earn on Ingain you must be at least 16: it is the minimum working age in Italy. Anyone who declares a lower age cannot access paid missions.
For users aged 16 to 18 we apply extra safeguards: euro withdrawals and vouchers that pay out real money require the consent of a parent or guardian, and some missions — those with potentially sensitive content or that involve publishing advertising content — are not available.
If you believe someone under 16 has created an account, write to us: we will close it and delete the data.
8 · Your rights
You can exercise at any time, by writing to info@ingain.it, the rights under Articles 15-22 GDPR:
- Access — to know what data we hold and get a copy;
- Rectification — to correct wrong data;
- Erasure — within the limit of tax data, which the law requires us to keep for 10 years;
- Restriction and portability — to receive your data in a machine-readable format;
- Objection to processing based on legitimate interest, including anti-fraud;
- Withdrawal of consent to promotional communications, at any time and without giving reasons.
Automated decisions
The anti-fraud system assigns an automatic score and can temporarily suspend the account: while the suspension lasts, the highest-value missions, withdrawals and voucher redemptions stop, and deliveries are not accepted automatically after 30 days. The money you have earned stays yours, and the suspension has an end date. Verifications can be rejected automatically. In both cases you have the right to review by a person: use the appeal feature in the app, or write to us. We do not take fully automated, final decisions about your earnings without you being able to challenge them (Art. 22 GDPR).
Complaints
If you believe the processing breaches the GDPR you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it) or with the supervisory authority of the EU country where you live (Art. 77 GDPR), or go to court.
9 · Changes
If we change this notice we update the date at the top and, when the change is substantial, we tell you inside the app. Previous versions are available on request.