Privacy policy

Information on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

1. Introduction and scope

Archetipi Digitali s.r.l. (hereinafter also “Archetipi” or the “Company”) recognizes the importance of protecting personal data and is committed to processing it in compliance with Regulation (EU) 2016/679 (“GDPR”), Legislative Decree 196/2003 as amended and other applicable provisions.

This notice describes how the personal data of users who:

visit the website www.archetipi-digitali.it and the apps website apps.archetipi-digitali.it and the related pages;
use the Archetipi software applications expressly described in this notice, including AIquote and ShareNarrate;
contact the Company through online forms, email or other communication channels;
request information, quotes, support or professional services;
have pre-contractual or commercial dealings with Archetipi, as individuals or as representatives of organizations,

is processed. Where necessary, additional information may be provided for processing connected with specific activities, applications or initiatives.

This notice concerns processing for which Archetipi acts as controller. It does not automatically govern processing carried out on behalf of customers, for which Archetipi may act as processor pursuant to Article 28 GDPR.

2. Data controller

The data controller is:

Archetipi Digitali s.r.l.

VAT no.: 05374590262
REA: TV-439139
Reference address: Via Alcide de Gasperi 61/A, 31020 San Vendemiano (TV), Italy

Website: https://www.archetipi-digitali.it
Email: info@archetipi-digitali.it

For any request concerning the processing of personal data or the exercise of the rights provided by the GDPR you can use the email address above.

3. Principles of processing

Archetipi processes personal data according to the principles of lawfulness, fairness, transparency, purpose limitation, minimization, accuracy, storage limitation, integrity and confidentiality.

Data is used for specific and legitimate purposes and is not subsequently processed for purposes incompatible with the original ones, except as permitted by law.

The Company adopts technical and organizational measures proportionate to the nature of the processing and to the risks to the rights and freedoms of data subjects.

4. Processing related to the website

4.1 Browsing data

While browsing the site, the IT systems and infrastructure that make it work may process technical information generated by communications over the Internet.

This information may include:

IP address;
date and time of requests;
address of the requested resources;
information about the browser, operating system and device;
server response codes;
technical and diagnostic data relating to the operation and security of the site.

This data is processed to enable the site to function, ensure the security of the infrastructure, detect anomalies and carry out maintenance.

The legal basis is the controller's legitimate interest pursuant to Article 6(1)(f) GDPR, as regards security, prevention of abuse and technical management of the site, as well as the performance of pre-contractual or contractual measures where relevant.

4.2 Contact forms and information requests

Through the site users can send requests for information, quotes or collaboration proposals.

In this context the following may be processed:

first and last name;
email address;
any company or organization to which the user belongs;
further contact details voluntarily provided;
content of the request;
any attachments and additional information provided by the data subject.

Data is used to answer requests, assess the needs expressed and manage any follow-up activities.

The legal basis is Article 6(1)(b) GDPR, when processing is necessary to take steps at the data subject's request prior to entering into a contract, or Article 6(1)(f) GDPR, when processing is necessary to respond to professional or business communications and the controller has a legitimate interest.

Providing the data marked as mandatory is necessary to submit the request. Further data is optional.

Having read the notice does not, in itself, constitute consent to optional processing such as sending promotional communications.

4.3 Cookies and similar technologies

The site may use cookies and equivalent technical tools necessary for the operation of the pages, preference management and security.

Any use of analytics cookies not equivalent to technical ones, profiling cookies or other tools subject to consent takes place in compliance with applicable law, including Article 122 of the Privacy Code and the provisions of the Italian Data Protection Authority.

Where required, such tools must be activated only after obtaining free, specific, informed and revocable consent.

Merely continuing to browse is not equivalent to consent to the use of non-necessary cookies.

Specific information on the tools actually used, their providers, purposes and retention periods is made available through the cookie information on the site.

This provision does not imply that all the categories of cookies described are actually used.

4.4 Specifics for the apps.archetipi-digitali.it site

The general provisions above remain applicable according to their scope. For the apps site, which is separate from the corporate site www.archetipi-digitali.it, the actual configuration is the one described here: there are no contact forms or cookie banner and the corporate site's tools are not embedded. Support links open the user's email program.

The apps.archetipi-digitali.it site is static, requires no registration and is hosted on Netlify. Delivering the pages involves processing IP and technical request data for delivery, operation and security. The information on services and retention in the Netlify privacy notice applies. No fonts are loaded from external services.

