Privacy notice

1. Data controller

The controller of personal data is Cementum.ai S.r.l., with registered office at Via Alcide De Gasperi 19D, 84043 Agropoli (SA), Italy, VAT no. IT06413860658. For any request: privacy@cementum.ai.

2. Personal data collected

Registration data

• Email address
• Password, stored in encrypted form
• VAT number and billing details, at the time of payment

Platform usage data

• Content of questions and conversations with the platform
• Documents uploaded for analysis
• Technical access logs (IP address, browser, device)

Purchase and contract signature data

• Company name, VAT number, tax code, registered office, e-invoicing recipient code or certified email (PEC)
• First name, last name, role, email and mobile number of the signer; if buying on behalf of someone else, first name, last name, tax code and role of the person who authorized it
• Proof of the electronic signature, kept by the signature provider

Data sent through the site's forms

• Contact form: name, email, company (optional), reason and message
• Waiting list: email, profession, name and company (optional), consent to marketing communications (optional)

Cookies and measurement tools

Google Tag Manager, Google Analytics 4 and the Meta Pixel are activated only if you accept in the cookie banner. Details are in the cookie policy.

3. Purposes of processing

• Providing the platform and the Pocket Urbanist service
• Managing the account and authentication
• Responding to requests sent through the site's forms
• Improving the service and developing new features
• Complying with legal and tax obligations
• Sending service communications about the product
• Only with your consent: measuring use of the site and the effectiveness of advertising, and sending marketing communications

4. Legal basis

• Performance of the contract and of pre-contractual measures (Art. 6(1)(b) GDPR)
• Compliance with legal obligations (Art. 6(1)(c) GDPR)
• Consent of the data subject, for measurement cookies, the Meta Pixel and marketing communications (Art. 6(1)(a) GDPR)

[TO BE UPDATED WITH THE LAWYER: legal basis and retention of data from the contact and waiting-list forms]

5. Service providers

• Artificial intelligence service providers: the content of conversations is processed through third-party services with servers in the European Union and/or the United States, bound by data protection agreements.
• Platform hosting: servers in the European Union.
• Site hosting and form handling: Amazon Web Services (AWS).
• Measurement and advertising, only with consent: Google (Tag Manager and Analytics) and Meta (Pixel).
• Payments: PCI-DSS certified processors.
• Anti-abuse check on the purchase, contact and waiting list forms: Cloudflare Turnstile, which verifies the browser before sending. [TO BE UPDATED WITH THE LAWYER: Turnstile: Cloudflare's role, data processed and retention]
• Platform and uploaded documents: Amazon Web Services (AWS), with servers in Italy and the European Union. Documents are read and classified with AWS Bedrock artificial intelligence models, in the European region, also so that the project chat can consult them; scans may be converted into text (OCR).
• Subscription payments and billing: Stripe Payments Europe Ltd (Ireland), which keeps the card details; Cementum never sees them. It receives the customer's company name, VAT number, registered office, email and mobile number.
• Electronic signature of the contract: Yousign SAS (France), which sends the signing codes by email and text message and keeps the proof of signature (identity, email, mobile number, IP address, date and time). [TO BE UPDATED WITH THE LAWYER: role of Stripe and Yousign, retention period of the proof of signature]

[TO BE UPDATED WITH THE LAWYER: transfers outside the European Union and the related safeguards]

6. How we use artificial intelligence

Cementum uses artificial intelligence models to read, cross-check and cite regulatory and cartographic sources. The model does not make decisions on the user's behalf: every result links to its source, whatever could not be confirmed is stated, and the decision stays with the person.

Details are on the How we use artificial intelligence page. [TO BE UPDATED WITH THE LAWYER: use of data to train models]

7. Data retention

• Account data: for the duration of the relationship and thereafter as required by law.
• Conversation history: the user can delete it at any time; deletion is permanent.
• Billing data: ten years, as required by tax law.

8. Rights of the data subject

Under Articles 15 to 22 of the GDPR you can access your data, request its rectification or erasure, restriction of processing and portability, object to processing and withdraw consent at any time, by writing to privacy@cementum.ai. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

9. Security measures

• Encryption of data in transit and at rest
• Role-based access controls
• Access monitoring and logging
• Regular backups and recovery procedures

10. Changes to this notice

Material changes will be communicated by email or through a notice on the platform.

11. Contact

Cementum.ai S.r.l., Via Alcide De Gasperi 19D, 84043 Agropoli (SA), Italy, VAT no. IT06413860658. Email: privacy@cementum.ai.