Privacy policy

The data controller

DEEXMA LABS - SOCIETÀ A RESPONSABILITÀ LIMITATA (single-member limited liability company), Via Romualdo Marenco 28, 00124 Rome (RM), Italy — Tax code / VAT no. 18654381005, REA RM-1798329.

For any matter concerning personal data: PEC (certified email) [email protected]. No DPO has been appointed: the company’s size and processing activities do not require one.

The contact form

If you submit the form we process: first and last name, business email, company (optional) and the description of the process you tell us about. Name, email and description are necessary: without them we cannot reply, and failing to provide them only means we cannot handle the request. The mandatory checkbox confirms that you have read this notice: it is not consent, and it is not the legal basis for the processing.

Requests you send are received by the site’s functions hosted on Cloudflare Pages and stored in Cloudflare D1. The database is accessible only to authorised personnel through the provider’s reserved tools. A copy of the request, with the contact details and the message, is sent through Cloudflare’s email service to the company mailbox so that we can reply; it is therefore also processed by the business email providers.

Purposes and legal bases: replying to and assessing the request. When you write on your own behalf, this concerns pre-contractual measures taken at your request (Art. 6(1)(b) GDPR); when you write on behalf of a company, the basis is legitimate interest (Art. 6(1)(f)) in handling the commercial contacts you initiate — processing you may object to at any time using the objection described below.

Retention in the site database: 12 months from submission of the request. Once a year we delete from the company mailbox the requests that are closed, with any replies, unless they led to a collaboration. If a collaboration begins, the data becomes part of the contractual relationship and is kept for its duration and for the statutory periods that follow (10 years for administrative and accounting records). No profiling: requests are read by a person.

A courtesy we ask of you: in the free-text field describe processes, not people. We do not need — and you should not enter — third parties’ personal data (employees, clients) or special categories of data: the workflow is enough for a first assessment.

The second checkbox — optional and never pre-selected — concerns receiving email communications about Deexma Labs’ services and case studies, at most once a month. Legal basis: consent (Art. 6(1)(a) GDPR; Art. 130 of the Italian Privacy Code). It can be withdrawn at any time, as easily as it was given: via the link in every communication or by writing to the PEC, with immediate effect and without affecting the lawfulness of prior processing. Consent is kept together with its proof and the request for a maximum of 12 months, unless withdrawn earlier.

Submitting the form is protected by anti-abuse measures without a visible CAPTCHA: a honeypot field for bots and a single-use technical token of limited validity, which is not used to recognise you between visits. At submission the system may process your IP address in pseudonymised form (hash) for the sole purpose of limiting bulk submissions, kept for a maximum of 30 days. Legal basis: legitimate interest (Art. 6(1)(f)) in the security of the service.

AI demos and features

The home demo, the lab’s search and audit functions and the request-drafting assistant in the contact section process the free text you choose to send, on your own initiative. Outputs are produced by an artificial intelligence system and are marked as such in the notice next to each demo. When the AI service is unavailable — for maintenance or because usage limits have been reached — the same features show only preloaded examples or fixed-question guided paths, without artificial intelligence, and send no text to external services.

The assistant in the contact section only drafts a summary of your request: in the guided path without AI the draft is created and stays in your browser, while in AI mode the answers and the draft pass through the systems described in this section solely to generate them, and are not stored. In either case the conversation is not kept and the draft does not become a request until you decide to submit the form, after reading it and editing it if needed: from then on the request follows the rules of the section “The contact form”, including 12-month retention.

Purposes and legal basis: providing the demonstration or assistance requested and showing you the generated answer. The processing is necessary to perform the service requested by the data subject (Art. 6(1)(b) GDPR).

Recipients: the text is sent to OpenRouter, Inc. (United States), which acts as processor under Art. 28 GDPR pursuant to its own Data Processing Agreement (DPA). To generate the answer, OpenRouter forwards it to the provider of the configured language model, chosen only from those OpenRouter lists as zero data retention: under their terms they do not keep the texts after processing and do not use them to train models. The lab search also uses a web search tool, which receives the words to search for and operates under its own terms.

Processing by OpenRouter and the model provider may take place outside the European Economic Area. As a safeguard for the transfer to OpenRouter, its DPA includes the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914; you may ask the controller for a copy of them.

The controller does not keep the texts sent or the answers generated. It records only a technical event with the purpose of the request, the pseudonymised hash of the IP address, the date and an estimate of the request size, used for usage limits. Text logging is disabled. The technical event is deleted at the first daily cleanup after 48 hours from the request, and in any case within 30 days for security, usage-limit control and abuse-prevention purposes.

As indicated next to the fields, do not enter personal data of your own or of third parties, or special categories of data: non-personal content is enough to try the demos.

Hosting, recipients and technical logs

The public site is delivered through Cloudflare Pages, a service of Cloudflare, Inc., which acts as processor under Art. 28 GDPR pursuant to its own Data Processing Addendum. Pages and static assets are served through the provider’s global network. When a user accesses the site, Cloudflare processes the technical data needed to route and protect traffic — including IP address, routing data and system information — and may make some of it available to the controller as technical logs. Legal basis: legitimate interest in the security and operation of the site (Art. 6(1)(f) GDPR); retention follows the service terms and the criterion of necessity with respect to delivery and security.