We use GoatCounter to learn about visits and interactions, including clicks on downloads. The script is hosted on our site and sends measurements to archetipi.goatcounter.com. Requests may include page path and title, referrer, URL parameters, screen size and technical browser information; the service also receives the connection's IP.

GoatCounter does not use cookies for these measurements. Its notice describes aggregate statistics and temporary in-memory processing of IP and user agent, for up to eight hours, to distinguish repeat visits. Statistics are kept in the service as long as needed to analyze the site's trends and can be deleted by the operator; the documentation indicates servers in Finland and Germany. We use no other trackers on this page. These statistics concern the site, not the content read in the app.

By following an external link or downloading from a third-party platform you contact the relevant provider, which processes data according to its own notice. Visiting this page does not activate Gemini nor send ShareNarrate content to Google.

5. Communications and business relationships

Archetipi may process personal data of customers, prospective customers, suppliers, collaborators and their respective representatives.

The categories of data may include identification and contact information, professional role, organization, content of communications, contractual data and administrative information.

Processing may be carried out in order to:

manage requests, commercial proposals and quotes;
negotiate, conclude and perform contracts;
maintain operational communications with representatives;
manage invoicing, accounting and regulatory obligations;
protect the rights arising from contractual relationships.

The legal bases are, as the case may be, Article 6(1)(b), (c) and (f) GDPR.

In dealings with legal entities, legitimate interest may justify processing the professional contact data of their representatives to manage relevant relationships and communications, after assessing the applicable conditions.

Professional contact data is not automatically used for indiscriminate marketing activities.

Any promotional communications by electronic means are carried out in compliance with applicable law, on the basis of consent where required or of the specific exceptions permitted by law, guaranteeing the related rights of objection.

6. Software products and applications

Archetipi develops and distributes software solutions and digital applications.

The categories of data processed, the storage methods and any use of external services depend on the features of the individual products.

The general provisions of this notice apply to the applications expressly identified in the document, supplemented by the relevant specific sections.

The release of new products involving different processing will require an update of the notice or the preparation of a dedicated document.

6.1 AIquote — macOS application

Description and purposes

AIquote is an independent macOS application that lets users view information on the availability and use of the Codex quotas associated with their OpenAI account.

The application uses the Codex App Server component and communicates with OpenAI services to obtain the information needed to display the quotas.

AIquote is not an official OpenAI product nor is it affiliated with OpenAI.

Categories of data

To provide the intended features, the application may process:

technical identifiers and email address of the connected OpenAI account;
information on the plan associated with the account;
usage percentages, remaining quotas, time windows and reset times;
technical credentials and tokens necessary for authentication;
display settings and user preferences;
technical data and local configurations necessary for the operation of the application and of the integrated component.

Account and quota data come from OpenAI services.

Legal basis

Processing of the data necessary for AIquote to work is based on Article 6(1)(b) GDPR, as it is necessary to provide the features requested by the user.

Linking the OpenAI account is optional, but essential to view personal quotas.

Architecture and processing methods

AIquote is designed to work mainly locally.

Authentication takes place through OpenAI services. The integrated component manages the information needed to maintain the session and may store it on the device through the mechanisms provided by the implementation and by macOS.

Account and quota information is used by the interface for display and may be kept temporarily in memory.

Preferences, technical configurations and any operational files of the component may remain locally on the device.

AIquote does not provide for an additional user account with Archetipi Digitali nor a company server intended for the centralized collection of users' OpenAI quotas or credentials.

Access limitations and purposes

AIquote is designed to view quota information and not to acquire the content of ChatGPT conversations, prompts or personal documents.

For the features described, the application does not require access to the address book, microphone or camera.

There are no built-in advertising profiling or behavioral analysis features.

The configuration described does not involve the use of optional telemetry tools by Archetipi.

Any processing carried out directly by OpenAI for the operation, security and management of its services remains separate.

Retention and disconnection

Information kept in working memory is used for the duration of the application session.

Technical credentials may be stored locally to allow the connection to be restored.

The disconnect command asks the authentication component to remove the credentials associated with the AIquote session, according to the features actually supported.

Disconnecting does not delete the OpenAI account, the information independently kept by OpenAI or necessarily all local preferences and configurations.

Uninstalling the application may not automatically remove data that may be stored in the macOS Keychain.

Since there is no separate AIquote account with Archetipi, no procedure to close such an account is necessary.

For information on removing local data or for requests relating to Archetipi's processing you can use the company privacy contact.

