Privacy notice

1. Data controller

Unleaf Advisoring S.R.L.S. — Registered office: Via Sebino 11, 00199 Rome (RM), Italy, tax code and VAT no. 17905611004. PEC (certified email): company@pec.unleaf.it — to exercise your rights: privacy@unleaf.it.

The Controller has not appointed a Data Protection Officer (DPO), as the conditions that make the appointment mandatory under Article 37 GDPR are not met.

2. Categories of data processed

• Access request data: first name and surname, email, organisation, requested role, any free-text message, the declaration that the applicant is acting for professional purposes and not as a consumer, outcome of the assessment. The reserved area has no open registration: anyone requesting access fills in a form, which the Controller assesses. Providing these data is necessary to assess the request: without them, the request cannot be examined.
• Account data: email, password (stored only as a hash by the authentication provider, Supabase — we never see it in clear text), assigned role.
• Two-factor authentication (MFA): if enabled, a TOTP secret is generated and stored by Supabase; we never see the secret or the codes from your authenticator app.
• Acceptance of the Terms of use: account identifier and cryptographic hash of the email, date and time of acceptance, version of the Terms, the declarations made (acceptance of the Terms and specific approval of the clauses) and language of the screen.
• AI assistant usage logs (audit log): for each question put to the assistant we keep your account identifier (email), the text of the question, the generated answer, the cited sources, the role, the AI model used and the date and time — for traceability, security, enforcement of the monthly usage limit and periodic review of answer quality.
• Limits on the use of sources: for each answer we record, with your account identifier, which external documents the assistant used and how many words it reproduced verbatim from them, without the text; this is used to limit the use of the same document in the answers of the following 24 hours.
• Notifications and preferences: visibility preferences for the editorial series, the topics and countries you choose to follow, in-app service notifications and their read status. Following topics and countries is optional: if you choose none, you receive no notifications about them. The countries you follow may suggest where you travel or intend to travel: we use them only to show you the notifications you have asked for, we do not disclose them to third parties, and you can change or remove them at any time from the Account page. To find out when the travel advice for a country changes, the Portal reads the UK government’s public list of travel advice (Foreign, Commonwealth & Development Office), without transmitting any user data.
• Technical browsing data: IP address, browser type, pages visited, collected automatically by the hosting infrastructure for the operation and security of the site. The Controller does not keep its own archive of these logs, except for the temporary list of blocked IP addresses described in the next point.
• Automatic blocking of scanners: the Portal records the IP address of anyone requesting certain paths used by automated vulnerability scanners (paths that no legitimate user visits and that respond as non-existent pages), together with the date of the first and last attempts, the number of attempts, the last path requested and the client’s user agent, and blocks that address for 7 days (access to the whole site is refused). Anyone with an active session is neither recorded nor blocked.
• Reports and complaints: if you write to us to report content, to ask for it to be corrected or removed, or to make a complaint, we process your identification and contact details, the address of the contested content, the content of the report and of its outcome, and your exchanges with us.
• Rights requests: if you exercise one of your rights, we record the date and channel of the request, how we verified your identity, the right exercised, the actions taken, and the date and outcome of our reply.

The site does not use statistical analytics tools (e.g. Google Analytics), advertising cookies, tracking pixels or social plugins.

We count, in aggregate form, how many times the “Prossimi passi” (Next steps) box is opened and how many times people choose to write to Unleaf from it. These are numbers per day and per topic, with no account identifier, IP address or page read, and we do not use them to trace individual people or to profile anyone. If you write to Unleaf from the box, you send the message yourself from your email program to info@unleaf.it, and we handle it like any request for information, in accordance with the privacy notice of the www.unleaf.it website.

Third-party data in the content. The editorial content and the public sources indexed in the assistant’s knowledge base may contain personal data of third parties (for example names of authors, reviewers or people mentioned in institutional documents). These data are processed only as part of the informative content, on the basis of the Controller’s legitimate interest in disseminating information on security (Article 6(1)(f)); they come from public sources and not from the data subjects. Informing these people individually would be impossible or would involve a disproportionate effort (Article 14(5)(b) GDPR): this notice takes its place. To exercise your rights or to ask for a piece of data to be removed, write to privacy@unleaf.it.

