Privacy and cookie policy

1. Data controller

The data controller is Anomaleet Srl · Via Pace 17, 20866 Carnate (MB) · P.IVA 10289790965 · [email protected].

For any request about your personal data, write to [email protected].

2. What data we collect

Data you provide: when you fill in the contact form we collect name, company, email, the selected topic and the message text.

Data collected automatically: if you consent to statistical cookies, Google Analytics collects browsing data (pages viewed, visit duration, device and browser type, referrer, approximate location derived from the IP address).

AI assistant (chat) data: the text of the messages you type and the generated replies, a random conversation identifier saved in your browser, the IP address in hashed form and technical browser data. Details are in section 5.

We do not collect special categories of data and we do not carry out advertising profiling.

3. Purposes and legal basis

Replying to requests sent through the form or by email: pre-contractual measures taken at your request (Art. 6.1.b GDPR).

Measuring site usage in aggregate form to improve it: your consent (Art. 6.1.a GDPR), which you can withdraw at any time.

Answering the questions asked to the AI assistant: pre-contractual measures taken at your request (Art. 6.1.b GDPR); preventing abuse of the chat service: legitimate interest of the controller (Art. 6.1.f GDPR).

Keeping the site running and secure: legitimate interest of the controller (Art. 6.1.f GDPR).

4. Cookies and similar technologies

The site uses browser local storage to remember your cookie choice. It is not a tracking cookie and is never sent to any server.

Statistical cookies are set only after your consent. If you decline, the Google Analytics script is not even loaded and no data is sent to Google.

5. AI assistant (site chat)

The site offers a chat run by a virtual assistant powered by artificial intelligence: you are not talking to a person. Replies are generated automatically by Anomaleet using OpenAI services and may contain errors or inaccuracies. The automated nature of the service is stated in the chat itself. To talk to a member of the team, write to [email protected].

Data processed: the text of the messages you type, sent to bot.anomaleet.com, and the generated replies; a random conversation identifier saved in your browser. To generate replies, messages are sent via API to OpenAI, acting as processor, which under its API services terms does not use the data to train its models. To prevent abuse and enforce the request rate limit, the IP address is stored only in hashed form (non-reversible), never in clear text, together with technical browser data (user agent, referring page).

Data controller: Anomaleet Srl, [email protected] (see section 1). No profiling is carried out and no automated decision producing legal or similarly significant effects on you is taken. Please do not enter unnecessary personal data, yours or of third parties, in the chat.

Providers: the service runs on Cloudflare (Cloudflare, Inc.); to generate replies, messages are sent via API to OpenAI, acting as processor; the conversation is stored in a database hosted by Supabase, Inc. in a data centre in the United Kingdom.

Retention: conversations are kept for 24 hours from the last message, to preserve the context of the dialogue, and then deleted; technical service logs, which do not contain the message text, are kept by Cloudflare for no longer than 7 days.

6. Who we share data with

Contact form data is delivered through EmailJS Inc., acting as processor for the sole purpose of delivering the message to our mailbox.

Statistical data is processed by Google Ireland Ltd. as processor, under the Google Analytics terms.

The site is hosted on Cloudflare Pages (Cloudflare, Inc.), acting as processor for hosting and content delivery through its CDN network, and processing technical connection logs, including the IP address, to operate and secure the service.

AI assistant chat data is processed by OpenAI, L.L.C. (reply generation) and Supabase, Inc. (database) as processors, as described in section 5.

Data is never disclosed or sold to third parties for commercial purposes.

7. Transfers outside the European Economic Area

Some providers — including Cloudflare, Inc., EmailJS Inc. and OpenAI, L.L.C. — are based in the United States. Transfers rely on the European Commission standard contractual clauses and, where applicable, on the provider’s certification under the EU-U.S. Data Privacy Framework.

Chat data is stored by Supabase, Inc. in the United Kingdom, a country covered by a European Commission adequacy decision.

8. How long we keep data

Contact requests: 24 months from the last exchange, unless a contract arises, in which case statutory terms apply.

Conversations with the AI assistant: 24 hours from the last message; technical chat service logs: no longer than 7 days.

Statistical data: 14 months, per the Google Analytics retention setting.

9. Your rights

You may request access, rectification, erasure, restriction and portability at any time, and object to processing based on legitimate interest (Art. 15-22 GDPR).

You can withdraw consent to statistical cookies through the “Cookie preferences” link at the bottom of the page, without affecting the lawfulness of prior processing.

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

10. Changes

Any update to this policy is published on this page with a new update date.