Gaposa App (RollApp) Privacy Statement

Oct 19, 2026

Gaposa Srl collects the information needed to run the Gaposa app (RollApp) and your Hub (RollApp Hub) — your account and your motors' names, positions and schedules — and shares device information with Google or Amazon only if you link Google Home or Alexa. This statement covers the Gaposa app (RollApp), your Hub (RollApp Hub) and our cloud service. Please read it in full.

1. About this statement

Gaposa Srl is the controller of your personal information. We manufacture motors and controls for roller shutters, awnings, blinds and doors, and we provide the Gaposa app (RollApp), the Hub (RollApp Hub) and the cloud service that connects them. In this statement, "we", "us" and "our" mean Gaposa Srl.

FAB Controls Ltd, a company based in the United Kingdom, develops, hosts and operates the app, the hub software and the cloud service for us. FAB Controls acts as our data processor: it uses your information only on our instructions and only for the purposes in this statement.

Data protection contact

• Name: Marco Gasparrini, Director
• Email: controller@gaposa.com
• Post: Gaposa Srl, Via Ete 90, 63900 Fermo (FM), Italy

The Gaposa app is not intended for children, and we do not knowingly collect information about children.

2. Information we collect

We collect the information below when you create an account, set up your hub and use the app.

Type	What it includes	Where it comes from
Account	Your name, email address, phone number and password. Your password is stored only in hashed form by our sign-in provider, Google, so we never see it	You, when you register
Home and devices	Your hub's serial number, firmware version and update history; the names, types and rooms of your motors and devices; their current position (for example, 60% open) and status, such as moving or online	You and your hub
Schedules	The schedules and timers you create, including dawn and dusk timers	You
Location	Your home's location, which we use to work out dawn and dusk times for your schedules and to get local weather data for your home	You, or your phone's location if you allow the app to use it
Activity	The commands sent to your devices and the events your hub reports, such as a motor reaching its position	Your app, your hub, and Google Home or Alexa if linked
Technical	The IP addresses of your phone and hub, your phone's model and operating system, the app version, sign-in records, and a push notification token for your phone	Your phone and hub
Crash reports	Your phone's model, operating system and app version, and what the app was doing when it crashed	Your phone, when the app crashes
Voice assistants	Your commands and an access token, if you link Google Home or Alexa (see Section 5)	Google or Amazon
Marketing and support	Your marketing preferences and any messages you send us	You

3. How we use your information

We use your information only where the law gives us a reason to. Most of what we do is needed to provide the app and hub to you.

What we use it for	Legal basis
Creating and managing your account, and signing you in	Performance of our contract with you
Controlling your motors, running your schedules and timers, and showing their position and status	Performance of our contract with you
Working out dawn and dusk times, and getting local weather data for your home	Performance of our contract with you
Sending push notifications about your devices, such as a schedule running or your hub going offline	Performance of our contract with you
Updating your hub's firmware	Performance of our contract with you, and our legitimate interest in keeping the service secure
Voice control through Google Home or Alexa, when you link them	Performance of our contract with you
Answering your questions and support requests	Performance of our contract with you
Finding and fixing faults, using crash reports and activity records	Our legitimate interest in keeping the service working
Keeping the service secure and preventing unauthorised access	Our legitimate interest, and our legal obligations
Telling you about changes to the service or to this statement	Our legal obligations
Sending you news about Gaposa products (see Section 4)	Our legitimate interest, or your consent where the law requires it
Meeting our tax, accounting and other legal obligations	Our legal obligations

A legitimate interest is a business reason to use your information that is not outweighed by your own rights and interests. We will only use your information for a new, unrelated purpose if we tell you first and explain the legal basis.

4. Marketing

We may email you news, offers and occasional requests for feedback about Gaposa products similar to the ones you use. Where the law requires your consent first, we will ask for it separately and clearly.

You can stop these messages at any time by using the unsubscribe link in any email, changing your preferences in the app, or contacting us. Stopping marketing does not affect service messages, such as notifications about your devices.

We do not sell your personal information, and we do not share it with other organisations for their own marketing.

5. Google Home and Amazon Alexa

You can link your Gaposa account to Google Home or Amazon Alexa to control your motors by voice and from the Google Home or Alexa app. Linking is optional: nothing is shared with Google or Amazon unless you link your account.

What we share with Google and Amazon

When you link your account, we share with the service you linked:

• Device details: the name, type (for example roller shutter, awning or blind), room and a unique identifier for each motor and device in your Gaposa account.
• Device status: the current position of each device, whether it is moving, and whether it is online.
• An account identifier: an identifier for your Gaposa account, so the service can match your requests to your devices.

We send this when you link your account and when you ask Google or Alexa about a device. We also send it when a device changes, for example when you move a blind with a remote control, so the Google Home and Alexa apps show the correct status.

