Data Controller

The data controller is Andrea Lorini (Ai-Audit.it), VAT no. IT10678020966, based at Via Cherubini 6, 20145 Milan, Italy. For any request regarding this policy or your data, you can write to info@ai-audit.it.

What data we process and why

Contact form. When you write to us through the form we process your name, email, company (optional) and the message content, solely to reply to your request. The legal basis is pre-contractual measures and our legitimate interest in replying. Emails are delivered through our provider Resend.

Sofia voice agent. Sofia is an AI-based assistant (not a human). If you start a conversation with Sofia, your voice (microphone audio) is processed in real time by our provider Retell AI to power the assistant. We ask for your consent before activating the microphone; the legal basis is consent. We do not record or retain the audio for any further purpose.

Technical browsing data. Like any website, our hosting systems record technical data (e.g. IP address, browser type, date and time) in server logs, for security and correct operation. The legal basis is legitimate interest.

Traffic analytics (Google Analytics). Only if you give consent through the cookie banner, we use Google Analytics 4 to collect aggregate statistics about site usage (page views, source, device type). The legal basis is consent, which you can withdraw at any time from “Cookie preferences”. The IP address is anonymised and we do not use this data for advertising profiling.

Cookies. We use technical/functional cookies and, only with your consent, analytics cookies: see the Cookie Policy.

Academy: accounts, purchases and certificates

Student account. If you register with the Academy we process your name, email and (optional) company to create and manage your account; authentication is handled through Google Firebase Authentication. The legal basis is performance of the contract.

Purchases and invoicing. When you buy a course we process order and billing data: amount, course, personal/business and tax details (name/company, address, tax code, VAT number where applicable, SDI recipient code or certified email). Payment is handled by Stripe; the electronic invoice is issued through Fatture in Cloud (TeamSystem) and transmitted to the Italian Interchange System (SdI). The legal bases are performance of the contract and compliance with tax obligations.

Enrollments and progress. To deliver the courses we process enrollment and progress data (completed lessons, quiz scores), on the basis of performance of the contract.

Certificates. On passing the quizzes we issue a certificate bearing your name and a public verification code (verification page). Anyone with the code can check its validity; the certificate exposes no other data about you.

Providers and data processors

To provide the service we rely on providers that process data on our behalf:

• Resend — delivery of contact-form and purchase-confirmation emails.
• Cloudflare (Turnstile) — anti-abuse check on public forms (contact, discovery survey). It uses no cookies and does not profile: it analyses technical browser signals and the IP address to tell a person from an automated program.
• Retell AI — voice processing for the Sofia assistant.
• Google Firebase / Google Cloud — website hosting, database of site content and of the requests you send us (contact form, discovery survey), account authentication (europe-west1 region).
• Stripe — processing of course payments.
• Fatture in Cloud (TeamSystem) — issuing and transmitting the electronic invoice (SdI).
• Google Analytics (Google Ireland Ltd) — aggregate usage statistics, enabled only after consent.

Transfers outside the European Union

Some providers (Resend, Retell AI, Stripe and Google) may also process data in the United States. Where this happens, the transfer is based on appropriate safeguards under the GDPR, such as the European Commission’s Standard Contractual Clauses.

Data retention

We keep contact emails for as long as needed to handle your request and any follow-up. Technical logs are kept for a limited period for security purposes. Audio from conversations with Sofia is not retained beyond the session. Account and purchase data are kept for the duration of the relationship; billing data and invoices are kept for the period required by tax obligations (normally 10 years).

Your rights

Under the GDPR (Arts. 15-22) you have the right to access your data, request its rectification or erasure, restrict or object to processing, obtain data portability, and withdraw consent at any time. To exercise these rights, write to info@ai-audit.it.

Complaint to the supervisory authority

If you believe the processing of your data infringes the law, you have the right to lodge a complaint with the competent supervisory authority (in Italy, the Garante per la protezione dei dati personali).

Changes to this policy

We may update this policy to reflect changes to the site or the law. The last-updated date is shown below.

Contact

For any question about this policy, write to info@ai-audit.it.