This privacy policy governs the Ulabase service, provided by SoftInstigate Srl Società Benefit under Italian and EU law at https://ulabase.com. Please contact us at info@ulabase.com for any questions.
Information on Personal Data Processing pursuant to Articles 12 and following of the General Data Protection Regulation (GDPR)
Last updated: September 29, 2026
Regulation (EU) 2016/679 ("General Data Protection Regulation"), hereinafter GDPR, provides for the protection of natural persons with regard to personal data.
SoftInstigate is committed to ensuring that the processing of data relating to a natural person (hereinafter "data subject") is based on the principles of correctness, lawfulness and transparency, as well as protection of confidentiality and the rights of the data subject.
SoftInstigate will process your personal data in compliance with regulations, with the utmost care, implementing effective management procedures and processes to ensure the protection of processing, committing to protect the information communicated in such a way as to avoid unauthorized access or disclosure as well as to maintain data accuracy and to ensure appropriate use of the same.
We provide you pursuant to art. 13 of the GDPR (EU regulation 2016/679) and in consistency with the principle of transparency, the following information in order to make you aware of the characteristics and methods of data processing:
1. Formerly RESTHeart Cloud
Until September 2026 Ulabase was named "RESTHeart Cloud" and was provided at the web address https://cloud.restheart.com. RESTHeart Cloud is now Ulabase: every user of RESTHeart Cloud is a user of Ulabase at https://ulabase.com. The Data Controller is the same, SoftInstigate, and the personal data collected for RESTHeart Cloud continue to be processed for Ulabase, for the same purposes and on the same legal bases, as described in this privacy policy, which replaces the one that applied to RESTHeart Cloud.
2. Identity and Contact Details
The Data Controller is SoftInstigate S.R.L. Società Benefit
- Legal representative: Andrea Di Cesare
- Registered office: Via del Beato Cesidio 49, 67100, L'Aquila, Italy
- Email: info@ulabase.com
- Certified email (PEC): softinstigate@legalmail.it
3. Contact Details of the Data Protection Officer (DPO)
As SoftInstigate does not fall within the cases provided for in art. 37, paragraph 1, of the GDPR, a Data Protection Officer has not been appointed.
4. Types of Data Processed, Purpose of Processing, Legal Basis and Legitimate Interest
SoftInstigate collects and/or receives autonomously or through third parties the personal data indicated below which will be processed for the purposes described below.
4.1. Types of Data Processed
The information concerning you as a Data Subject includes:
- Personal data (e.g., name, surname, physical address, nationality, province and municipality of residence, landline and/or mobile phone, tax code, email address/es);
- Billing data necessary for invoicing the subscriptions purchased from SoftInstigate;
- Account data for Ulabase registration, including username, password hash, organizations, service tier selection, and region preferences;
- Service usage data including API calls, database operations, resource consumption, and service performance metrics for billing, monitoring, and service optimization purposes;
- Technical data such as IP addresses, user agent strings, and connection logs necessary for service provision and security;
- Payment data necessary for billing and subscription management. Payment processing is handled using Stripe as our payment provider, and you are invited to review their privacy policy;
- Web traffic data processed in aggregated and automated form through privacy-focused analytics, collected only for statistical purposes and never used for user identification or profiling;
- Communication data including emails, support requests, and other communications with SoftInstigate for customer support and service delivery purposes;
- Marketing data with explicit consent, including preferences for receiving information about Ulabase, updates, and promotional materials.
