Notice on the processing of personal data

"AmicoAI" service — Art. 13-14 EU Reg. 2016/679 (GDPR)

Last updated: 28 August 2026 Version: 1.6

This notice describes how Guides4you S.r.l. collects, uses and protects the personal data of users of the digital service "AmicoAI", in compliance with EU Regulation 2016/679 ("GDPR"), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the "Privacy Code"), and applicable sector regulations.

1. Data Controller

2. Data Protection Officer (DPO)

The Controller has not appointed a Data Protection Officer (DPO) under art. 37 GDPR, considering the mandatory conditions not to be met. For any question regarding the processing of personal data, the data subject may write to privacy@amicoai.it.

3. Useful definitions

• Main User: the natural person who registers for the Service through the Portal.
• Partner: the second person — if any — indicated by the Main User, who has given consent to the shared use of the Service.
• AI System: the third-party artificial intelligence service used to interpret messages and generate responses.
• WhatsApp Gateway: the technical infrastructure that connects the Service to the WhatsApp app.

4. Categories of personal data processed

4.1 Data collected during registration (Main User)

• first name, last name;
• city of residence;
• date of birth (optional);
• email address;
• mobile phone number;
• password (stored in hashed form with a modern cryptographic algorithm; the Controller is unable to decrypt it);
• IP address, browser and device type (for IT security purposes).

4.2 Partner data

• name (if provided by the Main User);
• mobile phone number;
• email address (if used to send the invitation link);
• confirmation of consent given.

4.3 Data arising from use of the Service

• content of WhatsApp messages exchanged with AmicoAI (text, any emoji, any attachments);
• activities recorded by the User in their own to-do list (titles, descriptions, deadlines, status);
• the User's lists (e.g. groceries, packing): list title and text of individual lines, with an indication of whether a line has been checked off. The text of the lines is encrypted in the database (AES-256-GCM); the list title is stored in plain text because it is needed to recognize the list when the User calls it up by name;
• the User's personal archive: photographs, documents (e.g. PDFs) and links that the User deliberately chooses to send to AmicoAI to store and retrieve them later, together with the name used to identify them. The content of the files is encrypted at rest (AES-256-GCM), with the key stored outside the database; the original name of the file sent is not stored; the name chosen by the User is stored in plain text because it is needed to recognize the item when the User calls it up by name. The archive is optional: it is activated only if the User spontaneously sends an attachment, and is limited to 10 items of 5 MB each. The User is invited to carefully consider which documents to store there: anyone with access to the User's device or WhatsApp account can request their return within the conversation, since no further authentication factor is provided. Every return is logged in the security logs (date, time and name of the item, never the content);
• the User's text notes: notes, codes, addresses or other information that the User deliberately chooses to dictate to AmicoAI so that they are stored under a name and retrieved later. The text is encrypted at rest (AES-256-GCM), with the key stored outside the database; the name chosen by the User is stored in plain text because it is needed to recognize the note when the User calls it up by name. Notes are optional: they are activated only if the User saves one, and are limited to 10 items of 4000 characters each. The same access-security considerations already indicated for the personal archive apply: anyone with access to the User's device or WhatsApp account can request their return within the conversation, since no further authentication factor is provided. Every return is logged in the security logs (date, time and name of the note, never the content);
• Google Calendar connection, if and only if the User voluntarily activates it from their personal area: access and refresh tokens issued by Google (stored encrypted, AES-256-GCM), the identifier of the chosen calendar and the identifiers of the created events. When the connection is active, the title and any notes of the User's reminders are transmitted to Google to create the corresponding calendar events, and events created by the User on Google may be read to generate the related reminders. The connection can be revoked at any time from the personal area or from the Google account settings;
• voice messages: if the User sends a voice message, it is automatically transcribed on the Controller's systems, using a speech-recognition model that runs entirely on the Service's server. The audio recording is not transmitted to any external provider and is not retained: it is deleted from disk immediately after transcription, whether successful or not. Only the transcribed text remains of the voice message, handled like any other message (see §9);
• technical interaction logs (date/time, latency, outcome of calls to the AI System);
• aggregate statistics (number of messages, frequency of use, etc.).

