Personal Data Processing Policy
pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR)
Last updated: 21 September 2026
1. Data Controller
The Data Controller is Martuccio AI S.r.l.s.
- Registered office: Via Fontevivo 19/F, 19125 La Spezia (SP)
- VAT: 01603100114
- PEC: martuccioai@pec.it
- Email: info@martuccioai.com
2. Types of Data Collected
a) Data voluntarily provided by the user
Text of the question: the content the user writes in the field of the conversational assistant on the homepage, and the generated answer. The field is free and requires no identifying data: what it contains is up to the user. Question and answer are logged together with a random conversation identifier, which is not linked to the IP address or to any other user data; email addresses and phone numbers the user may write are replaced automatically before logging.
b) Browsing data
The computer systems and software procedures used to operate the website acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (e.g., IP addresses, browser type, operating system, domain names and addresses of websites from which access was made).
c) Cookies and tracking technologies
The website uses technical cookies, necessary for its operation and not subject to consent, and third-party Google Analytics 4 analytics cookies, installed only after the user has given consent and for statistical measurement purposes. Vercel Analytics is also used, collecting data about website usage in aggregate, anonymous form without profiling cookies. When the booking calendar is opened, the Cal.com service sets its own technical cookies. Categories, durations and withdrawal procedures are detailed in section 10.
d) Data provided to book a call
the name, email address, any notes and the email addresses of any guests that the user enters in the booking form, opened by the “Book a call” button, together with the chosen date, time and time zone. The form is provided by Cal.com, Inc., which processes the data on behalf of the Controller; the booked call is also recorded in the Controller’s Google calendar. The form loads only when the button is pressed: until then the Website sends no request to Cal.com.
3. Purposes and Legal Basis of Processing
| Purpose | Legal Basis | Data processed |
|---|---|---|
| Chat assistance on the website and quality review of the answers | Legitimate interest of the Controller (Art. 6, par. 1, let. f) GDPR) | Text of the question and of the answer, random conversation identifier |
| Anonymous analysis of website usage | Legitimate interest of the Controller (Art. 6, par. 1, let. f) GDPR) | Anonymous browsing data |
| Compliance with legal obligations | Legal obligation (Art. 6, par. 1, let. c) GDPR) | Necessary data |
| Endpoint security: limit on the number of requests | Legitimate interest of the Controller (Art. 6, par. 1, let. f) GDPR) | IP address |
| Booking and holding the call requested by the user | Performance of pre-contractual measures taken at the request of the data subject (Art. 6, par. 1, let. b) GDPR) | Name, email address, any notes and guests, date, time and time zone of the call |
4. Nature of Data Provision
Providing data is voluntary: the Website can be consulted without writing anything. The assistant field asks for no identifying data, and none is needed to receive an answer. Booking a call requires a name and an email address: without them, the booking cannot be made. The Controller can always be contacted at the addresses given in section 9.
5. Methods of Processing
Personal data is processed using electronic and automated tools, adopting adequate technical and organizational security measures to ensure confidentiality, integrity, and availability, including encrypted transmission (HTTPS/TLS).
No automated decision-making process, including profiling, is carried out pursuant to Art. 22 of the GDPR.
6. Data Recipients
Personal data may be communicated to:
- Vercel Inc. (USA), website hosting service
- OpenRouter, Inc. (USA), service that forwards the question to the providers of the models that generate the answers of the conversational assistant and compute its numerical representation for searching the Website documents; providers are selected among those that do not retain or use the data to train their models
- Langfuse GmbH (Germany), observability service that logs, on servers in the European Union, the questions to the conversational assistant and their answers, to review their quality
- Cal.com, Inc. (USA), appointment booking service: receives the data entered in the booking form and processes it on behalf of the Controller, as data processor
- Google Ireland Limited (Ireland), provider of the Google Analytics 4 statistical measurement service, only where the user has given consent, and of the calendar service in which the Controller records booked calls
- Possible email sending service, for sending email communications
Data will not be disclosed or transferred to third parties for commercial purposes.
7. Extra-EU Data Transfer
Some of the services used are based in the United States of America or transfer data there: Vercel, OpenRouter and the language model providers it selects, Cal.com, and Google LLC, recipient of the data collected through Google Analytics and Google Calendar and processed by Google Ireland Limited. Data transfer to the USA takes place on the basis of the EU-U.S. Data Privacy Framework, pursuant to Art. 45 GDPR — under which Google is certified — or with adequate safeguards pursuant to Art. 46 GDPR (Standard Contractual Clauses of the European Commission).
8. Retention Period
- Text of the questions to the assistant: logged together with its answer on the observability service (Langfuse, servers in the European Union) and retained for 30 days, after which it is deleted. It is not written to any store of the Website.
- IP address (request limiting): retained for 60 seconds in the memory of the process serving the Website, the length of the counting window. It is not written to disk or to any external store.
- Browsing data: processed in anonymous and aggregate form, not attributable to identified or identifiable persons.
- Booking data: retained on the booking service (Cal.com) and in the Controller’s calendar for 12 months from the date of the call, after which it is deleted.
9. Rights of the Data Subject
Pursuant to Articles 15-22 of Regulation (EU) 2016/679, the data subject has the right to:
- Access (Art. 15): obtain confirmation of the existence of processing and access to their data
- Rectification (Art. 16): obtain the correction of inaccurate data
- Erasure (Art. 17): obtain the deletion of their data ("right to be forgotten")
- Restriction (Art. 18): obtain the restriction of processing
- Portability (Art. 20): receive their data in a structured format
- Objection (Art. 21): object to the processing of their data
To exercise your rights, you can contact the Controller:
- Email: info@martuccioai.com
- PEC: martuccioai@pec.it
The Controller undertakes to respond within 30 days of receiving the request.
10. Cookies and local storage
The website uses the following means of storage on the user’s device:
- Technical cookies and local storage: necessary for the operation of the website. This category includes the browser localStorage entry “martuccioai.consenso”, which stores the choice made through the banner. They do not require consent. The entry persists until the user deletes it or until the purposes described here are updated.
- Third-party analytics cookies — Google Analytics 4: installed only after the user has given consent. Purpose: statistical measurement of visits and pages viewed. Cookies used: “_ga” and “_ga_<property ID>”, with a 24-month lifetime. Google’s advertising features (Google Signals and ad personalisation) are switched off.
- Anonymous analytics tools — Vercel Analytics: collect data about website usage in aggregate, anonymous form, without profiling cookies and without personal tracking.
- Third-party technical cookies — Cal.com: set by the booking service only when the user opens the calendar by pressing “Book a call”, and necessary for its operation: “__cf_bm”, for protection against automated requests, lasting 30 minutes, and session cookies, deleted when the browser is closed. On the same occasion the service keeps display preferences and the identifier of the booking in progress in the local storage of its own domain. They do not require consent, as they are strictly necessary to provide the service requested by the user.
- Withdrawing and changing consent: at any time through the “Cookie preferences” item in the site footer, which reopens the choice panel. Withdrawal stops collection immediately and removes the “_ga” and “_ga_<property ID>” cookies already installed from the device.
The website does not use profiling cookies for advertising purposes and does not pass the data it collects to advertising networks.
11. Right to Complain
The data subject has the right to lodge a complaint with the competent Supervisory Authority:
12. Changes to the Policy
The Controller reserves the right to modify this policy at any time, informing users through the website. Changes will be effective from the date of publication on the website. It is recommended to regularly consult this page.