4.2. Purpose of Processing and Legal Basis
Personal data is processed for the following purposes:
Service Delivery and Performance (Legal basis: Contract performance)
- Provision of the Ulabase service
- Account management and authentication
- Technical support and customer service
- Service monitoring and optimization
- Billing and payment processing
Legal and Regulatory Compliance (Legal basis: Legal obligation)
- Tax and accounting obligations
- Compliance with Italian and EU regulations
- Data retention as required by law
Legitimate Business Interests (Legal basis: Legitimate interest)
- Service improvement and development
- Security monitoring and fraud prevention
- Statistical analysis and reporting
- Business communications related to existing services
Marketing and Communications (Legal basis: Consent)
- Promotional communications (with explicit consent)
- Newsletter and service updates (with explicit consent)
- Market research and surveys (with explicit consent)
- Onboarding emails following Ulabase registration
By creating an account, you agree to receive product updates and marketing communications. You can unsubscribe at any time.
5. Data Sharing and Third Parties
SoftInstigate may share personal data with:
- Payment Processors: Stripe for subscription payments
- Cloud Infrastructure Providers: AWS, MongoDB Atlas and other cloud providers for service delivery
- Technical Partners: Limited to service delivery requirements
- Legal Authorities: When required by law or legal process
All third-party processors are bound by appropriate data protection agreements and GDPR compliance requirements.
6. Data Retention
Personal data is retained for different periods based on the purpose:
- Account data: Duration of service plus 3 years for legal compliance
- Billing data: 10 years as required by Italian tax law
- Service usage data: Up to 2 years for service optimization
- Marketing data: Until consent is withdrawn
- Communication data: 3 years for customer service purposes
7. Your Rights Under GDPR
As a data subject, you have the following rights:
- Access: Right to obtain confirmation about data processing and access to your data
- Rectification: Right to correct inaccurate or incomplete data
- Erasure: Right to deletion of personal data under certain conditions
- Restriction: Right to restrict processing under certain conditions
- Portability: Right to receive your data in a structured format
- Objection: Right to object to processing based on legitimate interests
- Consent withdrawal: Right to withdraw consent for marketing communications
To exercise these rights, please contact us at info@ulabase.com.
8. Data Security
SoftInstigate implements appropriate technical and organizational measures to protect personal data, including:
- Encryption of data in transit and at rest
- Access controls and authentication systems
- Regular security audits and monitoring
- Staff training on data protection
- Incident response procedures
9. International Data Transfers
Data may be transferred to countries outside the EU for service delivery purposes. All transfers are conducted with appropriate safeguards, including:
- EU adequacy decisions
- Standard contractual clauses
- Certification mechanisms
10. Cookies and Tracking Technologies
The cookies that Ulabase sets are listed in the Ulabase Cookie Policy.
10.1. Analytics
We use privacy-focused analytics to understand how Ulabase is used:
- No tracking cookies: We do not use tracking cookies that identify individual users
- Aggregated data only: All analytics data is processed in aggregated form
- Privacy-first approach: Our analytics solution is designed to respect user privacy
- No personal identification: Analytics data cannot be used to identify individual users
10.2. Server-Side Tracking
For Ulabase (ulabase.com), we implement privacy-focused server-side tracking to measure service performance and marketing effectiveness.