4.4 Payment data

Credit card or other payment instrument data is NOT processed nor stored by the Controller. Such data is collected and managed directly by the payment provider Stripe Payments Europe Ltd., acting as an independent data controller. Only the outcome of the transaction and the identifiers necessary for invoicing (e.g. name, surname, address, tax code or VAT number) are transmitted to the Controller.

4.5 Cookies and similar technologies

The Portal uses technical cookies, and — subject to consent — analytics and marketing cookies. For details, please refer to the Cookie Policy available at https://amicoai.it/cookie-policy.

5. Purposes and legal bases of processing

The provision of data indicated as "mandatory" is necessary to provide the Service: failure to provide it prevents use of the Service. Refusal to provide data indicated as "optional" has no consequence on the provision of the Service.

6. Transmission of messages to the AI System

For the Service to function, the content of messages exchanged by the User with AmicoAI is transmitted to the third-party AI System provider.

6.1 Providers currently used

The updated list of sub-processors is available on request at privacy@amicoai.it.

6.2 Safeguards applied

• AI System providers are appointed as data processors under art. 28 GDPR by means of a specific Data Processing Agreement.
• The Controller selects contractual plans that exclude the use of data for training AI models.
• Non-EU data transfers take place on the basis of Standard Contractual Clauses (SCC) approved by the European Commission under art. 46 GDPR, supplemented by additional technical measures (e.g. minimization of transmitted data).

6.3 What we do not transmit

AI System providers receive only the text of the messages necessary to generate the response. We do not transmit: passwords, payment data, unnecessary unique user identifiers, raw IP addresses. Conversation transcripts sent to providers are pseudonymized where technically possible.

7. Categories of data recipients

Personal data may be disclosed to the following parties, within the limits of their respective purposes:

The complete and up-to-date list of data processors is made available on written request at privacy@amicoai.it.

Personal data is never sold, transferred or made available to third parties for commercial purposes.

8. Transfers of data outside the EU

The Service uses providers established outside the European Economic Area. In particular:

• Meta Platforms, Inc. (transmission of WhatsApp messages and attachments) — based in the United States. Attachments sent by the User pass through and temporarily remain on Meta's systems in accordance with its policies. Meta adheres to the EU-U.S. Data Privacy Framework, subject to the European Commission's adequacy decision of 10 July 2023.
• Google LLC (Google Calendar synchronization, only if the User activates the connection) — based in the United States. Google adheres to the EU-U.S. Data Privacy Framework. The transfer concerns the title and any notes of the User's reminders and ceases upon revocation of the connection.
• Hangzhou DeepSeek AI Co., Ltd. (AI System provider) — based in China.
• Stripe Payments Europe Ltd. (payment management) — based in Ireland (EU) but with possible non-EU sub-processors.

Transfers to China: China does not benefit from an adequacy decision of the European Commission. The transfer takes place on the basis of Standard Contractual Clauses (SCC) under art. 46 GDPR, supplemented by a Transfer Impact Assessment specific to the Chinese regulatory framework, and by the following additional technical measures:

• prompt minimization (only the text necessary to generate the response is transmitted to the AI provider, without unique personal identifiers, email addresses or phone numbers);
• pseudonymization where technically possible;
• selection of contractual plans that exclude the use of data for training AI models.

Such transfers comply with arts. 44-49 GDPR, in particular through:

• failing other grounds, Standard Contractual Clauses (SCC) approved by the European Commission (Implementing Decision 2021/914/EU);
• a case-by-case assessment of the level of protection offered by the destination country (Transfer Impact Assessment) and adoption of additional technical measures (encryption in transit and at rest, pseudonymization, minimization).

The User has the right to obtain a copy of the above safeguards by writing to privacy@amicoai.it.

9. Data retention periods

Once these periods have elapsed, the data is deleted or irreversibly anonymized.

