Privacy Policy

1. Data Controller

The Data Controller of the personal data described in Part A is IKIweb Internet Media S.r.l., with registered office at Via Varzi 6, 21052 Busto Arsizio (VA), Italy — VAT IT02848390122 (hereinafter “IKIweb”, “the Company” or “we”).

For any request concerning the processing of personal data you can contact us at info@ikiweb.it.

2. Who this notice is for

IKIbrain is a platform that enables Customers to create AI-powered virtual assistants (chatbots) that answer on the basis of content provided by the Customer, and to publish them on their own websites, in their own applications or through standalone chats accessible via QR code or direct link.

IKIweb’s role changes depending on where and how the data is processed. For this reason this notice is divided into two parts:

Part C contains the common provisions.

3. Definitions

• Personal Data: any information relating to an identified or identifiable natural person.
• Data Controller: the party that determines the purposes and means of processing Personal Data. Depending on the processing, this role is held by the Company or by the Customer.
• Data Processor: the party that processes Personal Data on behalf of the Controller.
• Data Subject: the natural person to whom the Personal Data relates.
• Customer: the professional or business that uses the IKIbrain platform.
• Visitor: the person who interacts with an IKIbrain chatbot.
• DPA: the Data Processing Agreement governing the relationship between IKIweb and Customers pursuant to art. 28 GDPR.

Part A — Processing carried out by IKIweb as Data Controller

4. Data processed

4.1 Browsing the ikibrain.ai website

While you browse the website, some technical data is collected automatically:

• IP address
• Browser type and version
• Pages visited and time spent
• Date and time of access
• Diagnostic data

4.2 Cookies and similar tools

On the ikibrain.ai website we use:

• Technical (necessary) cookies: essential for the operation of the website and for storing the choices made in the cookie banner.
• Usage statistics: the Matomo analytics platform, on an installation managed by IKIweb, in cookieless mode and with IP address anonymisation, solely to produce aggregated statistics on website usage.
• Lead generation (marketing) cookies: only with consent given through the banner, the Leadinfo service to identify the companies visiting the website for B2B commercial purposes.

For detailed information on individual cookies and preference management, please refer to the Cookie Policy.

4.3 Contact and quote request forms

When you write to us through the forms on the website, we process the data you enter: name, email address, phone number, company, website, the plan you are interested in and the content of your message.

4.4 Chatbot on the ikibrain.ai website

When you use the chatbot on the ikibrain.ai website, for example to request information about the Service, we process:

• Text of the messages exchanged in the conversation
• Date, time and duration of the conversation
• IP address, processed for security and abuse-prevention purposes
• Information about the device and browser
• Any personal data voluntarily provided in the chat (for example name, email, phone number)

The chatbot does not use cookies: only a technical identifier stored in the browser is used to keep the conversation going.

Please do not enter special categories of personal data in conversations (art. 9 GDPR, for example health data).

4.5 Customers and contact persons

For the activation and use of the app.ikibrain.ai platform we process:

• Name, surname and email address of the contact person and of authorised users
• Company name and VAT ID
• Billing details
• Platform access and usage data

The content that the Customer uploads to the platform to configure their chatbots (Knowledge Base) and the conversations of Customers’ chatbots are processed on behalf of the Customer: see Part B.

4.6 Payments

Access to the Service normally takes place through direct payment by credit card, handled by the payment service provider Stripe. Card details are entered directly on Stripe’s platform, which processes them as an independent data controller in accordance with its own privacy policy. IKIweb receives from Stripe only the information needed to manage the subscription and billing (for example, the payment outcome).

Alternatively, the Service may be activated following direct contact and issuance of a dedicated quote, with payment by bank transfer based on the invoice issued by IKIweb.

We do not collect or store credit card numbers or payment credentials on our systems.

5. Purposes and legal bases

6. Provision of data and automated decision-making

The provision of the data marked as mandatory in the forms, at registration or required for billing is necessary to follow up on the request or to conclude and perform the contract. The provision of other data is optional.

The provision of personal data in conversations with the chatbot is optional: failure to provide it does not prevent the use of the chat, but may prevent us from contacting you back.

The processing described does not involve automated decision-making producing legal effects concerning data subjects or similarly significantly affecting them, within the meaning of art. 22 GDPR. The answers generated by the chatbot are purely informational in nature.

7. Data retention

• Account data: for the duration of the contractual relationship and for 90 days after its termination, to allow possible export or reactivation of the subscription.
• Billing data: for 10 years from the date of the operation, as required by Italian tax law.
• Requests through the website forms: for as long as necessary to handle the request and, if a contractual relationship follows, according to the periods set for account and billing data.
• Conversations with the chatbot on the ikibrain.ai website: for 180 days from the conversation, then automatically deleted. Any contact details provided in order to be contacted back are processed for as long as necessary to follow up on the request.
• Browsing and usage data: retained for as long as necessary for analytics and security purposes. Data that has been effectively anonymised may be retained for statistical purposes.
• Backup copies: retained for a maximum of 60 days and then automatically deleted.