Categories of recipients: hosting and infrastructure service providers, acting as processors. Cloudflare, Inc. delivers the public site, runs the functions that receive requests and stores data in Cloudflare D1, under its own Data Processing Addendum. The database has European Union jurisdiction; the constraint concerns the database and does not geographically limit the global network on which the functions run. We do not sell or transfer data collected through this site to third parties for their own purposes.

Transfers outside the EU: for hosting and infrastructure services, processing may take place outside the Union, covered by the safeguards of Chapter V GDPR (standard contractual clauses included in the providers’ DPAs and, where applicable, adequacy decisions). You may ask the controller for a copy of the safeguards.

Cloudflare Web Analytics

The site loads a small Cloudflare script to measure page views, visit sources, loading times and Core Web Vitals. According to the provider documentation, Web Analytics uses no cookies or localStorage for measurement and does not fingerprint visitors.

The browser downloads the script from static.cloudflareinsights.com and sends metrics to cloudflareinsights.com. We add no contact-form data, AI conversation texts or custom events to the beacon. The statistics can be viewed by the controller in the Cloudflare dashboard; details about the provider and transfers are in the privacy policy.

We do not use Cloudflare Web Analytics for advertising or profiling and we keep no measurement preferences in the browser.

The Instagram profile and ads

Our profile @deexmalabs is on Instagram, a service of Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland). Meta is an independent controller of the data it processes on Instagram, except as stated below for ads and statistics: how it processes that data, including outside the European Economic Area, and how to exercise your rights against it are explained in its Privacy Policy (privacycenter.instagram.com/policy).

We are the controller for what we do on the profile, which we manage with our own staff and external communications and social media contractors: the contractors process data on our behalf as processors (Art. 28 GDPR). We process what Instagram shows us (username and public data, interactions, who viewed stories), the messages you send us and the statistics, figures without names that also cover people who only visit the profile. Legal basis: legitimate interest in communicating our activity, handling conversations on the profile and measuring how content performs (Art. 6(1)(f) GDPR); for questions about our services that you ask on your own behalf, pre-contractual measures (Art. 6(1)(b)). Following us and writing to us is your choice.

We also run paid ads on Instagram to promote the company. We choose who sees them using the criteria Meta offers: age, country or region, and general interests. To show them Meta uses the data it holds about you, which involves profiling carried out by Meta, and it reports the results to us only as figures without names. For interests, which Meta infers from your behaviour, the legal basis is the consent it collects for personalised ads (Art. 6(1)(a)); for age and location it is our legitimate interest in promoting our services (Art. 6(1)(f)).

We are joint controllers with Meta for choosing the audience, displaying the ads and reporting on the results (Art. 26 GDPR), and the same applies to the profile statistics. We handle the choice of audience and this notice; Meta handles how the ads are shown and the individual data behind the reports and statistics. For that data you may contact us or Meta: if you write to us, we forward the request. We see comments on an ad, and any messages that follow from it, with the username, and we treat them like those on the profile.

You may object at any time: to the ads without giving a reason, and to the other processing on the profile on grounds relating to your particular situation. For ads, the quickest way is through Instagram’s Ad preferences, where you can hide our ads, so that you stop seeing them, and withdraw the consent you gave Meta for personalised ads.

Once a year we delete from the profile’s message inbox the conversations that are closed, meaning nothing is outstanding; if they led to a collaboration, the periods in “The contact form” apply. This deletes our copy: your copy and Meta’s do not depend on us. Comments and interactions stay on Instagram until you or we remove them; statistics, reports and lists of story viewers remain for the periods set by Meta.

Your rights

Within the limits of Articles 15-22 GDPR you may exercise at any time, by writing to the controller’s PEC (or via the contact form), the rights of:

• access to the data concerning you and information about their processing;
• rectification of inaccurate or incomplete data;
• erasure, in the cases provided for;
• restriction of processing;
• portability, for data you have provided and that is processed by automated means on the basis of a contract or consent;
• objection to processing based on legitimate interest, for reasons relating to your particular situation;
• objection to promotional emails: at any time, without any reason, with immediate effect (for Instagram ads, see the dedicated section);
• withdrawal of consent, for processing based on it, without affecting the lawfulness of prior processing.

We reply within one month of the request; the period may be extended by two months for complex or numerous requests, in which case we inform you within the first month with the reasons (Art. 12 GDPR). If you believe that processing infringes the law, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

No automated decisions

We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals (Art. 22 GDPR). We do not profile anyone on this site; Instagram ads are described in the dedicated section.

Minors

This site is aimed at companies and professionals. We do not knowingly collect data of children under 14; if you believe this has happened, write to us and we will erase it.

Changes to this notice

If processing changes — a new tool, a new provider, a new purpose — this page is updated before the change becomes operational, with the revision date at the top. Previous versions are available on request.