Privacy notice

When you visit the site your browser automatically sends technical data: IP address, browser type (user agent), requested page, date and time. They are needed to show you the pages and to protect the site from abuse.

The site keeps no access logs with your IP address. For the limits against automated submissions (contact form, AI assistant, reports) the address is turned into a non-reversible code (hash) computed with a secret key that changes every day; the counters are deleted within one day. Only for login attempts to the restricted area does the counter use the plain IP address, for at most one hour, and it is also deleted within one day.

The encrypted connection (HTTPS) is provided directly by the site's server, at OVH Hostings Inc. (OVHcloud) in Beauharnois (Québec), Canada, with a Let's Encrypt certificate: traffic does not pass through external intermediaries. The protection against network attacks of OVH Hostings Inc. (OVHcloud) processes the IP address for that purpose only.

Legal basis: the controller's legitimate interest in a working and secure website (Art. 6(1)(f) GDPR).

The site counts visits with its own system, without cookies, without storing anything in your browser and without third-party services such as Google Analytics. For each page view only counts are kept: page, language, referring site (domain only, e.g. "google.com"), device type (phone, tablet or computer), day and hour. Clicks on the phone numbers and email addresses of Edoardo Gabrielli, on external links and on document downloads are counted the same way.

To estimate how many different visitors arrive on a day and how long a visit lasts, the site computes a code (hash) from IP address, user agent and a secret key that changes every day. The IP address and user agent are never stored. During the day the pages viewed are linked to this code to compute how long the visit lasts; afterwards only the counts remain. The code cannot identify you or recognise you on later days and is deleted by the following day. Visits by robots (search engines and automated programs) are not counted.

If your browser sends a "Do Not Track" or "Global Privacy Control" signal, your visit is not counted at all.

The counts are kept for 400 days and then deleted automatically.

Legal basis: the controller's legitimate interest in understanding which content is of interest and improving the site (Art. 6(1)(f) GDPR). The daily code is pseudonymous data that exists for one day at most; the data kept afterwards are aggregate and do not allow you to be identified.

If you write to us through the contact form we process the data you enter: name, email, company (optional) and message, together with the language, the page you wrote from and the date and time you ticked the box stating that you have read this notice (it is not a consent: we reply because you ask us to). Your IP address is not stored.

The message is saved in the site's restricted area and emailed to the mailbox of Edoardo Gabrielli dodogabrie@gmail.com, with your address as the reply-to. We use it only to answer you and follow up on your request.

Edoardo Gabrielli may use the AI tools of the restricted area to read and summarise received messages; in that case the message text is sent to the AI service provider with the safeguards described in the "AI assistant" section.

Retention: as long as needed to handle the request and any resulting business relationship, and in any case no longer than 730 days from receipt, after which the message is deleted automatically; Edoardo Gabrielli may delete a message at any time.

Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) when you ask for information for yourself; if you write on behalf of a company and in the other cases, the controller's legitimate interest in answering those who contact it (Art. 6(1)(f) GDPR). Providing the data is optional, but without name, email and message we cannot answer you.

The site offers an AI-based assistant that answers questions about the site's content.

Who you are talking to. The chatbot is an artificial intelligence program, not a person. It answers only from the content published on the site (pages, news, documents, videos) and cites its sources. It can make mistakes or give incomplete answers: for binding information on prices, lead times and terms, contact Edoardo Gabrielli directly.

Do not write personal data. The chatbot does not need to know who you are. Please do not write personal or confidential data, yours or anyone else's. As an extra safeguard, before the message is saved or sent to the AI provider the site automatically replaces email addresses and phone numbers with "[rimosso]". The filter does not recognise every kind of data (names or postal addresses, for example), which is why we ask you not to write them.

If you ask to be contacted. When you ask for a price, a quote, delivery times or a call back, the chatbot may suggest that you leave your contact details. Only then does it ask for your name and an email address or a phone number, in a small form inside the chat; you can also write them in a single message. The email address and the phone number are not sent to the AI provider and do not stay in the saved conversation: the site puts them in a message for Edoardo Gabrielli, together with your name, your company if you wrote it, your request, a short summary written by the artificial intelligence, the language and the page you wrote from. Your name, your company and the text of your request, if you write them in the chat messages, are instead part of what the AI provider receives and of the saved conversation; those written in the form are not. The summary is written from the messages of the conversation. There is no box to tick: the chatbot tells you who receives the data and points you to this notice when it asks for them and when it confirms that the request has been recorded. Each conversation records one request only. The message is handled like those of the contact form (section "Contact form"): same recipients, same legal basis, automatic deletion after 730 days.

