Privacy policy

Who is responsible for your data

The data controller is SOGNI DIGITALI di Desire Laval Oliver Polydor, Via Gino Lisa 45, 10147 Torino, Italy, VAT number IT13347550017. For any question about your data, write to hello@sognidigitali.com or to privacy@sognidigitali.com.

Data protection officer: none has been appointed. For any question about your data, you can contact Desire Laval Oliver Polydor, owner of the business, at privacy@sognidigitali.com.

General principle: we only ask for the data your request needs. The website contains no advertising trackers and SOGNI DIGITALI does not sell your data.

What data, for what purpose

Each feature of the website receives different data. Here is, purpose by purpose, what is collected and why.

Contact form

Data collected: name, email, message and, if you enter them, phone, company and current website, plus the page language. An anti-abuse calculation (ALTCHA) runs in your browser, with no cookie or third-party service. Purpose: to reply to your message and, if you wish, prepare a proposal. Messages are received in Keronos, our management software, which we host ourselves.

Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR). Retention period: 12 months after our last exchange if no contract is signed, then deletion; if a contract is signed, your message joins your client file and follows the periods set out below.

Booking the free 30-minute call

Data collected: name, email, chosen date and slot, meeting format, language, your consent and, if you enter them, phone, company, current website, address (in-person meeting) and message. The same anti-abuse calculation (ALTCHA) applies. Purpose: to organise the meeting and send you the confirmation and any reminder. Requests are received in Keronos.

Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR). Retention period: 12 months after the meeting. Video calls: Zoho Meeting (Zoho Corporation B.V., Utrecht, Netherlands; data hosted in Zoho's European Union data centre).

Prometheus AI assistant

Prometheus is an artificial intelligence assistant: its answers are generated automatically. Your messages and its answers go through Keronos and are then sent to Scaleway, our AI provider, which runs the language model in its data centres in Paris, France.

Data collected: the content of the conversation, a session ID, the language and your IP address; if you ask to speak to the team, the name, email, phone and company you enter. Purpose: to answer your questions about our services. Do not write sensitive data (health, passwords, bank details) in the conversation.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to us. Retention in Keronos: 12 months after the conversation. Retention and use of messages by Scaleway, including for training: Scaleway does not keep or read message content and does not use it to train models. It keeps only anonymised usage data, for up to 6 months, and, if a request causes an abnormal error, its content for two weeks at most to fix the problem.

Phone calls with Prometheus

Depending on the number you call, Prometheus, our AI receptionist, answers straight away, or the team answers first and Prometheus takes the call if no one picks up. During a call with Prometheus, a member of the team may take over. Prometheus may also call you back about an appointment or a call request you made. At the start of the call, you are told that the call is recorded and, when Prometheus answers, that you are speaking with an artificial intelligence.

Data collected: your phone number, the audio recording, the call record and, for calls with Prometheus, the transcript and a written summary. The phone operator Zadarma carries the call. When Prometheus answers, the voice is processed in real time by Amazon Web Services in Stockholm, and the text by Scaleway in Paris.

Legal basis: our legitimate interest in handling and following up requests made by phone (Art. 6(1)(f) GDPR); you can object by writing to us. The audio recording and, for calls with Prometheus, the transcript are deleted after 30 days. The written summary of calls with Prometheus and the record of every call stay in your client file for as long as it exists. During a call with a member of the team, you can ask them to stop the recording: the audio is then not kept. With Prometheus, the recording cannot be stopped: Prometheus can put you through to a member of the team (during office hours) or have someone call you back, and the audio and transcript of what has already been said are deleted after 30 days.

Online presence audit

The audit is optional. It analyses a public website whose address you provide. Data collected: the site address, your name, your email address, your language and, if you enter it, the company name. Purpose: to prepare your analysis, send it to you by email after our team has reviewed it and, as you accept by ticking the form's box, contact you about it.

This data is processed in Keronos, our management software, where your request creates a contact record. An artificial intelligence model, hosted in Paris by Scaleway, our AI provider, reads the public content of your site to prepare a draft of the analysis. Our team reviews this draft: nothing is sent to you without that review.

The analysis reads public pages only. Only enter the address of a site you manage or are entitled to have analysed. Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) and, to contact you about the analysis, the consent you give by ticking the box (Art. 6(1)(a) GDPR). Retention of the analysis and data: 12 months; your email address is deleted 30 days after your request is closed.

Unlocking Skills

To get a skill made by SOGNI DIGITALI, the page invites you to follow our TikTok and Instagram accounts. Unlocking asks for no account or email, and the website cannot check whether you follow us: it receives no data about you from TikTok or Instagram. Your browser only sends a random identifier, which cannot be used to recognise you, and our server sees your IP address only for as long as needed to limit abuse.

