Privacy policy
What the website receives, why, for how long, who with, and how to exercise your rights.
Last updated: [TO FILL IN: publication date of this version]
Who is responsible for your data
The data controller is Sogni Digitali di D.L. Oliver Polydor, Via Gino Lisa 45, 10147 Torino, Italy, VAT number IT13347550017 (to be confirmed). For any question about your data, write to hello@sognidigitali.com (to be confirmed) [TO FILL IN: dedicated privacy address, if you create one].
Data protection officer: [TO FILL IN: DPO name and contact, or a statement that no DPO has been appointed].
General principle: we only ask for the data your request needs. The website contains no advertising trackers (to be confirmed) and SOGNI DIGITALI does not sell your data (to be confirmed).
What data, for what purpose
Each feature of the website receives different data. Here is, purpose by purpose, what is collected and why.
Contact form
Data collected: [TO FILL IN: exact form fields, for example name, email, company, phone, message]. Purpose: to reply to your message and, if you wish, prepare a proposal. Messages are received in Keronos, our management software, which we host ourselves (to be confirmed).
Legal basis: [TO FILL IN: legal basis, for example pre-contractual steps taken at your request, Art. 6(1)(b) GDPR]. Retention period: [TO FILL IN: period, and what happens if no contract is signed].
Booking the free 30-minute call
Data collected: [TO FILL IN: exact fields, for example name, email, phone, chosen slot, meeting format, message]. Purpose: to organise the meeting and send you the confirmation and any reminder. Requests are received in Keronos (to be confirmed).
Legal basis: [TO FILL IN: legal basis, for example pre-contractual steps, Art. 6(1)(b) GDPR]. Retention period: [TO FILL IN: period]. Video calls: [TO FILL IN: tool used for video meetings and its provider, if it receives data].
Prometheus AI assistant
Prometheus is an artificial intelligence assistant: its answers are generated automatically. Your messages and its answers go through Keronos and are then sent to OpenRouter, our AI provider, which passes the request to a language model to produce the answer (to be confirmed).
Data collected: the content of the conversation and [TO FILL IN: any other data, for example session ID, IP address, language]. Purpose: to answer your questions about our services. Do not write sensitive data (health, passwords, bank details) in the conversation.
Legal basis: [TO FILL IN: legal basis, for example legitimate interest or consent]. Retention in Keronos: [TO FILL IN: period]. Retention and use of messages by OpenRouter and the model provider, including for training: [TO FILL IN: contractual terms and settings chosen].
Online presence audit
The audit is optional. It analyses a public website whose address you provide. Data collected: the site address, your name, your email address, your language and, if you enter it, the company name. Purpose: to prepare your analysis, send it to you by email after our team has reviewed it and, as you accept by ticking the form's box, contact you about it.
This data is processed in Keronos, our management software, where your request creates a contact record. An artificial intelligence model, through OpenRouter, our AI provider, reads the public content of your site to prepare a draft of the analysis. Our team reviews this draft: nothing is sent to you without that review. [TO FILL IN: proposed wording, to be validated; models and model providers used]
The analysis reads public pages only. Only enter the address of a site you manage or are entitled to have analysed. Legal basis: [TO FILL IN: legal basis]. Retention of the analysis and data: [TO FILL IN: period].
Unlocking Skills
To get a skill made by SOGNI DIGITALI, the page invites you to follow our TikTok and Instagram accounts. The website asks for no account, email or identifier to do so (to be confirmed). It cannot check whether you follow us and receives no data about you from TikTok or Instagram (to be confirmed).
When you open TikTok or Instagram, those services process your data under their own privacy policy. Measurement of unlock button use: [TO FILL IN: state whether these clicks are counted anonymously in Umami].
Visitor statistics
We measure audience with Umami, installed on our servers (stats.sognidigitali.com). Umami sets no cookies and respects your browser's Do Not Track setting (to be confirmed). Statistics are aggregated: page views, country, device type, referring sites [TO FILL IN: exact list of metrics].
Legal basis: [TO FILL IN: legal basis, for example legitimate interest in understanding how the site is used]. Retention period: [TO FILL IN: period].
Server technical logs
[TO FILL IN: state whether the server or Keronos record technical logs (IP address, date, requested page, browser), for what purpose (security, diagnostics), on what legal basis and for how long]
Likes and comments on skills and the blog
On each skill's page, you can leave a like and a comment without creating an account; under each blog article, in the same way. Comments are published only after our team has reviewed them. For a comment, we receive your nickname and your text, which become public once the comment is approved, plus the language of the page. This data is stored in Keronos, our internal management tool (to be confirmed).
Your email is optional. If you enter it and tick the consent box, it is used only to reply to you: the website never shows it or sends it back, and it is deleted with the comment. You can ask for it to be deleted at any time (to be confirmed). Liking a story works the same way, with no account or comment; sharing a story only tells us the means used (device menu, download or link), never the app you chose or who you are.
To limit abuse, your IP address is never stored in plain form: we keep only a one-way fingerprint (HMAC-SHA256 with a secret server key), used only for rate limits and spam prevention. The like relies on a random identifier created by your browser (see the Cookies and local storage page); we keep only a fingerprint of it (SHA-256).
