StopTime analyses and stores measurements on the device. It does not automatically upload videos, photographs or reports to CE4U. Purchases and entitlement checks require communication with Google Play and the RAVENG commercial service. After the terms have been accepted, the app automatically requests timestamps for evidence created or imported, as described in section 4.
Connections at startup. The app automatically contacts Google Play and the RAVENG commercial service, including when you use only the free features. If a service is unavailable, the app may still attempt the connection and receive an error.
Version scope. Nameplate OCR and automatic timestamp requests are introduced in Android version 1.1.0. Android versions 1.0.x do not include OCR and request a PDF timestamp only when the user explicitly selects that action.
1. Controller and contact details
CE4U S.r.l., trading as RAVENG, is the controller for processing by the Android commercial service, support and test management. Registered office: Via Gioacchino Rossini 29/2, 37012 Bussolengo (VR), Italy; tax/VAT number 04731920239; REA VR-444364.
For privacy requests, write to info@raveng.it or posta@pec.ce4u.it, with the subject “Privacy StopTime Android”.
For recordings and reports, the controller is whoever actually determines the purposes and means of the activity, such as the company, client or professional. This notice does not replace the information that must be provided to people recorded. The app licence does not give CE4U remote access to the local archive.
2. On-device data and permissions
Videos, audio from recordings and imported originals, event images, machine data, declared name and organisation, notes, parameters, results, reports and learning progress remain local. Terms receipts record declarations, choices, version, the text digest and the device date: they are not sent to the commercial service and do not authenticate the operator’s identity. Accepting the terms of use is not general consent to personal data processing.
The camera is used for recordings and nameplate photographs that you request. You can deny or revoke permission in Android settings and use compatible features, including importing files. Starting with Android build 11, internal recording also requires microphone permission to capture audio with video. The microphone is used while the app is in the foreground: when you open the camera, a brief in-memory check verifies the built-in microphone and 48 kHz audio; those samples are not saved. When you start recording, audio and video are processed and stored on the device. Preview luminance and, when available, the tilt sensor support framing checks; they are not sent to the commercial service. You can deny or revoke this permission and import a compatible original. Earlier builds do not record audio or require microphone permission. Android’s document and photo pickers grant access only to selected files. General gallery, location, contacts and SMS access are not requested.
No named StopTime account is required. The app does not include advertising, advertising identifiers or CE4U behavioural analytics tools. It uses a pseudonymous technical identity for commercial entitlements and the Google Play Billing library, which also sends technical diagnostics to Google as described in section 3. External connections involve network data, including the IP address.
3. Purchases, technical identity and testing
The app generates a random installation identifier and a recovery secret, protected using Android Keystore. It sends Google Play digests of the identifier and, for a single report, the session, without names or machine data.
The CE4U service at https://raveng.it/v1/billing/ receives the technical identifier, app package, purchase data and tokens, and session reference. It verifies purchases, duration, refunds and revocations with Google and retains entitlements for recovery and reprints. Before payment it records the link to the session, even if the purchase is not completed, to recognise payments completed while the app is closed.
The secret is sent over HTTPS to authenticate you; the commercial register stores an HMAC representation, not the plain value. Purchase tokens are encrypted at rest; identifiers, orders and other register metadata are not fully encrypted by this software. The service does not receive videos, photographs, complete reports or card numbers. Google handles payments under its own privacy policy.
In the commercial Android version, the client automatically initiates HTTPS restore requests at startup, sending the installation identifier, app package and recovery secret in the authentication header. This also happens before a purchase, and connection attempts also occur when the RAVENG service is not operational; the operation may then fail. Exports check entitlement online: service unavailability can prevent export without automatically starting replacement purchases. Recovering entitlements on another installation requires the identity in the encrypted backup; the Google account alone does not recreate it.
If you enter a review code, the service retains its HMAC, its association with the technical identity and the exported sessions. Authorisations are renewed online. Payments are disabled and files identify their test origin.
Billing library diagnostics. Google Play Billing automatically sends Google data about call outcomes, errors and the service connection. This includes a random Billing client identifier and metadata such as app and Android versions, device model and build, configured language/country and network type, with technical SIM operator codes when available. These are not geographic coordinates. Google uses this data to improve library performance and support; StopTime provides no switch to disable these diagnostics. This flow is separate from payments and can occur without purchases and even when the RAVENG service is unavailable. The Google privacy policy and official Billing logging information apply.
Connections can generate technical network data and error or security logs. Website logs from previous connection attempts may retain IP address, date and time, URL, outcome, response size and device or app information. Security checks could also record headers, meaning the technical information accompanying a request. HMAC protection of the secret in the commercial register does not retroactively erase these logs.
