Privacy Policy

1. Data controller

The controller of Users' personal data is GRUPPO G COMUNICAZIONE S.R.L., registered office at Via Buenos Aires 34, 10134 Turin (TO), Italy, VAT and Tax Code 10329430010 (EU VAT IT10329430010), REA TO-1124060, email and certified email (PEC) marinoacg@legalmail.it. For any request about personal data: marinoacg@legalmail.it. The controller has not appointed a Data Protection Officer (DPO), as it is not mandatory for the processing carried out.

2. Scope: Users and End clients

This notice covers the data of people accessing the Platform (administrators, agencies, clients and their staff). For End clients' data that Agencies enter into the Platform (e.g. business name, sector, keywords, texts), the Agency is the controller and the Provider acts as processor under Art. 28 GDPR, according to the DPA.

3. Data processed

Account data: name or company name, email, role, password stored only in hashed form. Usage data: date and number of logins, articles created, plan limits, upgrade requests and related notes, configured locations, acceptance of legal documents (date, version, IP address). Content: texts, keywords, images, client profiles, editorial plans and reports. Technical data: IP address, server logs, failed login attempts.

4. Purposes and legal bases

a) Creating and managing the account and providing the Platform, including limits and usage reports (performance of a contract, Art. 6.1.b GDPR). b) Security and abuse prevention, e.g. lockout after repeated failed logins (legitimate interest, Art. 6.1.f). c) Service communications, such as alerts about limits and handled requests (performance of a contract). d) Tax and accounting obligations (legal obligation, Art. 6.1.c). e) Establishment or defence of legal claims, including proof of acceptance of the Terms (legitimate interest).

We do not carry out marketing profiling and do not sell data to third parties.

5. Artificial intelligence and search data

To generate texts and SEO analyses, the Platform sends AI and search data providers only the content needed (keywords, titles, instructions, locations). No credentials or account data are sent. Under the providers' contractual terms, data sent via API are not used to train their models. Users are asked not to enter unnecessary third-party personal data.

6. Processors and recipients

Data are processed by providers appointed as processors or sub-processors: application hosting and infrastructure (Emergent Labs); database and file storage (MongoDB Atlas, MongoDB Inc.); storage of social post photos and videos (Cloudflare R2, Cloudflare Inc., EU area); AI text and image generation (Google LLC – Gemini); search data and keyword volumes (DataForSEO); publishing automation (Make, Celonis); destination WordPress websites and social networks chosen by the User. Data may also be disclosed to tax and legal advisers and to authorities when required by law. The up-to-date list is available on request.

7. Transfers outside the EU

Some providers may process data in the United States or other countries outside the European Economic Area. Transfers are based on adequacy decisions (e.g. EU-US Data Privacy Framework) or on Standard Contractual Clauses approved by the European Commission.

8. Retention

Account data and content: for the duration of the relationship and for 12 months after termination, to allow export. Accounting data: 10 years. Security and access logs: up to 90 days. Upgrade requests and acceptance records: for the duration of the relationship and the applicable limitation period. Social post media: videos are deleted about one hour after publication and photos 7 days after publication; the post text is kept for the duration of the relationship. Users are advised to download media for their own archive.

9. Data subject rights

You may request access, rectification, erasure, restriction, portability and object to processing (Arts. 15-22 GDPR) by writing to marinoacg@legalmail.it. We reply within 30 days. You may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it). If your data were entered by an Agency as End client, please contact the Agency first, as it is the controller.

10. Security

Hashed passwords, expiring access tokens, separate roles (administrator, agency, client), data isolation per account and per client, encrypted connections (HTTPS) and temporary lockout after failed login attempts.

11. Changes

Any changes to this notice are published on this page with the update date and, if relevant, communicated to Users.