OpenAI services

Accessing the account and viewing quotas involve direct communications with OpenAI.

OpenAI processes the information received according to its own privacy roles and applicable conditions.

For users in the European Economic Area, OpenAI indicates OpenAI Ireland Limited as the controller of the processing described in its notice.

For more information:

https://openai.com/policies/eu-privacy-policy/

Requests concerning data independently processed by OpenAI must be addressed to OpenAI through the channels it provides.

6.2 Distribution through third-party platforms

Some Archetipi applications, including AIquote, may be distributed through third-party platforms such as the Mac App Store.

Operations relating to store access, download, updates and any payments may involve independent processing by the platform operator.

For the Mac App Store, Apple's privacy notice applies, available at:

https://www.apple.com/legal/privacy/it/

Using AIquote does not in itself involve transmitting the user's Apple Account credentials to Archetipi.

6.3 ShareNarrate — Android and iOS version in testing

Google is optional. You can read texts and articles with the device's standard voice without entering a Gemini key. Without activation and consent the app does not send content to the Gemini APIs.

Content and local data

The app receives only the text, link or single audio file you choose to share, or the text you paste. It may keep in the device's private space the original content, the extracted text, the title, the source address, the reading position, narrator preferences and, for songs, metadata, lyrics and the generated interpretation. It does not automatically access other conversations or the content of the apps you share from.

No ShareNarrate account is needed. The app includes no advertising, no usage-analytics tools of its own and no commercial profiling, and does not record the microphone. There is no Archetipi server that automatically collects the library, shared texts, audio or the API key.

Standard reading

Standard reading uses the speech synthesis engine configured on Android. The app selects a voice that the engine declares installed and usable offline; if none is available, it asks you to install one. Settings, any voice downloads and processing by the engine's provider remain subject to its terms. Reading a text that is already available does not require Gemini; retrieving a web page does still require a connection.

The iOS version in testing uses Apple's system speech synthesis when Google is not activated. The available voices and any downloads depend on the system. The app and its Share extension access the same private library on the device; no online library is created.

Retrieving pages and songs

When you share a URL, the device contacts the page's site, including any redirect addresses, to extract the readable text. The site receives the normal connection data, including IP, requested URL and technical HTTP information. The app does not import the browser's logins or cookies and does not bypass logins or paywalls. For ChatGPT only content made available through the public link can be read.

To interpret a song, with Google activated, the app may contact YouTube Music or the Apple/iTunes catalog to identify it. In updated versions, title and artist are sent to Gemini with Google Search to look for public explanations of the meaning, without automatically retrieving song lyrics. The services also receive the normal technical connection data; Google generates the queries needed for the search. The SOURCES link lets you consult the sources and Google's suggestions without interrupting playback. You can also manually provide a text you have the right to use. Access to your music account is not requested.

For Grounding with Google Search, Google's terms provide for retention of prompts, context and outputs for 30 days to create the results and suggestions and for service monitoring. Search may incur costs on the project associated with your key. Search results, suggestions and the related audio remain in memory during the session and are not saved to the library or audio cache; the original link remains for a new search. Earlier versions may still use YouTube Music or LRCLIB to look up lyrics: update the app to switch to the new path.

Shared voice messages and audio summaries

You can share an audio file, for example a WhatsApp voice message, to get a short summary in Italian read with the Google voice engine, with a playback limit of 15 seconds. The app does not read WhatsApp history, does not record the microphone and does not identify people by voice. Summarizing and reading voice messages requires Google to be connected; texts and articles remain usable with the standard voice.

Before the first audio upload, a separate, revocable consent is requested. If you grant it, the shared file is sent directly from the device to the Gemini APIs with your key, without passing through an Archetipi server. The voice message may contain the voice, personal data and information of other people: share it only if you have an adequate legal ground and avoid sensitive content. The AI summary may omit details or contain errors.

The original, up to 8 MiB, is copied into the private archive excluded from backup to complete processing even after sharing. The local copy is removed after the summary is saved or when you delete the reading; if processing fails, it remains available to retry until removed. The summary and the reading's technical information stay in the library, while the TTS audio follows the synthesis cache rules. Local deletion does not delete data already processed by Google under the service's terms.

Google Gemini, only if you connect it

Before verifying your key and using Google, the app requires specific consent to sending content, confirmation that you are of legal age and of the project with active billing. Google requires at least 18 years of age and use of Paid Services for clients distributed in the EEA, Switzerland and the United Kingdom. Creating a key does not make every use of the APIs free: quotas, charges and availability depend on your project.

