Privacy notice

This notice explains which personal data we process when you visit the esisti.ai website or ask for early access to Esisti, why we do it, who we share the data with, how long we keep it and what rights you have. It is written under Article 13 of Regulation (EU) 2016/679 ("GDPR"). The Esisti app, once available, will have its own notice.

In short

• The website uses no cookies and stores nothing in your browser.
• We count visits with a tool that uses no cookies and does not identify you: we only see totals.
• If you ask for early access, we use your e-mail only to write to you about early access. No newsletters or promotions without your consent.
• Some providers are based in the United States. Transfers are protected by the safeguards the GDPR provides for.
• To exercise your rights, write to privacy@esisti.ai.

1. Who the controller is

The controller is Simone Spagnolo, sole trader (ditta individuale), with registered office in Via Roma 47/A, 22029 Uggiate con Ronago (CO), Italy, VAT number IT04182930133 ("Esisti" or "we").

• E-mail: info@esisti.ai
• Privacy and rights: privacy@esisti.ai

We have not appointed a data protection officer (DPO).

2. Which data we process and why

2.1 Visiting the website

When you open a page, your browser sends technical data: IP address, browser and device type, the page requested, date and time. We need them to show you the website and to protect it from abuse and attacks. The provider that hosts the website, Vercel, receives them in its technical logs.

Legal basis: our legitimate interest in running the website and keeping it secure (Art. 6(1)(f) GDPR).

2.2 Visit statistics

We use Cloudflare Web Analytics to know how many people visit the website, which pages they see, which website they come from, from which country, with what kind of device and browser, and how fast the pages load. The tool uses no cookies, stores nothing on your device and builds no profiles: we only see totals, never the individual person. To count the visit, Cloudflare receives the IP address and the browser's technical data.

Legal basis: our legitimate interest in understanding how the website is used and improving it (Art. 6(1)(f) GDPR). You can object by writing to us (section 7) or block the tool with your browser settings or a content-blocking extension.

2.3 Early access

What you give us. E-mail, your business's website and whether you are a business or an agency. We also record the language of the page.

What we do.

• The form uses Cloudflare Turnstile, a check against automated programs that loads only when you submit the form. To work, it receives the IP address and technical data about the browser.
• For the limit of 5 requests a day we keep the IP address only in the server's memory, without saving it: it is erased when the server restarts.
• We save the request as a contact on Resend, in the "Early access" list.
• We send you a confirmation e-mail and send our team a notification with the request's details, which arrives in our Google Workspace mailbox.

Use. We use your e-mail only to write to you about early access and the opening of Esisti. No newsletters or promotions without your consent.

Do you have to give us the data? No, it is your choice. Without an e-mail and a website, however, we cannot record the request.

Legal basis: steps taken at your request before a possible contract (Art. 6(1)(b) GDPR). For the check against abuse, our legitimate interest (Art. 6(1)(f) GDPR).

2.4 E-mails you send us

If you write to us, for example at info@esisti.ai or privacy@esisti.ai, we use your address and your message to reply. E-mails arrive in our Google Workspace mailbox.

Legal basis: answering your request (Art. 6(1)(b) GDPR) or our legitimate interest in handling correspondence (Art. 6(1)(f) GDPR).

3. Who we share the data with

The data are processed by us and by the providers listed below. Unless we say they are independent controllers, the providers act as processors on our behalf, under a contract (Art. 28 GDPR).

We also share data with authorities when the law requires it. We do not sell data.

Providers' notices: Cloudflare and, for Turnstile, the Turnstile Privacy Addendum; Google.

4. Transfers outside the European Union

These providers are based in the United States or belong to groups based in the United States:

The EU-US Data Privacy Framework applies to certified US companies and is based on the European Commission's adequacy decision of 10 July 2023. The standard contractual clauses are those approved by the European Commission (Decision (EU) 2021/914). You can ask us about the safeguards, or for a copy, at privacy@esisti.ai.

5. How long we keep the data

• The website's technical logs: for a short period, under Vercel's rules, for the running and security of the website.
• Visit statistics: only totals remain, with no data that identifies you.
• IP address for the request limit: only in the server's memory, for one day at most; erased when the server restarts.
• Early-access requests: until we write to you about the opening of access, and in any case no longer than 12 months from the request. The same applies to the notification in the team's mailbox. If you create an Esisti account, we delete the request and the app's notice applies.
• E-mails you send us: as long as needed to handle the request, and in any case no longer than 24 months.

We may keep data longer when we need it to defend a right or the law requires us to keep it.

6. Cookies and data stored in the browser

• The website sets no cookies and stores no data in your browser.
• Visit statistics (section 2.2) use neither cookies nor other data stored on your device.
• Cloudflare Turnstile loads only when you submit the early-access form. It is a security tool: to work, it collects technical data about the browser and the IP address.
• Fonts are served from our own servers: your browser does not contact Google Fonts.

We use no profiling, advertising or statistics cookies. That is why we do not need your consent and show no banner (Art. 122 of the Italian Personal Data Protection Code, Legislative Decree 196/2003, and the Italian Data Protection Authority's cookie guidelines of 10 June 2021). If we ever use tools of another kind, we will ask for your consent first.

7. Your rights

You have the right to:

• access: know whether we process data about you and get a copy;
• rectification: correct wrong or incomplete data;
• erasure: ask us to delete the data, in the cases of Art. 17 GDPR;
• restriction: ask us to stop using the data for a while, for example while we check a complaint of yours;
• portability: receive the data you gave us in a structured, machine-readable format, for processing based on your request;
• objection: object at any time, on grounds relating to your situation, to processing based on legitimate interest, including visit statistics.

To exercise them, write to privacy@esisti.ai. We answer within one month; if the request is complex we may take two more months, and we will tell you. It is free of charge.

8. Complaint to the supervisory authority

If you believe we process your data in breach of the GDPR, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work. If you like, write to us first: we will try to sort it out together.

9. Changes to this notice

We update this notice when the website, the providers or the law change. You always find the date of the last update at the top.