3. Purposes and legal bases

• Assessing requests for access to the reserved area — pre-contractual measures taken at the request of the data subject (Article 6(1)(b)).
• Providing the authenticated service (login, dashboard with the history of your interactions, AI assistant, notifications, preferences, export) — performance of the contract with the registered user (Article 6(1)(b)).
• Keeping proof of acceptance of the Terms and defending the Controller’s rights — legitimate interest of the Controller (Article 6(1)(f)).
• Security, traceability, abuse prevention and enforcement of the monthly usage limit (audit log, rate limiting) — legitimate interest of the Controller (Article 6(1)(f)); the legitimate interest assessment is documented internally.
• Limiting the use of the same external document in the assistant’s answers, to protect the rights of the owners of the sources (source limit counters) — legitimate interest of the Controller (Article 6(1)(f)).
• Periodic review of the quality of the assistant’s answers on samples of recorded interactions: an OpenAI model carries out an automatic pre-assessment, without receiving the user’s email or identifier, and the final assessment is made by staff authorised by the Controller — legitimate interest in improving the service and keeping it secure (Article 6(1)(f)).
• Technical delivery, security and diagnostics of the infrastructure (technical hosting logs) — legitimate interest of the Controller in the operation and security of the service (Article 6(1)(f)).
• Protecting the Portal against automated vulnerability scanning (recording and temporary blocking of IP addresses that request the trap paths) — legitimate interest of the Controller in network and information security (Article 6(1)(f); Recital 49 GDPR).
• Handling reports, requests for correction and complaints received from third parties and defending the Controller’s rights — legitimate interest of the Controller (Article 6(1)(f)).
• Handling requests to exercise data subject rights and replying to them — legal obligation (Article 6(1)(c), in conjunction with Articles 12 and 24 GDPR); keeping the register of requests, so that we can show that we handled them correctly — legitimate interest of the Controller (Article 6(1)(f)).

4. Processing methods — no profiling

Data are processed using IT tools and appropriate technical and organisational measures (see section 9). The assistant’s monthly usage limit is an automatic threshold count, not a profiling activity: it produces no legal or similarly significant effects and does not constitute automated decision-making within the meaning of Article 22 GDPR. Adjusting the answers to the account’s role is a preference in how content is ranked, not an assessment of the person. Notifications about topics and countries depend only on the choices you make on the Account page: the Portal does not infer your interests from what you read or ask the assistant. The temporary blocking of IP addresses that request trap paths is also an automatic technical measure, which lifts by itself when it expires and produces no legal or similarly significant effects on the person.

5. Use of artificial intelligence

The Portal’s assistant is a generative AI system (Regulation (EU) 2024/1689 — the “AI Act”): users are informed of this in the interface and on a dedicated transparency page (“AI notice”) describing how it works, its limits and the responsibilities involved.

For privacy purposes, the following are particularly relevant:

• the text of the question, the context passages retrieved from the corpus and the previous messages in the same conversation are sent to OpenAI to generate the answer; for API customers, OpenAI states a maximum retention of 30 days (subject to legal obligations or exceptions for specific endpoints documented by OpenAI) and no use for model training by default;
• the question and the answer are recorded in the audit log (see sections 2 and 10); samples of interactions may be examined by staff authorised by the Controller for quality review (see section 3);
• the answers are generated automatically and may contain errors: they do not constitute professional advice and must be checked against the cited sources.

Recommendation: do not include in your questions personal data (your own or other people’s) that are not necessary, nor confidential or classified information: the free text of the question is kept in the audit log and sent to the AI provider on the terms described above.

6. Cookies

Only technical session cookies are used, set by the authentication provider (Supabase) solely for users who have logged in. The session ends after 48 hours of inactivity and in any case within 14 days of login. No cookies are set for anonymous visitors; no consent banner is required, as these are strictly necessary cookies under the Guidelines of the Italian Data Protection Authority (10 June 2021). The interface language (Italian/English) is determined by the URL path, not by a cookie. Details are in the cookie notice (a dedicated page of the Portal).