What is sent and to whom. Your filtered message, together with the latest questions and answers of the conversation, the relevant passages of the site and the company contacts published on the site, is sent through OpenRouter to an AI model provider chosen from a restricted list, which generates the answer. Requests are configured to exclude providers that use the texts to train their models or keep them for other purposes; some providers may keep them for a limited time only to prevent abuse (according to their documentation: Google AI Studio up to 55 days; Google Vertex AI up to 90 days only for content flagged by automated checks; Microsoft Azure only flagged samples). OpenRouter does not keep the texts beyond the time needed to forward the request, except for legal obligations or abuse prevention; according to its documentation, it samples a small number of requests and categorises them by topic, anonymously and without linking them to the account, for its own reporting. The allowed providers are listed under "Recipients".

What is stored. The site stores the conversation (filtered questions and answers), the language, the page you opened the chatbot from and a random identifier generated by your browser. Neither your IP address nor other identifying data are stored. The random identifier lives in the browser tab's memory (sessionStorage) and is erased when you close the tab; it only lets you see the conversation again if you reload the page.

For how long. Conversations are deleted automatically 30 days after the last message (up to 7 more days if the analysis described below fails). No message is kept longer than 365 days in any case. Before deletion the AI prepares a summary of the period's conversations (recurring topics, frequent questions, unanswered questions) from which identifying data are removed (no names, addresses or numbers): Edoardo Gabrielli uses it to improve the site's content and keeps it.

Reports. You can flag a wrong answer with the "Report this answer" button and add an optional note. The report stays with the conversation and is deleted with it. Please do not write personal data in the note either.

Who reads the conversations. Edoardo Gabrielli can read conversations in the restricted area to check the quality of the answers and correct the site's content.

No automated decisions. The chatbot takes no decisions producing legal effects on you or similarly significantly affecting you (Art. 22 GDPR) and builds no visitor profiles.

Usage limits. To prevent abuse the number of messages is limited; the count uses the daily non-reversible code described under "Browsing and security".

Legal basis: the controller's legitimate interest in offering an assistance tool that the visitor chooses to use (Art. 6(1)(f) GDPR). Its use is optional: all information is also available on the site's pages and through the usual contacts.

The restricted area is used only by Edoardo Gabrielli and by whoever maintains the site. For each user the site processes email, name, password (stored only as a non-reversible hash), the two-step verification key and recovery codes (the latter only as non-reversible hashes), role and permissions, last login date and the changes made to the content. Users can connect their own chatbot to the restricted area through personal tokens, of which the site keeps only a hashed fingerprint.

Retention: for the duration of the assignment or employment; the account is disabled or deleted when no longer needed.

Legal basis: performance of the employment or collaboration relationship and the controller's legitimate interest in the security of the site (Art. 6(1)(b) and (f) GDPR).

The maps of our offices are not loaded when you open the page. Until you click "Show the map" you see a placeholder with the address and no data leave the site. When you click, your browser downloads the map images ("tiles") from the OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom), which distributes them through a worldwide network of servers (CDN): the network chooses the server that answers, and your IP address and browser data may also be processed outside the European Union and the United Kingdom. The OpenStreetMap Foundation processes these data as an independent controller under its own privacy policy. The images set no cookies. Legal basis: your choice to load the map (consent, Art. 6(1)(a) GDPR), which you withdraw simply by not clicking again: the site does not remember the choice.

Fonts are hosted on the site itself: the site does not connect to Google Fonts or other external services while you browse.

The public site uses no profiling or analytics cookies, first- or third-party. That is why it shows no cookie consent banner: consent is required only for cookies and tools other than technical ones (Art. 122 of the Italian Privacy Code and the Garante's Guidelines of 10 June 2021).