Privacy-First Approach: We have deliberately designed our tracking system to maximize your privacy:
- No tracking cookies: We built a cookie-free tracking system to avoid invasive browser tracking
- No personal data sharing: We only send pseudonymized (hashed) identifiers to Google, never your actual email address or personal information
- Server-side only: All tracking happens on our servers, not in your browser, giving you more control
- Purpose-limited: We track only conversion events (signups, provisioning, purchases) to measure advertising campaign effectiveness, not your browsing behavior
Google Analytics 4 (GA4)
We use GA4 to track page views and user interactions within ulabase.com:
- Server-side tracking: All tracking is performed server-side without client-side cookies
- Data pseudonymization: Email addresses are hashed (SHA-256) creating pseudonymous identifiers that cannot be reversed
- Data collected: Page views, pseudonymous user identifiers (hashed email addresses), referring pages, and Google Click IDs (gclid) when present
- Purpose: Understanding service usage patterns, measuring marketing campaign effectiveness, and improving user experience
- Legal basis: Consent obtained during account registration (Article 6(1)(a) GDPR)
- Data sharing: Only pseudonymized data is shared with Google LLC under their data processing agreement and GDPR-compliant standard contractual clauses
- Privacy protection: Users cannot be individually identified from GA4 data; all personal identifiers are hashed before transmission
Google Ads Conversion Tracking
We track conversions (signups, service provisioning, purchases) for advertising campaign measurement:
- Enhanced Conversions: We use Google Ads Enhanced Conversions with hashed email addresses to measure conversion performance
- Data collected: Hashed email addresses (SHA-256), conversion events (signup, provision_free, purchase), conversion values, and Google Click IDs (gclid) when available
- Purpose: Measuring advertising campaign effectiveness and optimizing ad performance
- Legal basis: Consent obtained during account registration (Article 6(1)(a) GDPR)
- Data hashing: Email addresses are hashed using SHA-256 before transmission to Google for privacy protection
- Data sharing: Hashed conversion data is processed by Google LLC for conversion attribution under their data processing agreement
- No cookies required: Conversion tracking works even when ad blockers or privacy browsers block tracking cookies
Consent and Control
By creating a Ulabase account, you consent to this server-side tracking for service improvement and marketing measurement. You can:
- Withdraw consent: Contact us at info@ulabase.com to opt out
- Request data deletion: Request deletion of your tracking data at any time
- Continue using services: Opting out of tracking will not affect your ability to use Ulabase
Data Retention
- GA4 data is retained according to Google's data retention policies (configurable, typically 2-14 months)
- Conversion event logs are retained in our systems for up to 90 days for audit purposes
- Google Click IDs (gclid) are stored for up to 90 days to enable conversion attribution
- Upon request, we will delete your tracking data within 30 days
10.3. Essential Cookies
We may use essential cookies necessary for:
- Service authentication and session management
- Security and fraud prevention
- Service delivery and functionality
10.4. Cookie Consent
For non-essential cookies, we will obtain your explicit consent before placing them on your device.
11. Data Processing for Ulabase
For Ulabase, data processing includes:
- Account registration and management through ulabase.com
- Payment processing through Stripe
- Service usage monitoring and billing
- Self-service support and documentation access
- Onboarding email series: After registration, users will receive up to 6 emails with tips and suggestions over a period of several days to help them get started with the service. Users can unsubscribe from these emails at any time using the unsubscribe link provided in each email
The Customer is the data controller of the personal data that their own applications process through Ulabase, such as the users of the Customer's services; for such data SoftInstigate acts as data processor, as set out in the Ulabase Terms and Conditions.
12. Children's Privacy
Our services are not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.
13. Changes to This Privacy Policy
We may update this privacy policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. We will notify users of material changes by:
- Posting the updated policy on our website with a new "Last updated" date
- Sending email notifications to registered users for significant changes
- Providing notice through the Ulabase console where applicable
Continued use of our services after changes become effective constitutes acceptance of the updated privacy policy.
14. Contact Information
For any questions about this privacy policy or your personal data:
- Email: info@ulabase.com
- Mail: SoftInstigate Srl Società Benefit, Via del Beato Cesidio 49, 67100, L'Aquila, Italy
- Subject: Please reference "Privacy Policy" or "GDPR Request" in your communication
15. Complaints
You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) if you believe your data protection rights have been violated:
- Website: https://www.gpdp.it
- Address: Piazza di Monte Citorio, 121, 00186 Roma RM, Italy
16. Legal Framework
This privacy policy is governed by:
- EU General Data Protection Regulation (GDPR) 2016/679
- Italian Legislative Decree 196/2003 as amended
- Italian Civil Code provisions on privacy and data protection
- EU Digital Services Act and related regulations
Questions About This Policy?
If you have questions about this privacy policy or how we handle your personal data, please contact us at info@ulabase.com. We're committed to protecting your privacy and will respond to your inquiry promptly.