The key is protected on the device using Android Keystore or, on iOS, the Apple keychain shared only with the ShareNarrate extension. It is used to authenticate requests sent directly to Google; it is not included in the app nor sent to Archetipi. Verifying the key also contacts Google. The app sends the texts needed to choose the narrator and for speech synthesis, the reading instructions and, for songs, the lyrics and metadata needed for interpretation.

According to the Gemini terms, Google does not use inputs and responses of Paid Services to improve its products. The abuse monitoring documentation indicates retention of prompts, context and responses for 55 days, with possible review by authorized personnel. The Google privacy notice and the terms of your project also apply.

You can separately revoke the sending of voice messages, revoke the general Google consent and remove the connection from the app. Subsequent texts and articles use the standard voice; generating and listening to voice summaries requires Google to be connected. Revocation does not delete data already processed by the provider. Avoid sending credentials, API keys, confidential content or other people's personal data without an adequate legal ground.

Retention, protection and deletion

The local library holds at most 50 readings and stays on the device until you remove individual items or delete the app's data. The cache of completed Gemini syntheses is managed with a 100 MiB limit: the oldest files are removed when space is needed. The system may delete the cache earlier; there is no fixed term in days.

Removing a reading from the list does not immediately delete the corresponding audio from the cache. On Android you can clear the cache from the system settings; to remove all local data you can clear the app's data or uninstall it. Android backups of the app are disabled; on iOS the library and audio cache are excluded from backup. Before deleting the iOS app, remove the key from its controls: the Apple keychain may keep it even after uninstalling. Removing the key from the app does not delete the key or the project on Google Cloud: to revoke them use Google's controls.

Connections to the services use HTTPS. Device protections, Android Keystore and the Apple keychain reduce the risk of unauthorized access, without making any security system infallible. Do not send the API key to support.

Support and reports

If you choose to send an email or a report, we receive the contact details and the information you voluntarily include. Check the message before sending it and avoid unnecessary personal material. We keep communications for the time needed to handle the request and any legal obligations or needs to protect rights; they are not used to automatically subscribe you to promotional communications.

Purposes, consent and provision of data

For the processing within Archetipi's remit that is necessary for the requested functions and for support, the legal bases of the general sections apply, in particular Article 6(1)(b) GDPR. The optional sending of content to Gemini is based on the user's specific consent pursuant to Article 6(1)(a), revocable without affecting the lawfulness of earlier processing. Processing carried out directly by providers under their own terms and notices remains separate.

Providing a Google key is optional; without it the standard functions remain available. Not providing the content prevents it from being read. The automatic choice of the narrator's tone and the interpretation of texts may produce errors and do not constitute decisions intended to produce legal or similarly significant effects on the user within the meaning of Article 22 GDPR.

7. Technical support and user requests

Users can contact Archetipi for information, reports and support relating to the site, products and services.

In this context the following may be processed:

identification data and contact details;
content of requests;
communications exchanged;
technical and diagnostic information provided by the user;
any attached documents, images or screenshots.

Data is used exclusively to handle requests and strictly related activities, subject to further legitimate purposes communicated to data subjects.

The legal basis is the performance of contractual or pre-contractual measures, where relevant, or the controller's legitimate interest in managing communications and reports.

Users of the applications must not send passwords, session tokens or other confidential credentials through the support channels.

8. Recipients of data

Personal data may be accessible to authorized Archetipi personnel and to external parties providing services necessary for carrying out the activities described.

Depending on the processing, these parties may include:

hosting, infrastructure and IT service providers;
email and communication tool providers;
parties in charge of system maintenance and security;
administrative, tax and legal advisors;
technology providers involved in delivering specific services;
public authorities in cases provided for by law.

Providers that process personal data on behalf of Archetipi are identified and governed, where necessary, by agreements compliant with Article 28 GDPR.

Services acting as independent controllers are responsible for the processing carried out for their own purposes, according to their respective notices.

The Company does not sell users' personal data.

Disclosure of data collected through AIquote to advertising companies for profiling purposes is not envisaged.

9. International transfers

In carrying out the activities described, the use of some technology providers may involve transfers of personal data to countries outside the European Economic Area.

When such transfers are attributable to Archetipi, they are carried out on the basis of the conditions and safeguards provided by Chapter V of the GDPR, including, where applicable, adequacy decisions, standard contractual clauses and necessary supplementary measures.

As regards processing independently carried out by OpenAI, information on international transfers and the related safeguards is contained in its privacy notice.

