Privacy and cookie policy

1. Data controller

The data controller is Anomaleet Srl · Via Pace 17, 20866 Carnate (MB) · P.IVA 10289790965 · [email protected].

For any request about your personal data, write to [email protected].

2. What data we collect

Data you provide: when you fill in the contact form we collect organisation, full name, work email, organisation size and the message text.

Data collected automatically: if you consent to statistical cookies, Google Analytics collects browsing data (pages viewed, visit duration, device and browser type, referrer, approximate location derived from the IP address).

Virtual assistant (chat) data: the text of the messages you type and the generated replies, a random conversation identifier, date and time, the IP address in pseudonymised form and technical browser data. Details are in section 5.

We do not collect special categories of data and we do not carry out advertising profiling.

3. Purposes and legal basis

Replying to requests sent through the form or by email: pre-contractual measures taken at your request (Art. 6.1.b GDPR).

Measuring site usage in aggregate form to improve it: your consent (Art. 6.1.a GDPR), which you can withdraw at any time.

Answering the questions asked to the virtual assistant: pre-contractual measures taken at your request (Art. 6.1.b GDPR); preventing abuse of the chat service: legitimate interest of the controller (Art. 6.1.f GDPR).

Keeping the site running and secure: legitimate interest of the controller (Art. 6.1.f GDPR).

4. Cookies and similar technologies

The site uses browser local storage to remember your cookie choice. It is not a tracking cookie and is never sent to any server.

Statistical cookies are set only after your consent. If you decline, the Google Analytics script is not even loaded and no data is sent to Google.

5. Virtual assistant (site chat)

The site offers a chat run by a virtual assistant powered by artificial intelligence. You are not talking to a person: replies are generated automatically from information provided by Anomaleet, may contain errors or inaccuracies, and are neither commercial offers nor binding technical advice. The automated nature of the service is stated in the chat itself. To talk to a member of the team, write to [email protected].

Data processed: the text of the messages you type and the generated replies; a random conversation identifier; date and time of each message; to prevent abuse, the IP address in pseudonymised form (non-reversible keyed hash) and technical browser data (user agent, referring page). The assistant has no access to any other data about you, nor to accounts or reports. Please do not enter unnecessary personal data, yours or of third parties, in the chat.

Purposes and legal basis: providing the information you request (pre-contractual measures taken at your request, Art. 6.1.b GDPR); preventing abuse and keeping the service secure (legitimate interest, Art. 6.1.f GDPR). No automated decision producing legal or similarly significant effects on you is taken on the basis of the chat.

Providers: the service runs on Cloudflare Workers (Cloudflare, Inc.); to generate replies, messages are sent via API to OpenAI, L.L.C., acting as processor, which under its API services terms does not use the data to train its models; the conversation is stored in a database hosted by Supabase, Inc. in a data centre in the United Kingdom.

Retention: conversations are kept for 24 hours from the last message, to preserve the context of the dialogue, and then deleted; technical service logs, which do not contain the message text, are kept by Cloudflare for no longer than 7 days. The conversation identifier is stored in your browser (sessionStorage) and is removed when the tab is closed or with the “New conversation” command. To request earlier deletion of a conversation, write to [email protected] indicating the approximate date and time.

6. Who we share data with

Contact form data is delivered through EmailJS Inc., acting as processor for the sole purpose of delivering the message to our mailbox.

Statistical data is processed by Google Ireland Ltd. as processor, under the Google Analytics terms.

The site is hosted on Cloudflare Pages (Cloudflare, Inc.), acting as processor for hosting and content delivery through its CDN network, and processing technical connection logs, including the IP address, to operate and secure the service.

Virtual assistant chat data is processed by OpenAI, L.L.C. (reply generation) and Supabase, Inc. (database) as processors, as described in section 5.

Data is never disclosed or sold to third parties for commercial purposes.

7. Transfers outside the European Economic Area

Some providers — including Cloudflare, Inc., EmailJS Inc. and OpenAI, L.L.C. — are based in the United States. Transfers rely on the European Commission standard contractual clauses and, where applicable, on the provider’s certification under the EU-U.S. Data Privacy Framework.

Chat data is stored by Supabase, Inc. in the United Kingdom, a country covered by a European Commission adequacy decision.

8. How long we keep data

Contact requests: 24 months from the last exchange, unless a contract arises, in which case statutory terms apply.

Conversations with the virtual assistant: 24 hours from the last message; technical chat service logs: no longer than 7 days.

Statistical data: 14 months, per the Google Analytics retention setting.

9. Your rights

You may request access, rectification, erasure, restriction and portability at any time, and object to processing based on legitimate interest (Art. 15-22 GDPR).

You can withdraw consent to statistical cookies through the “Cookie preferences” link at the bottom of the page, without affecting the lawfulness of prior processing.

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

10. Changes

Any update to this policy is published on this page with a new update date.