These are the only items stored in your browser, all set by the site:

• assistant.session, assistant.conversation: sessionStorage (technical); only if you use the chatbot; they let you find the conversation again if you reload; they last until the tab is closed.
• sessionid: technical cookie; only after logging in to the restricted area; it keeps you logged in; it lasts 8 hours from the last activity.
• csrftoken: technical cookie; in the restricted area and on the login and password reset pages; it protects forms from forged requests; it lasts 1 year.
• cms.editor: localStorage (technical); only after logging in to the restricted area; it shows the edit pen on pages; it lasts until logout.

The maps set no cookies.

You can delete cookies and stored data from your browser settings; the public site keeps working.

Data are processed by Edoardo Gabrielli. In addition, the following processors (Art. 28 GDPR) process them on behalf of Edoardo Gabrielli and only for the purposes described:

• OVH Hostings Inc. (OVHcloud), Canada: the server running the site, the encrypted connection, protection against network attacks and the backup storage, in a data centre in Beauharnois (Québec), Canada;
• OpenRouter, Inc., United States: routing of requests to the AI model of the chatbot and of the restricted-area tools;
• AI model providers, reached through OpenRouter (acting as processor, with the EU standard contractual clauses included in its data processing agreement) and limited to Microsoft (Azure), Google (Vertex AI, AI Studio), certified under the EU-US Data Privacy Framework; providers that train on requests are excluded;
• Google Ireland Limited (Gmail), Ireland: sending notifications of messages received through the contact form.

The up-to-date list of processors is available on request. Data are not sold or disclosed to the public.

When you choose to load a map, your browser connects to the network of servers (CDN) of the OpenStreetMap Foundation, which is based in the United Kingdom, a country covered by an adequacy decision of the European Commission (Art. 45 GDPR), renewed until 27 December 2031. The network is worldwide and chooses the server that answers: the IP address and browser data may therefore also be processed outside the European Union and the United Kingdom.

Google Ireland Limited (Gmail) (Ireland), which sends the site's emails, may process the data they contain outside the European Union. Transfer safeguard: adequacy decision of the European Commission on the EU-U.S. Data Privacy Framework, to which Google LLC adheres, and, where it does not apply, standard contractual clauses approved by the European Commission (Art. 46 GDPR).

The other transfers outside the European Union concern the AI tools: OpenRouter and the permitted model providers (Microsoft (Azure), Google (Vertex AI, AI Studio)) are based in the United States and may process the texts sent there. Transfers to the model providers rely on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which they are certified; transfers to OpenRouter (United States) rely on the standard contractual clauses approved by the European Commission (Art. 46 GDPR) included in its data processing agreement. You may request a copy of the safeguards from the controller.

For the chatbot, the texts sent are already stripped of emails and phone numbers and the site asks you not to enter personal data, so the transfer normally concerns only questions about the site's content.

The server, the backups and the encrypted connection are in Beauharnois (Québec), Canada, outside the European Union. Transfer safeguard: adequacy decision of the European Commission for Canada (Decision 2002/2/EC).

A backup of the site's database and files is made every night and kept for 14 days on the server. Data deleted from the site may therefore remain in backups until they expire; backups are used only to restore the site after a failure.

• Counters for usage limits: within 1 day.
• Daily code for statistics: until the following day.
• Aggregate statistics: 400 days.
• Chatbot conversations: 30 days after the last message (up to 7 more days if the analysis fails); no message beyond 365 days.
• Conversation summary: no expiry (identifying data are removed from it).
• Contact form messages: 730 days from receipt, then deleted automatically.
• Restricted-area accounts: duration of the relationship.
• Backups: 14 days on the server.

You may at any time ask the controller to access, rectify or erase your data, to restrict processing and to receive your data in a machine-readable format (Arts. 15-20 GDPR).

Right to object (Art. 21 GDPR). You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest: browsing and security of the site, visit statistics, replies to contact form messages that do not concern a request made for yourself, AI assistant.

You may withdraw at any time the consent given to load a map, as explained in the "External content" section: withdrawal does not affect what happened before it.

To exercise these rights write to dodogabrie@gmail.com; we answer within one month.

Note that for chatbot conversations the site keeps no data identifying you: to find your conversation we need the day, the page and the text of one of your questions.

If you believe the processing infringes the GDPR you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the EU country where you live or work.

Edoardo Gabrielli may update this notice, for example when a provider changes. The date at the top shows the latest version.