Privacy Policy

1. Data Controller

The Data Controller is IKIweb Internet Media s.r.l., with registered office at Via Varzi 6, Busto Arsizio (VA), Italy — VAT IT02848390122 (hereinafter “the Company”, “we” or “our”).

For any request concerning the processing of personal data you can contact us at: info@ikiweb.it.

2. What the Service consists of

IKIbrain is a platform that enables Customers to create AI-powered virtual assistants (chatbots), trained on content provided by the Customer, and to make them available to their users through multiple channels. The IKIbrain Service comprises:

• the website ikibrain.ai;
• the application platform app.ikibrain.ai, through which the Customer configures and manages their assistants;
• the conversational widget embedded in this website;
• the conversational widget that can be embedded into Customers’ websites and applications;
• standalone chats accessible via QR code or direct link;
• any other related service provided by IKIbrain.

In this notice, any reference to the “Service” means, collectively, all the channels listed above.

3. Scope

This Privacy Policy applies to the processing of personal data carried out through the Service, across all the channels described in section 2.

IKIbrain is a service intended for professionals and businesses, who use it in the course of their professional or business activity. Contractual relationships with Customers are governed by the Terms of Service.

This notice describes which data we collect, for which purposes and on which legal bases we process it (see section 6). Data collected is used solely to provide, secure and improve the Service, and to comply with legal obligations. Where the widget or chat is embedded in a Customer’s website, the roles and responsibilities in the processing are described in section 10.

4. Definitions

• Personal Data: any information relating to an identified or identifiable natural person.
• Usage Data: data automatically collected during the use of the Service (e.g. IP address, pages visited, session duration).
• Cookies: small text files stored on the user’s device.
• Data Controller: the natural or legal person who determines the purposes and means of processing Personal Data (the Company).
• Data Processor: a natural or legal person who processes Personal Data on behalf of the Controller.
• Data Subject: the natural person to whom the Personal Data relates.
• Customer: the professional or business that uses the IKIbrain Service.
• Visitor: the end user who interacts with the IKIbrain chatbot, whether embedded in the Customer’s website or available on the ikibrain.ai website.

5. Data collected

5.1 Data provided by the Customer

During activation and use of the Service, we collect:

• Contact person’s name and surname
• Email address
• Company name and VAT ID
• Billing details
• Content uploaded for chatbot training (web pages, documents, FAQs, texts)

5.2 Usage data

We automatically collect technical data while you use the Service:

• IP address
• Browser type and version
• Pages visited and time spent
• Date and time of access
• Unique device identifiers
• Diagnostic data

5.3 Conversation data (chatbot)

When a Visitor interacts with the IKIbrain chatbot — through the widget embedded in the Customer’s site or the standalone chat accessible via QR code or direct link — we collect:

• Text of the messages exchanged in the conversation
• Date, time and duration of the conversation
• Visitor’s IP address (in anonymised form)
• Information about the Visitor’s device and browser
• Any personal data voluntarily provided by the Visitor in the chat (name, email, phone)

The same categories of data are collected when the user interacts with the chatbot available on the ikibrain.ai website, for example to request information about the Service. In this case the Data Controller is the Company and this notice applies in full.

Important note: the Customer using IKIbrain on their own website/app is responsible for informing their Visitors about the presence of the chatbot and the processing of data through their own privacy notice compliant with applicable regulations.

5.4 Cookies and tracking technologies

We use cookies and similar technologies for the operation of the Service, the storage of preferences and the analysis of usage.

Types of cookies used:

• Technical (necessary) cookies: essential for the operation of the Service, authentication and security.
• Preference cookies: store user settings and preferences.
• Usage statistics: on the ikibrain.ai website we use the Matomo analytics platform in cookieless mode and with anonymised IP addresses: the data collected is aggregated and does not allow visitors to be identified.
• Lead generation (marketing) cookies: on the ikibrain.ai website, only with consent given through the banner, we use the Leadinfo service to identify the companies visiting the website for B2B commercial purposes. For details, please see the Cookie Policy.

The conversational widget and the standalone chats do not use cookies: for the operation of the conversation (e.g. session persistence), only a technical identifier stored in the browser is used. No profiling or marketing tools are used.

For detailed information on individual cookies and preference management, please refer to the Cookie Policy. Disabling some cookies may impair the functioning of the Service.

6. Purposes and legal bases of processing

Personal Data is processed for the purposes listed below, each based on the corresponding legal basis (art. 6 GDPR):

7. Provision of data and automated decision-making

The provision of the Customer’s identification, contact and billing data is necessary for the conclusion and performance of the contract: failure to provide it makes it impossible to activate or deliver the Service.

The provision of personal data by Visitors in conversations with the chatbot is optional: failure to provide it does not prevent the use of the chat, but may limit the ability to receive personalised answers or to be contacted back.

The Service does not involve automated decision-making producing legal effects concerning data subjects or similarly significantly affecting them, within the meaning of art. 22 GDPR. The answers generated by the chatbot are purely informational in nature.

