Privacy Policy

This privacy policy explains how GPT Chatbot di Federico De Cillia, an Italian sole proprietorship ("we", "us"), processes personal data across gptchatbot.it (this marketing website, the "Site") and the GPT Chatbot application at app.gptchatbot.it (the "App") — together, the "Services". It is the single privacy policy for both.

Data controller: GPT Chatbot di Federico De Cillia — via Ernesto Teodoro Moneta 50, Milano (MI), 20161, Italy — VAT IT13990330964 — info@gptchatbot.it

1. What We Collect, and Why

Depending on whether you just browse the Site or also use the App, we collect the following, each for a specific purpose and legal basis under the GDPR (Regulation (EU) 2016/679):

• Technical & log data (IP address, browser type, pages visited, timestamps) — collected automatically by our hosting providers to operate and secure the Services. Legal basis: legitimate interest (Art. 6(1)(f)) in running functioning, secure services.
• Analytics & advertising data on the Site (via Google Analytics 4 and Meta Pixel — see §3) — only if you accept our cookie banner. Legal basis: consent (Art. 6(1)(a)).
• Email address and message content, if you contact us directly at info@gptchatbot.it. Legal basis: pre-contractual/contractual necessity (Art. 6(1)(b)) or legitimate interest in responding to your enquiry.
• Account data (name, company email, password), if you create an App account. Legal basis: contract (Art. 6(1)(b)).
• Content you provide to the App — documents, URLs and other sources you connect for your chatbot's knowledge base, and the conversations it has with your end users — processed to generate chatbot responses. Legal basis: contract (Art. 6(1)(b)).
• Billing data, if you subscribe to a paid App plan, handled by our payment processor, Stripe. Legal basis: contract (Art. 6(1)(b)).

The Site itself does not require account creation and does not request camera or microphone access. We do not sell personal data to third parties.

2. Cookies and Consent

On your first visit, a banner asks you to accept or decline non-essential cookies. Only strictly necessary cookies (e.g. remembering your language and your cookie choice) are set before you decide — Google Analytics 4 and Meta Pixel load only after you click "Accept". Your choice is stored in your browser and applied on every subsequent visit.

You can change or withdraw your choice at any time via the "Cookie Preferences" link in the footer of every page. We do not respond to browser Do Not Track (DNT) signals, since our banner already provides an explicit, revocable choice.

3. Analytics and Advertising Tools We Use

• Google Analytics 4 (Google Ireland Ltd.) — audience and traffic measurement, with IP anonymisation enabled.
• Meta Pixel (Meta Platforms Ireland Ltd.) — measures the effectiveness of our advertising and, if you have consented on Meta's own platforms, can be used for ad personalisation there.

Both are loaded only after cookie consent (§2) and only process data while your consent is active.

4. Recipients and Sub-processors

We share personal data only with the service providers strictly needed to run the Services, each acting as our data processor under a data processing agreement:

• Vercel Inc. (USA) — Site hosting and infrastructure
• Google Ireland Ltd. — Site analytics (Google Analytics 4)
• Meta Platforms Ireland Ltd. — Site advertising measurement (Meta Pixel)
• GPT-Trainer — the platform powering the App, hosted on AWS (Amazon Web Services), primarily in Oregon, USA. GPT-Trainer holds ISO/IEC 27001:2022 and SOC 2 Type I certifications.
• AI model providers — OpenAI, Anthropic, Google and DeepSeek. Depending on which model you (or your own customer) select for a chatbot agent, the conversation content and connected documents needed to generate a response are sent to that provider. On the Business plan, if you use your own API key (BYOK) for a provider, that processing relationship is directly between you and the provider, not us.
• Stripe — for paid App plan billing
• Third-party integrations you choose to enable (e.g. Calendly, Google Calendar, WhatsApp, Instagram, or a webhook you configure) — only the data needed for that integration to function, and only if you turn it on

We do not otherwise disclose personal data to third parties, except where required by law.

5. International Data Transfers

Vercel, Google, Meta, GPT-Trainer, OpenAI and Anthropic process data in the United States. These transfers are covered by the European Commission's EU-U.S. Data Privacy Framework adequacy decision and/or the 2021 Standard Contractual Clauses, which the providers have executed as part of their standard terms.

DeepSeek is based in China, which the European Commission has not recognised as offering an adequate level of data protection — a materially higher-risk transfer than to the US, and one the Garante per la Protezione dei Dati Personali has previously taken direct enforcement action on regarding DeepSeek specifically (in January 2025, ordering the DeepSeek app blocked from Italian app stores over transparency concerns). If a chatbot agent uses DeepSeek as its model, conversation content and any connected documents are transferred to China under whatever contractual safeguards DeepSeek offers at the time — we have not independently verified that Standard Contractual Clauses or another valid transfer mechanism are in place. If this risk matters for your use case or your own customers' data, avoid selecting DeepSeek as the model, or use it only via your own API key (BYOK, Business plan) so the transfer is your own direct relationship with DeepSeek rather than ours.

6. Data Retention

• Analytics data: per Google's and Meta's standard retention settings for our account (currently 14 months for Google Analytics), or until you withdraw consent, whichever is sooner.
• Direct enquiries (email): for as long as needed to handle the request, then archived per standard business/accounting retention periods where a legal basis requires it.
• App account and chatbot data: for as long as your account is active, then deleted or anonymised within a reasonable period after closure — except billing records we must keep for statutory accounting/tax retention periods.

7. Your Rights

Under Articles 15–22 GDPR, you have the right to: access the personal data we hold about you; rectify inaccurate data; request erasure; restrict or object to processing; receive your data in a portable format; and withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, email info@gptchatbot.it. We will respond within one month of your request (extendable by two further months for complex requests, in which case we will tell you why). This is free of charge for reasonable requests.

8. Security

We rely on our providers' security infrastructure (encryption in transit via HTTPS, access controls, and the security certifications maintained by Vercel, Google, Meta and GPT-Trainer) and restrict access to the data we hold to what is operationally necessary.

9. Children's Privacy

The Site is a business marketing website, not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us at info@gptchatbot.it and we will delete it.

10. Changes to This Policy

We may update this policy from time to time; the effective date at the top reflects the last revision. Material changes will be highlighted on this page.

11. Complaints

If you have concerns about how we process your personal data, you have the right to lodge a complaint with your national data protection supervisory authority. In Italy, this is the Garante per la Protezione dei Dati Personali. We'd appreciate the chance to resolve your concern directly first, at info@gptchatbot.it.