App-managed connections use HTTPS with system TLS verification. The RAVENG and TSA clients do not automatically follow redirects; Google’s diagnostic component may handle them. The app disables unencrypted HTTP traffic.
4. Nameplates and timestamps
Reading a nameplate. When you photograph or select a nameplate, Google ML Kit’s Latin recognition model, bundled with the app, processes the image on the device, including offline. Google states that images, input text and recognition results are not sent to its servers. Suggested fields must be checked by the operator; fields already filled in are not automatically overwritten. The photograph stored in the archive is re-encoded as JPEG without location metadata.
ML Kit diagnostics. The SDK may communicate with Google for updates and compatibility and sends technical performance and usage data: manufacturer/model and operating system version, available accelerators, app package and version, installation identifier, latency, configuration and input/output sizes, feature version, events and error codes. Google uses this information for diagnostics and service usage analysis; it is not the photo content or recognised text. Connections involve the IP address. The ML Kit terms and privacy information, data collection disclosure and Google privacy policy apply. StopTime provides no control to disable SDK diagnostics.
Automatic timestamps.
After you have accepted the current terms, importing or recording a video, confirming an analysis and creating a report add requests for the video, analysis data, PDF and manifest to the local queue. When the app is active and a network is available, requests send Sectigo and FreeTSA, over HTTPS, only the file’s SHA-256 digest and RFC 3161 request data, including the algorithm and nonce. The queue retains unfinished requests and retries; no additional command is needed for each timestamp. Demonstration files do not initiate these requests. Providers also receive the IP address, connection time and metadata. PDFs, videos and report names are not uploaded. A digest can be compared with a known file and is not necessarily anonymous.
Timestamping automatically accompanies the measurement operations described above, including before a report purchase. The free Learn feature does not create timestamp requests. The technical integrity signature, by contrast, is applied only on command and uses a local key. Requests, responses and verification remain in separate local files without modifying the PDF. Local deletion does not erase provider records: see Sectigo Privacy, Sectigo documents and FreeTSA CPS. No qualified timestamp or professional signature is promised.
5. Purposes, legal bases and provision of data
| Processing | Purpose and legal basis |
|---|---|
| Requested features, purchased entitlements, recovery and reprints | Delivering the requested service: Article 6(1)(b) GDPR, to the extent necessary and when you are party to the relationship. |
| Contractual support and participation in requested tests | Handling requests and tests: Article 6(1)(b). |
| Professional contacts on behalf of the user organisation | Legitimate interest in managing the relationship with the organisation: Article 6(1)(f), limited to relevant data. |
| Reliability of billing and OCR integrations, technical diagnostics | CE4U’s legitimate interest in app reliability: Article 6(1)(f). Google’s own processing is governed by its policy and the legal bases described there. |
| Security and protection of entitlements | Legitimate interest in preventing fraudulent reuse and recreation of deleted data: Article 6(1)(f). |
| Timestamping associated with evidence of a requested measurement | Performing the documentary function described: Article 6(1)(b). Providers’ own processing is governed by their respective policies. |
Technical identity and library diagnostics are processed automatically in the commercial version. Purchase history and timestamp data relate to user-selected features; timestamps are requested automatically when the evidence identified in section 4 is created. Selecting a photo for OCR and providing support attachments are optional. The bases applicable to recordings depend on the activity organised by the company or professional. We do not use the data for advertising or commercial profiling.
6. Recipients and transfers
Relevant data may be accessed by authorised CE4U personnel, hosting, email and support providers, and authorities where required by law. Google and timestamp providers receive the data described above; you choose the recipients of exported files.
RAVENG infrastructure. Recipients include the server infrastructure, backup storage and technical maintenance providers used by CE4U for the commercial service. According to the controller’s statement of 30 September 2026, servers and backups are located in Italy. This concerns their location and does not certify the country from which each provider may exercise administrative access. For information about recipients, use the contact details in section 1.
Google. Google services may process data outside the European Economic Area. Google publishes its transfer mechanisms, including the Data Privacy Framework for transfers covered by Google LLC’s certification and standard contractual clauses where necessary; the same page explains how to request a copy. This reference describes the instruments declared by Google without attributing to CE4U contracts it has not entered into.
Sectigo. Its privacy policy provides for international processing, including in the United Kingdom, United States, Canada and India. It describes instruments such as adequacy decisions and standard clauses and allows details and copies of safeguards to be requested from the provider. The general policy alone does not identify the regime applicable to every timestamping request.