10. Rights of the data subject (arts. 15-22 GDPR)

The User — and the Partner — may exercise the following rights at any time:

• Access to their own personal data and related information (art. 15);
• Rectification of inaccurate or incomplete data (art. 16);
• Erasure of data ("right to be forgotten") within the limits provided by law (art. 17);
• Restriction of processing in certain circumstances (art. 18);
• Portability of data in a structured, readable format (art. 20);
• Objection to processing based on legitimate interest (art. 21), including direct marketing;
• Withdrawal of consent at any time, without affecting the lawfulness of processing based on consent given before the withdrawal (art. 7);
• The right not to be subject to automated decisions producing significant legal effects (art. 22). The Controller states that the Service does not carry out automated decision-making under art. 22.

10.1 How to exercise these rights

Requests should be sent by email to privacy@amicoai.it. The Controller will respond within one month of receipt, extendable by a further two months for complex requests, with prior notice given to the data subject.

Exercising these rights is free of charge, except in the case of manifestly unfounded or excessive requests (art. 12.5 GDPR).

10.2 Complaint to the supervisory authority

The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali):

• Address: Piazza Venezia 11, 00187 Rome, Italy
• Email: protocollo@gpdp.it — PEC: protocollo@pec.gpdp.it
• Website: https://www.garanteprivacy.it

11. Data security

The Controller adopts technical and organizational measures appropriate to ensure a level of security commensurate with the risk (art. 32 GDPR), including:

• encryption of data in transit (TLS 1.2+) and at rest; in particular the text of the User's list lines (e.g. groceries, packing), the content of personal archive files and the text of personal notes are encrypted with AES-256-GCM, with the key stored outside the database itself. Archive files are stored on disk exclusively in encrypted form, with random names that reveal nothing about their content;
• password hashing with modern cryptographic algorithms (bcrypt/argon2);
• separation of development and production environments;
• access logging and periodic reviews;
• need-to-know access control;
• a data breach notification procedure within 72 hours to the Authority (art. 33 GDPR) and, where applicable, to data subjects (art. 34 GDPR);
• periodic backups and a disaster recovery procedure.

While adopting every reasonable measure, the Controller cannot guarantee the absolute inviolability of its systems: the User is invited to carefully safeguard their credentials and to promptly report any anomaly.

12. Processing of minors' data

The Service is reserved for individuals who are at least 18 years old. The Controller does not knowingly collect data from minors under 18. Should it become aware of accidental processing of a minor's data, it will proceed to delete it.

A User who adds as a Partner a person under 18 years of age is in breach of these Terms.

13. Processing of Partner data — specific notice

The Partner receiving the invitation link will find, before giving consent, this notice highlighted with the following specifications:

• the data controller is Guides4you S.r.l.;
• the legal basis is the Partner's explicit consent (art. 6.1.a GDPR);
• consent can be withdrawn at any time by writing to privacy@amicoai.it or following the dedicated procedure on the Portal: withdrawal deactivates the Partner's account but not the tasks already shared in the Main User's to-do list;
• the data processed is limited to: name (if provided), phone number, confirmation of consent, content of the messages the Partner exchanges with AmicoAI;
• the same rights set out in art. 10 of this notice apply to the Partner.

14. Changes to this Notice

The Controller reserves the right to update this Notice at any time, showing the date of the last update at the top. In the event of substantial changes, the User will be notified by email.

15. Visual summary (for quick reference, does not replace the full text)

📌 What data do we ask for? Name, email, city, phone number. And your partner's number if you want to share your list.

📌 What do we do with your messages? We pass them to the AI provider only to understand you and reply. We don't sell them, we don't use them to train models, we delete them after 90 days.

📌 Do we keep data forever? No. You can delete your account whenever you want, and after a few days we wipe everything, except tax data the law requires us to keep for 10 years.

📌 What about reminders I mark as "done"? Deleted within 24 hours. For recurring ones, only the original reminder remains, not the fact that you marked one occurrence as done.

📌 What about lists (groceries, packing)? Those stay as long as you want: nobody deletes them for you. Lines are kept encrypted, and when you decide to empty or delete a list they disappear from our database instantly — not even we can recover them.

📌 Do you sell data to anyone? Never. To no one.

📌 Can I write to a human about anything? Yes: privacy@amicoai.it