Legal basis: [TO FILL IN: legal basis, for example legitimate interest for the nickname, text and IP fingerprint, consent for the email]. Retention: published comments and their email [TO FILL IN: period]; rejected comments: permanently deleted 30 days after rejection; IP and like fingerprints [TO FILL IN: period].
AI visibility checker
This tool reads public files of a website whose address you provide (robots.txt, llms.txt, llms-full.txt, home page, sitemap). Only this address is processed, for the duration of the check: it is neither stored nor logged, and the result is not kept. We only count that a check took place, with no cookie or identifier. Your IP address is used to limit abuse; it is not kept.
Referrals
When you arrive through a referral link, we keep that link's code with your request, so we can recognise the person who recommended you. This code may contain their first name. You can delete it from the form before sending. It is not linked to any cookie or to our statistics.
This person receives a credit note if a contract is signed. In their client area, they see the status of the referral and a masked version of your contact details; your name and company only with your agreement. They never access the content of your request.
Legal basis: [TO FILL IN: legal basis, for example legitimate interest for the code, consent for the name and company]. Retention period: [TO FILL IN: period].
Business introducer partners
When you arrive through a business introducer partner's link and accept in the banner, your browser keeps that partner's code for 30 days in its local storage (key sogni-digitali-affiliate). There is no cookie. The code is removed from the page address as soon as you arrive and does not enter our statistics. If you later arrive through another partner's link, it replaces the previous one; a newsletter link never does. The same consent covers the name of the newsletter or campaign whose link you followed (key sogni-digitali-campaign), attached to your request so we know where it came from. Without consent, nothing is kept. When you arrive, before you answer, the code is sent once to our server and then to Keronos, with your IP address, to check whether it belongs to a partner or a campaign and to limit abuse; nothing is kept in your browser at that point. Once accepted, it stays on your device and is sent again only with the contact form. A newsletter link skips this check; it is counted in our statistics, with no personal data (to be validated).
This code is used to link your request to that partner, so we can calculate their commission if the deal is concluded. The business introducer partner has no account and no access to Keronos, where your request is recorded: they do not receive its content. They are paid a commission when a deal they brought in is concluded. This is not the client referral described above, which gives a credit note (to be validated).
Legal basis: your consent for keeping it in the browser, which you can withdraw at any time with "Manage my cookies"; for the link in Keronos, [TO FILL IN: legal basis]. Retention period: the code stays 30 days in your browser and your choice 6 months; in Keronos, [TO FILL IN: period].
Who receives your data
Your data is read by the people at SOGNI DIGITALI who handle your request. It is also processed on our behalf by the providers below, each only for its own task.
- IONOS: hosting of the website on a virtual private server in Europe (to be confirmed). [TO FILL IN: exact entity and signed data processing agreement]
- OpenRouter: routing to an AI model of Prometheus assistant messages and of the public content of the site being audited (to be confirmed). [TO FILL IN: entity, country, models and model providers used]
- Email: sending confirmations and replies by email. [TO FILL IN: name of the email provider and country of processing]
- [TO FILL IN: any other providers, for example video call tool, backups, WhatsApp if you write to us through it]
Keronos, which receives forms, booking requests and conversations, is hosted and run by SOGNI DIGITALI itself (to be confirmed). We may also disclose data to an authority when the law requires it.
Transfers outside the European Union
[TO FILL IN: state for each provider whether data leaves the European Economic Area (in particular for OpenRouter and AI model providers, and for the email provider), to which countries, and under which safeguard: adequacy decision, standard contractual clauses or other]
You can request a copy of the applicable safeguards by writing to hello@sognidigitali.com (to be confirmed).
How long, and how we protect your data
- Contact form messages: [TO FILL IN: period]
- Booking requests: [TO FILL IN: period]
- Prometheus conversations: [TO FILL IN: period in Keronos and at OpenRouter]
- Audit reports and related data: [TO FILL IN: period]
- Umami statistics: [TO FILL IN: period]
- Data kept after a contract is signed (accounting and tax obligations): [TO FILL IN: applicable legal period]
- Likes and comments on skills and the blog: [TO FILL IN: period for published comments, emails and fingerprints]; rejected comments: deleted 30 days after rejection
Security measures: [TO FILL IN: main measures, for example encrypted connections (HTTPS), access limited to authorised people, backups, updates]. No measure offers absolute security; if a data breach puts you at risk, we follow the notification duties set by the GDPR.
Your rights, and how to exercise them
The GDPR gives you the right to access your data, have it corrected or erased, restrict its processing, object to it, receive it in a machine-readable format (portability) and withdraw any consent at any time, without affecting what was done before the withdrawal.
To exercise a right, write to hello@sognidigitali.com (to be confirmed) stating your request. We reply within one month, which may be extended by two months for a complex request; we will tell you if so. We may ask you to confirm your identity.
Automated decisions: [TO FILL IN: confirm that no decision with legal or similarly significant effects on you is made solely by automated means, neither by Prometheus nor by the audit].
Lodging a complaint
If you believe your data is not being handled correctly, you can lodge a complaint with the Garante per la protezione dei dati personali, the Italian data protection authority (garanteprivacy.it), or with the authority of the EU country where you live or work. Feel free to write to us first: we always try to settle the matter directly.
Updates to this policy
We update this policy when the website or our providers change. The date at the top of the page shows the latest version. If a change affects how data already collected is used, we will let you know [TO FILL IN: how, for example by email].