What we receive from Google and Amazon

• Your commands, for example "open the living room shutter" or "set the bedroom blind to 50%". Google and Amazon turn your voice into a command before sending it to us. We do not receive voice recordings.
• An access token that lets Google or Amazon send commands to your Gaposa account. We do not receive your Google or Amazon password, and they do not receive your Gaposa password.

Why we use it

We use this information only to carry out your commands and to show the correct status of your devices in the Google Home and Alexa apps. We do not use information received from Google or Amazon for marketing or advertising.

Google's and Amazon's own use

Google and Amazon use the information they receive under their own privacy policies: Google's at policies.google.com/privacy, and Amazon's in the Amazon Privacy Notice for your country, available on the Amazon website and in the Alexa app.

How to unlink

You can unlink at any time:

• Google Home: in the Google Home app, find Gaposa in your linked services (Works with Google) and choose Unlink.
• Alexa: in the Alexa app, go to Skills & Games, then Your Skills, open the Gaposa skill and choose Disable Skill.

When you unlink, we stop sharing information with that service and delete its access token. Google or Amazon may keep information they have already received, under their own privacy policies.

6. Who we share it with

We share your information only with the organisations below, and only as far as each one needs it.

Who	Why	Their role
FAB Controls Ltd (United Kingdom)	Develops, hosts and operates the app, the hub software and the cloud service	Our processor, acting on our instructions
Google Cloud	Host our cloud service and database, handle sign-in, send push notifications and collect crash reports	Sub-processor, acting on our instructions
Amazon Web Services	Hosts the Alexa connection	Sub-processor, acting on our instructions
Google (Google Home) and Amazon (Alexa)	Let you control your devices by voice, only if you link them (see Section 5)	Independent controllers
Gaposa group companies	Provide customer support in your country	Act on our instructions
Other service providers, such as email delivery	Help us run the service, under contract	Our processors, acting on our instructions
Professional advisers, such as lawyers and auditors	Give us professional advice	Bound by professional confidentiality
Public authorities and regulators	Where the law requires us to share information	Use it under their own legal powers
A buyer of all or part of our business	If we sell or restructure our business. We anonymise the information where we can	Bound by confidentiality

Transfers outside the European Economic Area

FAB Controls is based in the United Kingdom, and Google and Amazon may process information in other countries, including the United States. When your information leaves the European Economic Area (EEA), we make sure it is protected by one of these safeguards:

• a European Commission decision that the country protects personal information adequately
• the European Commission's Standard Contractual Clauses in our contract with the recipient
• binding corporate rules, or an approved certification scheme that the recipient belongs to

Contact us if you would like details of the safeguard used for a particular transfer.

7. How long we keep it

We keep your information only as long as we need it for the purposes in Section 3.

Information	How long we keep it
Account, home and device information, your home's location, schedules and push notification token	While you have an account. When you delete your account, we delete this information within 30 days
Activity records and service logs	30 days
Crash reports	90 days
Google Home and Alexa access tokens	Until you unlink Google Home or Alexa, or delete your account
Marketing preferences	While you have an account. If you unsubscribe, we keep a record of it so we do not email you again
Support messages	As long as needed to resolve your request and deal with any follow-up questions or complaints
Records we must keep by law, such as tax and accounting records	For the period the law requires

We may keep information that has been anonymised so it can no longer identify you, for example for statistics.

8. Your rights

Under data protection law you have the right to:

• Access the personal information we hold about you and get a copy of it.
• Correct information that is wrong or incomplete.
• Delete your information. You can delete your account in the app or by contacting us.
• Restrict how we use your information, for example while we check that it is accurate.
• Move information you gave us to another organisation, in a structured, machine-readable format.
• Object to our use of your information for marketing at any time, or where we rely on our legitimate interests.
• Not be subject to decisions made only by automated processing that have legal or similarly significant effects on you. We do not make decisions like this.
• Withdraw your consent at any time, where we rely on it. This does not affect what we did before you withdrew it.
• Complain to a data protection authority. In Italy this is the Garante per la protezione dei dati personali, or you can complain to the authority in the country where you live. We would welcome the chance to deal with your concern first.

To use any of these rights, contact us using the details in Section 1. It is free, unless a request is clearly unfounded, repeated or excessive, in which case we may charge a reasonable fee or refuse it. We may ask you to confirm your identity first, so that we do not give your information to the wrong person. We aim to reply within one month, and will tell you if a complex request needs longer.

9. Security and changes to this statement

We protect your information with technical and organisational measures, including:

• encryption of everything sent between the app, your hub and our cloud service (HTTPS, and MQTT over TLS for the hub)
• encryption of our cloud database at rest, provided by Google Cloud
• passwords stored only in hashed form
• access limited to the people who need it to do their job, under a duty of confidentiality

We review this statement regularly. If we make important changes, we will tell you by email or in the app. This version replaces the RollApp privacy statement published on 24 September 2020.