Data subjects may request information on the safeguards relating to transfers within Archetipi's remit by contacting the controller.

10. Retention periods

Personal data is kept for periods proportionate to the purposes for which it is processed and in compliance with any regulatory obligations.

In particular:

Browsing data and technical logs: for the period needed for the operation and security of the infrastructure, according to the policies applied to the systems used, without prejudice to documented needs to investigate incidents or unlawful acts.

Contact requests and quotes: for the period needed to assess the request and any continuation of the commercial relationship, unless legal obligations or the need to protect rights require otherwise.

Contractual and administrative relationships: for the duration of the relationship and afterwards for the periods required by law, including the obligations to retain accounting and tax documentation, generally ten years for records subject to such obligation, without prejudice to different applicable terms.

Support communications: for the time needed to handle the request and any handling of disputes, according to criteria of proportionality and necessity.

Local application data: as described in the sections dedicated to the individual products.

Data subject to consent: until consent is withdrawn or the retention period communicated for the specific purpose is reached, without prejudice to any applicable obligations.

When it is not possible to indicate a numerical duration in advance, retention is determined on the basis of necessity with respect to the purpose, the nature of the data, regulatory obligations and the time limits for exercising or defending rights.

11. Nature of the provision of data

Providing data is generally optional.

Some data is however necessary to enable the use of certain features, respond to requests, provide services or comply with legal obligations.

Failure to provide such data may make it impossible to deliver the requested service.

The AIquote features that require personal information on quotas need the voluntary connection of the OpenAI account.

The connection does not entail obtaining a general consent for further purposes.

12. Data security

Archetipi adopts technical and organizational measures appropriate to the risk, in accordance with Article 32 GDPR.

These measures concern, according to the characteristics of the processing, access management, credential protection, security of communications and systems, maintenance and incident management.

The measures are subject to assessment and updating in relation to technological developments and risks.

No IT system can guarantee the absolute absence of risks. Any personal data breaches are handled according to the procedures and obligations provided by Articles 33 and 34 GDPR.

13. Rights of data subjects

Data subjects may exercise, in the cases and within the limits provided by Articles 15–22 of the GDPR, the following rights:

access to their personal data;
rectification of inaccurate data and completion of incomplete data;
erasure of data where the legal conditions are met;
restriction of processing;
data portability, where applicable;
objection to processing based on legitimate interest;
withdrawal of consent, for processing based on consent, without affecting the lawfulness of earlier processing.

For processing based on legitimate interest, objection may be exercised on grounds relating to the data subject's particular situation, subject to the conditions provided by Article 21 GDPR.

It is also possible to object at any time to the processing of personal data for direct marketing purposes.

Requests can be sent to:

info@archetipi-digitali.it

Archetipi responds without undue delay and, as a rule, within one month of receiving the request. In the cases provided by law the term may be extended, informing the data subject.

Where there are reasonable doubts about the requester's identity, additional information necessary for verification may be requested.

Where certain data is stored exclusively on the user's device and is not accessible to Archetipi, the controller will take this into account in responding to the request.

14. Automated decisions and profiling

Within the processing described in this notice, Archetipi does not envisage decisions based solely on automated processing that produce legal effects or similarly significantly affect data subjects within the meaning of Article 22 GDPR.

AIquote does not use quota information to commercially profile users or assign them individual scores.

Any profiling activities connected with different services will have to be the subject of a specific notice, where envisaged.

15. Minors' data

Archetipi's corporate site and professional services are not specifically intended for minors.

Applications that connect to third-party services, such as AIquote, can be used in compliance with the age requirements and terms set by the respective providers.

Archetipi does not intentionally use the features described to collect minors' personal data for commercial profiling.

16. Right to lodge a complaint

Data subjects who believe that the processing of their personal data violates applicable law may lodge a complaint with the competent supervisory authority, pursuant to Article 77 GDPR.

In Italy, the supervisory authority is the:

Garante per la protezione dei dati personali (Italian Data Protection Authority)

https://www.garanteprivacy.it

Any further administrative and judicial remedies provided by law remain unaffected.

17. Updates to the notice

Archetipi may update this notice as a result of legislative, organizational or technological changes, or of the introduction of new features, services and applications.

Changes will be published on this page with an indication of the update date.

In the case of substantial changes requiring further information obligations or the acquisition of consent, Archetipi will proceed in accordance with applicable law.

The updated version will be made available on the website and, where relevant, through the applications concerned.