8. Recipients and providers

Data may be disclosed to:

• authorised IKIweb personnel, within the scope of their duties;
• service providers acting on behalf of IKIweb as data processors, listed below;
• consultants and professionals for accounting and tax compliance;
• competent authorities, where required by law.

For the processing described in this Part A we use the following providers:

Stripe, which handles credit card payments, processes the data as an independent data controller (section 4.6).

Artificial intelligence providers: data processed through artificial intelligence providers is not used by these providers to train their models, in accordance with their respective commercial terms. Data may be retained by the providers for a limited period solely for anti-abuse monitoring, according to the applicable contractual terms.

9. Transfer of data outside the European Economic Area

Some providers are based in the United States or in other countries outside the European Economic Area (EEA). In such cases, data transfer takes place on the basis of:

• European Commission adequacy decisions (for example the EU-US Data Privacy Framework);
• standard contractual clauses approved by the European Commission;
• other appropriate safeguards provided for by art. 46 GDPR.

Information on the safeguards applied to each transfer, and a copy of them, can be requested by writing to info@ikiweb.it.

10. Data subject rights

Pursuant to Regulation (EU) 2016/679 (GDPR), the data subject has the right to:

• Access (art. 15): obtain confirmation of the existence of processing and access their Personal Data.
• Rectification (art. 16): obtain the correction of inaccurate data or completion of incomplete data.
• Erasure (art. 17): obtain the erasure of their data, in the cases provided for by law.
• Restriction (art. 18): obtain restriction of processing in certain cases.
• Portability (art. 20): receive their data in a structured, commonly used and machine-readable format.
• Objection (art. 21): object to processing based on legitimate interest, including processing for direct marketing purposes.
• Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing based on consent given before withdrawal.

To exercise these rights, please write to info@ikiweb.it. We will respond within one month of receiving the request; this period may be extended by two further months for particularly complex or numerous requests, in which case the data subject will be informed (art. 12 GDPR).

The data subject also has the right to lodge a complaint with the competent supervisory authority: the Italian Data Protection Authority (www.garanteprivacy.it).

11. Data security

IKIweb adopts technical and organisational measures appropriate to the risks of the processing, in accordance with Article 32 of the GDPR.

Part B — IKIbrain chatbots on Customers’ websites

12. Who the Data Controller is

If you use an IKIbrain chatbot on the website, in the application or in the standalone chat of a company other than IKIweb, the Data Controller of your data is that company (the Customer). The Customer decides for which purposes and in what way the data is processed, and provides you with the relevant privacy notice, which you can find on its website or in its application.

IKIweb provides the chatbot technology and processes the data solely on behalf of the Customer, as Data Processor, in accordance with the Customer’s instructions and the DPA.

13. Data processed on behalf of the Customer

On behalf of the Customer, IKIweb processes:

• the content of conversations with the chatbot, with date and time;
• the IP address and information about the device and browser;
• any personal data voluntarily provided in the chat;
• any personal data contained in the content uploaded by the Customer to configure the chatbot’s Knowledge Base.

The chatbot does not use cookies: only a technical identifier stored in the browser is used to keep the conversation going. No profiling or marketing tools are used.

IKIweb does not use this data for its own purposes or to train artificial intelligence models.

14. Retention, providers and security

The retention periods, the sub-processors used and the security measures applied to this data are set out in the DPA (Annexes A, B and C). Within those limits, conversation retention periods are set by the Customer.

15. How to exercise your rights

To exercise your GDPR rights over data processed through a Customer’s chatbot, please contact the Customer, as Data Controller. Any requests received by IKIweb are forwarded to the relevant Customer.

Part C — Common provisions

16. Links to third-party sites

The website and the platform may contain links to websites or services not operated by IKIweb. We have no control over the content, privacy policies or practices of such sites. We recommend reviewing the privacy notice of each site visited.

17. Minors

The IKIbrain platform is intended for professional users.

Any use of chatbots by minors on Customers’ websites or digital services is governed by the notices and terms provided by the respective Data Controllers.

18. Changes to the Privacy Policy

We reserve the right to update this Privacy Policy. Changes will be published on this page with an updated “Last updated” date.

For substantial changes, we will inform Customers via email or platform notification.

19. Contacts

• Data Controller: IKIweb Internet Media S.r.l. — VAT IT02848390122
• Registered office: Via Varzi 6, 21052 Busto Arsizio (VA), Italy
• Operating office: Vicolo della Assunta 5, Busto Arsizio (VA), Italy
• Email: info@ikiweb.it
• Web: ikiweb.it