When you open TikTok or Instagram, those services process your data under their own privacy policy.

Visitor statistics

We measure audience with Umami, installed on our servers. Umami sets no cookies and respects your browser's Do Not Track setting. Statistics are aggregated: page views, country, device type, referring sites.

Legal basis: legitimate interest in understanding how the website is used (Art. 6(1)(f) GDPR). Retention period: 12 months.

Server technical logs

Our server and Keronos record technical logs: IP address, date and time, requested page or feature, and browser type. They are used only for security (detecting abuse and attacks) and for troubleshooting. Legal basis: our legitimate interest in protecting the website and our services (Art. 6(1)(f) GDPR). Retention period: 12 months at most.

Likes and comments on skills and the blog

On each skill's page, you can leave a like and a comment without creating an account; under each blog article, in the same way. Comments are published only after our team has reviewed them. For a comment, we receive your nickname and your text, which become public once the comment is approved, plus the language of the page. This data is stored in Keronos, our internal management tool.

Your email is optional. If you enter it and tick the consent box, it is used only to reply to you: the website never shows it or sends it back, and it is deleted with the comment. You can ask for it to be deleted at any time. Liking a story works the same way, with no account or comment; sharing a story only tells us the means used (device menu, download or link), never the app you chose or who you are.

To limit abuse, your IP address is never stored in plain form: we keep only a one-way fingerprint (HMAC-SHA256 with a secret server key), used only for rate limits and spam prevention. The like relies on a random identifier created by your browser (see the Cookies and local storage page); we keep only a fingerprint of it (SHA-256).

Legal basis: legitimate interest for the nickname, text and IP fingerprint (Art. 6(1)(f) GDPR); your consent for the email (Art. 6(1)(a) GDPR). Retention: published comments and their email, for as long as the comment stays online, until you ask for deletion or until we remove it if it is inappropriate or misleading; rejected comments: permanently deleted 30 days after rejection; IP and like fingerprints: 12 months.

AI visibility checker

This tool reads public files of a website whose address you provide (robots.txt, llms.txt, llms-full.txt, home page, sitemap). Only this address is processed, for the duration of the check: it is neither stored nor logged, and the result is not kept. We only count that a check took place, with no cookie or identifier. Your IP address is used to limit abuse; it is not kept.

Referrals

When you arrive through a referral link, we keep that link's code with your request, so we can recognise the person who recommended you. This code may contain their first name. You can delete it from the form before sending. It is not linked to any cookie or to our statistics.

This person receives a PayPal credit or a credit note if a contract is signed. In their client area, they see the status of the referral and a masked version of your contact details; your name and company only with your agreement. They never access the content of your request.

Legal basis: legitimate interest for the code (Art. 6(1)(f) GDPR); your consent for the name and company (Art. 6(1)(a) GDPR). Retention period: until the reward is paid, then 12 months; a referral that leads to no contract is deleted after 12 months; accounting records (credit notes) are kept for 10 years.

Business introducer partners

When you arrive through a business introducer partner's link and accept in the banner, your browser keeps that partner's code for 30 days in its local storage (key sogni-digitali-affiliate). There is no cookie. The code is removed from the page address as soon as you arrive and does not enter our statistics. If you later arrive through another partner's link, it replaces the previous one; a newsletter link never does. The same consent covers the name of the newsletter or campaign whose link you followed (key sogni-digitali-campaign), attached to your request so we know where it came from. Without consent, nothing is kept. When you arrive, before you answer, the code is sent once to our server and then to Keronos, with your IP address, to check whether it belongs to a partner or a campaign and to limit abuse; nothing is kept in your browser at that point. Once accepted, it stays on your device and is sent again only with the contact form. A newsletter link skips this check; it is counted in our statistics, with no personal data.

This code is used to link your request to that partner, so we can calculate their commission if the deal is concluded. The business introducer partner has no account and no access to Keronos, where your request is recorded: they do not receive its content. They are paid a commission when a deal they brought in is concluded. This is not the client referral described above, which gives a PayPal credit or a credit note.

Legal basis: your consent for keeping it in the browser, which you can withdraw at any time with "Manage my cookies"; for the link in Keronos, our legitimate interest in paying our partners (Art. 6(1)(f) GDPR). Retention period: the code stays 30 days in your browser and your choice 6 months; in Keronos, for the term of the contract with the partner, then 12 months to settle the last commissions; commission payments stay in the accounts for 10 years.