7. Recipients and processors

• Supabase — authentication, database, audit log, notifications, access requests. Data hosted in an EU region.
• Vercel — hosting and delivery of the application (US provider). For data generated by the service, such as logs, the IP address and the location derived from the address, which Vercel also uses to operate and improve its own services, Vercel acts as an independent controller, in accordance with its own privacy notice (vercel.com/legal/privacy-notice).
• OpenAI — receives the text of the questions (and the retrieved passages) to generate the assistant’s embeddings and answers and, for quality review, samples of recorded questions and answers, without the user’s email or identifier (contracting entity for EEA customers: OpenAI Ireland Ltd; processing on US infrastructure).
• Aruba (EU provider) — the Portal’s mailboxes and sending of transactional emails (invitations, password resets, notices).
• Microsoft — storage of the register of reports and complaints (Unleaf’s OneDrive, restricted access).
• Anthropic — provides the artificial intelligence tool we use to read and sort the emails sent to the Portal’s addresses, including reports and complaints, and with which we administer and develop the Portal; in this case it receives the results of checks on the database, which as a rule we limit to counts and confirmations, without extracting users’ data, under its commercial terms, which include a data processing agreement (contracting entity for EEA customers: Anthropic Ireland, Limited). Anthropic does not use this data to train its models; every reply and every decision remains with a person.

Data are not passed on to third parties for marketing purposes, nor disseminated. Supabase, Vercel, OpenAI, Aruba, Microsoft and Anthropic process the data as processors (Article 28 GDPR). The data are also processed by the persons authorised by the Controller (staff and collaborators), who act on its instructions.

8. Transfers outside the EU

• OpenAI: the contracting entity for EEA customers is OpenAI Ireland Ltd; onward transfers to the United States take place on the basis of standard contractual clauses (SCCs) approved by the European Commission, referred to in the relevant Data Processing Addendum.
• Vercel (USA): certified under the EU-U.S. Data Privacy Framework (including the UK Extension) and the Swiss-U.S. DPF; its DPA also incorporates the SCCs.
• Supabase: the Portal’s data reside in an EU region; the DPA covers with SCCs the transfers of account and support data to the contracting entity in Singapore.
• Anthropic: the contracting entity for EEA customers is Anthropic Ireland, Limited; Anthropic may also process the data outside the European Economic Area, including in the United States, and for these transfers its data processing agreement refers to the standard contractual clauses (SCCs) approved by the European Commission.

You can obtain a copy of the safeguards adopted for the transfers (SCCs and the related DPAs) by writing to privacy@unleaf.it.

9. Security measures (summary)

Access upon approval with roles (RBAC); passwords protected against known compromised credentials; TOTP MFA available; data isolation at database level (Row Level Security: each user can access only their own data); encryption of traffic (HTTPS/TLS); traceability of interactions with the assistant; automatic abuse limitation (monthly usage limit and temporary blocking of the IP addresses of automated scanners).

10. Retention period

11. Data subject rights

You may at any time exercise the rights under Articles 15 to 22 GDPR (access, rectification, erasure, restriction, portability, objection) by writing to privacy@unleaf.it. We reply without undue delay and in any case within one month of the request; that period may be extended by two further months where necessary, taking into account the complexity and number of the requests, in which case we will inform you of the reasons within the first month. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

Right to object. For processing based on the Controller’s legitimate interest (Article 6(1)(f): security and audit log, quality review, source limit counters, technical logs, blocking of scanners, handling of reports, third-party data in the content, proof of acceptance of the Terms, register of rights requests) you may object at any time, on grounds relating to your particular situation, by writing to privacy@unleaf.it (Article 21 GDPR). The Controller will stop the processing unless it demonstrates compelling legitimate grounds that override your interests, or the processing is needed for the establishment, exercise or defence of legal claims.