Privacy Policy

Who is responsible

The data controller is Paolo Bonacchi, an individual based in Milan, Italy, reachable at pbonacchi@gmail.com. There is no company behind this deployment: it is a personal project in beta test, and the person named here answers for it directly.

What this site collects

One form on this site collects anything at all: the demo request. When you submit it, the following is stored:

• your name and email address, which are required;
• your company, if you choose to give one;
• the vertical and the subject you picked, and the language the page was in;
• your IP address, which is used only to limit how many requests can be sent from one source in a minute;
• a one-way hash of the verification token emailed to you, with the times it was sent and expires. The token itself is never stored.

Nothing else on this site records anything about you. Reading the pages, switching language and changing theme send nothing anywhere.

Cookies, analytics and trackers

This site sets no cookies, runs no analytics and embeds no third-party trackers. There is no consent banner because there is nothing to consent to.

The one thing written to your device is your light or dark theme preference, kept in your browser’s local storage and written only when you click the theme toggle. It never leaves your browser, and clearing your site data removes it.

Why it is collected, and on what basis

• Your name, email, company and choices are processed to answer the request you made and to build the workspace you asked for — steps taken at your request before any contract (GDPR Art. 6(1)(b)).
• Your IP address is processed to keep the form from being abused, which is a legitimate interest in the security of the service (GDPR Art. 6(1)(f)). It is used for nothing else and is not profiled.

The demo workspace, and what you put in it

Confirming your email creates a workspace on the platform. Whatever you enter into it is stored in the platform’s database and is yours; nobody is invited to it but you and the people you invite.

Please do not put real personal data about other people — clients, candidates, employees — into a demo workspace. The platform is in beta test, there is no data processing agreement in place, and it is not the right place for anyone else’s information.

A demo workspace is prevented, on the server, from sending email, text messages or electronic invoices to the outside world. That restriction is enforced in the code rather than left to the interface.

Who else processes it

The service runs on infrastructure operated by others. Each of these processes data on the controller’s instructions, under its own data processing terms:

• Vercel — hosting and delivery of the websites and their server functions, request logs, and analytics where consented.
• Supabase — database, authentication, file storage and edge functions.
• Anthropic — the AI features inside the platform (only when the workspace enables the AI features).
• OpenAI — search indexing (embeddings) of workspace content; the stand-in that serves AI requests when the primary provider is unavailable — only where the AI features are enabled; and, where the operator has enabled it and a member opens one, a real-time voice session in which that member’s speech is processed as audio.
• Google — sign-in with a Google account (OAuth), and the Google Workspace connector when a workspace connects it.
• Freshservice — creation of IT onboarding tickets from the staffing module (only when the workspace configures the Freshservice connector).
• Resend — delivery of transactional e-mail: invitations, verification and notification messages, and digests.
• Twilio — delivery of text messages: the recipient’s phone number and the message body (only when the workspace enables the SMS channel).
• Sentry — error reports from the applications and the edge functions: the failing request’s URL and metadata, and whatever an error message or stack trace carries.
• Stripe — subscription checkout, invoices and payment details for a paid plan (only when the workspace subscribes to a paid plan).

Some of these process data outside the European Economic Area. Where they do, the transfer relies on the safeguards in that provider’s own data processing terms. No other party receives your data, and none of it is sold, shared for advertising, or used to train anybody’s model by the controller.

How long it is kept

A demo request that never became a workspace — one you never confirmed, or that was not approved — is deleted automatically 90 days after you sent it. That is a nightly job in the database, not a reminder somebody has to act on. A request that did create a workspace is kept for as long as that workspace exists, because it is the record of who asked for it. Anything here is deleted sooner if you ask, and a workspace and its contents are deleted when you ask for it.

Your rights

You can ask for a copy of your data, for it to be corrected, deleted, or restricted, for it in a portable form, and you can object to processing based on legitimate interest. Write to the address above and you will get an answer without undue delay and within one month.

If you believe your data is being handled wrongly, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to the authority where you live.

Changes

This page changes in the same commit as the code it describes, and the date at the top is the date of that change. There is no archive of previous versions yet.