Atrium client area

If you become a client, your Atrium area records your login sessions (30 days at most, closed after 7 days without a visit), a 30-day presence cookie needed for it to work, your notification preferences and, if you turn them on, your phone or computer notification subscriptions, as well as your requests to be called back by Prometheus (number, language, date of consent). We also keep proof of your consents: version of the texts accepted, date and IP address fingerprint.

Notifications go through your browser's service (Google, Apple or Mozilla), which only receives a neutral text. Legal basis: performance of your contract (Art. 6(1)(b) GDPR) and, for proof of consent, our duty to be able to demonstrate your consent (Art. 7(1) GDPR). Retention: for as long as your account exists, then the contract retention period.

Who receives your data

Your data is read by the people at SOGNI DIGITALI who handle your request. It is also processed on our behalf by the providers below, each only for its own task.

• IONOS: hosting of the website on a virtual private server in Europe. Contracting company: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, bound to SOGNI DIGITALI by a data processing agreement.
• Scaleway, in Paris, France: AI model that answers Prometheus assistant messages and prepares the audit draft from the public content of the site. Contracting company: Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, bound to SOGNI DIGITALI by a data processing agreement.
• Email: sending confirmations and replies by email. Mailboxes: Zoho (mx.zoho.eu). Contracting company: Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, with data hosted in its European Union data centre. Keronos's automatic emails are sent through ZeptoMail, a service of the same Zoho group, from the European Union.
• Amazon Web Services, Stockholm region, Sweden: Prometheus's voice on the phone, speech recognition and speech synthesis. Contracting company: Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg; AWS's data processing addendum applies through its service terms.
• Hostinger International Ltd (Larnaca, Cyprus), with a server located in Düsseldorf, Germany: telephony and Prometheus's voice, including call recordings and transcripts. Zadarma (Estonia): operator of our phone lines. GatewayAPI (Denmark): sending text messages. WhatsApp (Meta group), if you choose to write to us through this channel.

Keronos, which receives forms, booking requests and conversations, is hosted and run by SOGNI DIGITALI itself. We may also disclose data to an authority when the law requires it.

Transfers outside the European Union

The data you entrust to us through this website is hosted and processed in Europe: our servers at IONOS (Europe) and Hostinger (Düsseldorf), AI at Scaleway (Paris) and AWS (Stockholm), email at Zoho (EU data centre). Zoho and AWS belong to groups based outside the Union; for any access from another country, their contracts provide for the European Commission's standard contractual clauses. If you write to us on WhatsApp, Meta may process your data in the United States, under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023).

You can request a copy of the applicable safeguards by writing to hello@sognidigitali.com.

How long, and how we protect your data

• Contact form messages: 12 months after the last exchange if no contract is signed
• Booking requests: 12 months after the meeting
• Prometheus conversations: 12 months in Keronos for written conversations; call recordings and transcripts deleted after 30 days. At Scaleway: message content not kept (two weeks at most in case of an abnormal error); anonymised usage data up to 6 months.
• Calls: recording 30 days; for calls with Prometheus, transcript 30 days; summary and call record for as long as your client file exists.
• Audit reports and related data: 12 months; the email address is deleted 30 days after the request is closed
• Umami statistics: 12 months
• Data kept after a contract is signed (accounting and tax obligations): 10 years from the last entry (Article 2220 of the Italian Civil Code)
• Likes and comments on skills and the blog: published comments and their email, for as long as the comment stays online; IP and like fingerprints, 12 months; rejected comments: deleted 30 days after rejection

Security measures: encrypted connections (HTTPS), access limited to authorised people, regular backups and security updates. No measure offers absolute security; if a data breach puts you at risk, we follow the notification duties set by the GDPR.

Your rights, and how to exercise them

The GDPR gives you the right to access your data, have it corrected or erased, restrict its processing, object to it, receive it in a machine-readable format (portability) and withdraw any consent at any time, without affecting what was done before the withdrawal.

To exercise a right, write to hello@sognidigitali.com stating your request. We reply within one month, which may be extended by two months for a complex request; we will tell you if so. We may ask you to confirm your identity.

Automated decisions: no decision with legal or similarly significant effects on you is made solely by automated means, either by Prometheus or by the audit.

Lodging a complaint

If you believe your data is not being handled correctly, you can lodge a complaint with the Garante per la protezione dei dati personali, the Italian data protection authority (garanteprivacy.it), or with the authority of the EU country where you live or work. Feel free to write to us first: we always try to settle the matter directly.

Updates to this policy

We update this policy when the website or our providers change. The date at the top of the page shows the latest version. If a change affects how data already collected is used, we will let you know by email when we have your address, and through a notice on this page or in your Atrium client area.

Cookies and local storageLegal notice