Privacy policy

The data controller is [RAGIONE SOCIALE], VAT number [P.IVA], registered at [INDIRIZZO].

For anything on this page — a question, a request, a complaint — write to [EMAIL PRIVACY]. A person reads it.

We have not appointed a data protection officer. We are not required to, and pretending otherwise would only add a mailbox nobody answers.

This page covers the public eutetic site and the demo behind the login. It does not cover a box installed in a workshop: what a box reads from your machines is governed by the contract signed with your company, not by this page.

The form at the bottom of the home page asks for four things: your name, your company, your email address, and your message. Name, email and message are required; company is not.

We use them for one purpose: to read what you wrote and answer you. Nothing goes into a mailing list, and we do not write to you again about something else.

The legal basis is Article 6(1)(b) GDPR — steps taken at your request before entering into a contract — and, where your message is not about a possible contract, our legitimate interest under Article 6(1)(f) in replying to people who write to us. You choose what to put in the message field, so please keep it to what is needed to answer; do not send health data, ID documents, or anyone else's personal data.

The form is delivered by FormSubmit, a third-party form relay, which passes the message on to our mailbox. It is a processor for that step. We have not been able to confirm where FormSubmit operates its servers, so we cannot rule out that your message is handled outside the European Economic Area. If that matters to you, write to us directly at the address above instead of using the form.

The form has a hidden field that automated senders fill in and people do not. If it comes back filled, the message is dropped and nothing is sent anywhere. That field collects nothing about you.

We keep the resulting email for as long as the conversation is live, and then for up to 24 months, so that we can pick up a thread you started. After that it is deleted.

There is no public signup. Accounts are opened by us, one at a time, for people we have agreed to give access to. If you have an account, we hold your name, your email address, your password stored as a hash — never in readable form — your role, and a record of your sessions.

We use it to let you in, to keep you logged in, and to know who did what if something needs to be looked into. The legal basis is Article 6(1)(b): performance of the arrangement under which you were given access.

This data lives in a Supabase Postgres database in region eu-west-1 — inside the European Union. It does not leave it.

We keep it while the account is open. Close the account and we delete it, along with the sessions, within 30 days.

If you import a dataset into the demo, that file stays in your browser. It is held in your browser's own storage on your own machine and is never uploaded to us. We cannot see it, and clearing your browser storage removes it for good.

The site is hosted by Vercel, which acts as a processor. Like any web server, Vercel records requests as they arrive — IP address, time, page requested, browser string. Those logs exist to serve the pages and to spot abuse, on the legitimate interest basis of Article 6(1)(f), and they are short-lived. We do not use them to build a picture of you, and we do not read them unless something has gone wrong.

Vercel is a US company. Requests may therefore be handled outside the European Economic Area, under the safeguards Vercel puts in place for its customers, including the standard contractual clauses adopted by the European Commission.

It is worth being specific about the things this site does not do:

• There is no analytics of any kind. No page-view counter, no heatmaps, no session recording.
• There are no profiling cookies and no third-party cookies. See the cookie page.
• There is no advertising, no ad network, no tracking pixel.
• The video on the home page is served from our own site, not embedded from a video service, so watching it tells nobody anything.
• We do not sell, rent or trade personal data. There is no scenario in which we would.
• There is no automated decision-making and no profiling under Article 22 GDPR. Nothing here decides anything about you on its own.

Only the processors named above — Vercel for hosting, Supabase for the database, FormSubmit for delivering the contact form — each bound to handle the data on our instructions and for nothing else. Beyond them, we disclose personal data only if a court or a competent authority requires it.

Under Articles 15 to 22 GDPR you can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, ask us to limit what we do with it, ask for it in a portable form, and object to processing we base on legitimate interest. Where we rely on your consent, you can withdraw it at any time, and withdrawing it does not undo what was lawful before.

Write to [EMAIL PRIVACY]. We answer within one month. If we need longer we will tell you why, before the month is up.

Giving us your data is never compulsory. The consequence of not giving it is simply that we cannot do the thing it was for: no email address, no reply.

If you think we have handled your data badly, you can complain to the Garante per la protezione dei dati personali (garanteprivacy.it), or to the supervisory authority where you live or work. You can go to court as well. We would rather you told us first, but that is your call, not ours.

If we start doing something new with personal data, this page changes before the new thing starts, not after. The date at the top is the date of the last change.