FreeTSA. Its public CPS states that the service does not require or retain personal information, but does not specify processing countries or safeguards for transfers outside the EEA. CE4U therefore does not certify European data location, the absence of technical logs or a particular transfer safeguard for this service. The function described in section 4 sends the digest and necessarily communicates the IP address to providers.
The Italian location of RAVENG infrastructure does not automatically extend to Google and the TSAs. HTTPS protects transmission but does not determine the processing country or replace safeguards required by law.
7. Backup and sharing
Local data is protected by the app container. Android automatic backup is disabled. You can create an AES-256-GCM encrypted backup with a password of at least 12 characters, which CE4U does not retain and cannot recover. Restoration requires an empty archive and the same Android edition; it does not automatically transfer Apple data or purchases.
Printing, sharing and exporting send files to the destinations you choose through Android. Check recorded people, personal data and confidential information before sending. Delivered copies and selected services follow their own rules.
8. Retention and deletion
You can request deletion without the app: write to info@raveng.it or posta@pec.ce4u.it with the subject “StopTime Android data deletion”. The request will be verified proportionately to its connection with the technical identity. Do not unnecessarily send recovery secrets, card details, identity documents or complete reports. If you have lost the identity and backup, your email alone cannot reliably identify the register entry: we will explain the available checks and any applicable retention.
Local archive. You can delete a session from Archive. Removing the app may delete local data, but not the remote commercial register, shared copies, backups, Google purchases or provider records. Subscription expiry does not delete the archive.
Commercial register. Identity, purchases and entitlements remain for verification, recovery and reprints until deletion is requested. Preparatory links and Google events serve to reconcile payments and prevent duplication, without a general automatic expiry. Unattributed notifications retain an encrypted token and metadata until identification through Google; they are removed if the identity has been deleted. Retention must be limited to data necessary for these purposes.
Remote deletion. The service allows removal of the identity, purchases, entitlements, preparatory links, review enrolment and associated notifications. It requires installation authentication and a separate confirmation valid for ten minutes. In the app, use Archive → Subscription icon (payment card, top right) → Service data → Delete remote data…. You can also email a request to the contacts above without the app. After completed deletion, the old identity, including in Android backups, cannot recover remote entitlements.
This does not delete local files, refund purchases or cancel Google Play subscriptions. To stop a subscription, also use “Manage subscriptions on Google Play”.
To prevent recreation from old tokens and notifications, HMAC digests of the obfuscated identity and known tokens remain with the deletion date: these are technical identifiers, without plain UUID, secret, tokens or orders. They do not expire automatically and are used for as long as such attempts remain possible. HMACs used to repeat a confirmation when its response was lost remain for 24 hours and are removed at the next service cycle.
Server copies. Deletion from the active register does not retroactively modify every backup or snapshot. An old register must not be reactivated without reconciling it with subsequent deletions. Immediate automatic deletion of all copies is not provided.
Technical service logs. Logs support security, error handling and service continuity. For existing website logs, daily archiving is configured with 90 archives for processed logs and errors and 7 for security checks. These are archive counts, not guaranteed deletion periods of 90 or 7 days. Files still in use and backups are managed separately.
Diagnostics and external providers. Google diagnostics are not described as ephemeral: the transport component may queue events on the device and Google processes them for the purposes in its policy. This notice does not set a deletion deadline for Google or TSA records, and CE4U cannot delete them using the RAVENG service command. You can also contact the respective providers about such data.
Support and tests. Data received is used to handle and complete the request or test and, where necessary, document activities and disputes, limiting further retention to what is relevant. Obligations relating to individual documents do not automatically extend to videos and attachments.
9. Beta testing and external websites
Google Play may make distribution, quality and feedback data available to CE4U to manage testing and correct issues. Attachments chosen for feedback are separate from local measurement processing. You can leave the programme using the relevant Google Play link.
Support, source and privacy links open the external browser. Website cookies and statistics are described in the raveng.it privacy policy, which is separate from this notice.
10. Rights and updates
Where the GDPR provides, you can exercise rights of access, rectification, erasure, restriction, objection and portability using the contacts in section 1. You can object to processing based on legitimate interests for reasons relating to your particular situation and lodge a complaint with the Italian Data Protection Authority.
For local content, contact the controller of the measurement activity and use the app’s features; CE4U has no remote access to these files. For Google’s and providers’ own processing, you can also use the contacts in their policies.
The app is intended for adults. It calculates physical quantities and does not make decisions about people that have legal effects. Changes to the described data flows will require an update to this notice.