8. Data retention

Personal Data is retained only for as long as necessary to achieve the purposes for which it was collected:

• Account data: for the duration of the contractual relationship and for 60 days after account deletion, to allow possible export.
• Billing data: for 10 years from the date of the operation, as required by Italian tax law.
• Training content (knowledge base): for the duration of the subscription. Upon termination, content and related vector indexes are deleted within 60 days.
• Conversation data: for the retention period agreed with the Customer in the contract (60, 90 or 180 days on a rolling basis, or for the entire duration of the subscription), configured by the Company in the platform. Upon termination of the contract, conversations that have not yet expired remain available for export and are deleted within 60 days, like the other account data.
• Usage and analytics data: in aggregated and anonymised form, with no time limit.

9. Sharing and transfer of data

9.1 Recipients of data

Personal Data may be disclosed to:

• Authorised personnel of the Company, within the scope of their duties
• Third-party service providers acting on behalf of the Company, bound by data processing agreements (DPA), as processors or sub-processors depending on IKIweb’s role described in section 10
• Competent authorities, where required by law

9.2 Third-party providers processing data on our behalf

The Service relies on the following third-party providers to deliver its features. These providers process data on our behalf as data processors — or as sub-processors, where IKIweb in turn acts as Processor on behalf of the Customer (section 10.2):

The updated list of providers is available on request by contacting info@ikiweb.it.

AI providers data handling: content uploaded to the knowledge base and conversation data processed through the OpenAI and Mistral AI APIs is not used by these providers to train their artificial intelligence models, in accordance with their respective commercial API policies. Data may be retained by the providers for a limited period solely for anti-abuse monitoring, according to applicable contractual terms.

9.3 Transfer of data outside the EU

Some of our providers are based in the United States or in other countries outside the European Economic Area (EEA). In such cases, data transfer takes place on the basis of:

• European Commission adequacy decisions (e.g. EU-US Data Privacy Framework)
• Standard Contractual Clauses (SCC) approved by the European Commission
• Other appropriate safeguards provided for by the GDPR (art. 46)

10. Roles in data processing

10.1 IKIweb as Controller

For Customer data (activation, billing, use of the IKIbrain platform) and for conversation data from the chatbot available on the ikibrain.ai website, the Company acts as Data Controller.

10.2 IKIweb as Processor

For Visitor data interacting with the IKIbrain chatbot embedded in the Customer’s site, as well as for any third-party personal data contained in the materials uploaded by the Customer to the knowledge base, the Company acts as Data Processor on behalf of the Customer, who remains Data Controller.

The relationship between IKIweb (Processor) and the Customer (Controller) is governed by a Data Processing Agreement (DPA), available on request.

The Customer is responsible for:

• Informing their Visitors about the processing of data through the chatbot
• Collecting any necessary consents
• Updating their privacy notice to include reference to IKIweb as Data Processor

11. Data subject rights (GDPR)

Pursuant to Regulation (EU) 2016/679 (GDPR), the data subject has the right to:

• Access (art. 15): obtain confirmation of the existence of processing and access their Personal Data.
• Rectification (art. 16): obtain the correction of inaccurate data or completion of incomplete data.
• Erasure (art. 17): obtain the erasure of their data, in the cases provided for by law.
• Restriction (art. 18): obtain restriction of processing in certain cases.
• Portability (art. 20): receive their data in a structured, commonly used and machine-readable format.
• Objection (art. 21): object to processing for legitimate reasons, including processing for direct marketing purposes.
• Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing based on consent given before withdrawal.

To exercise their rights, the data subject can contact us at info@ikiweb.it. We will respond within one month of receiving the request; this period may be extended by two further months for particularly complex or numerous requests, in which case the data subject will be informed (art. 12 GDPR).

The data subject also has the right to lodge a complaint with the competent supervisory authority: the Italian Data Protection Authority (www.garanteprivacy.it).

12. Data security

We adopt technical and organisational measures appropriate to protect Personal Data from unauthorised access, loss, destruction or alteration, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Role-based access control
• Secure authentication, with the option to enable two-factor authentication (2FA)
• Protection against unauthorised access attempts (automatic account lockout after repeated failed login attempts)
• Regular and redundant backups
• Continuous infrastructure monitoring

No electronic transmission or storage system can guarantee absolute security. Nevertheless, we are committed to adopting industry best practices to protect our Customers’ data.

13. Payment data

Activation of the Service follows direct contact with the Customer and issuance of a dedicated quote.

Payments are normally made by bank transfer based on the invoice issued by the Company. The Customer’s bank details and billing data are used solely for accounting, tax and contractual management purposes.

Upon the Customer’s request, payment may be made through electronic payment instruments (e.g. PayPal) via a payment link. In that case, the transaction takes place directly on the payment service provider’s platform, which processes the data as an independent data controller in accordance with its own privacy policy.

We do not collect or store credit card numbers or payment credentials on our systems.

14. Links to third-party sites

The Service may contain links to websites or services not operated by us. We have no control over the content, privacy policies or practices of such sites. We recommend reviewing the privacy notice of each site visited.

15. Minors

The Service is intended for professionals and businesses and is not directed to minors under the age of 18. We do not knowingly collect Personal Data from minors. Should we become aware of having collected data from a minor, we will promptly delete it.

16. Changes to the Privacy Policy

We reserve the right to update this Privacy Policy from time to time. Changes will be published on this page with an updated “Last updated” date.

For substantial changes, we will inform Customers via email or platform notification.

We encourage you to review this page periodically to stay informed about how we process personal data.

17. Contacts

For any questions regarding this Privacy Policy or the processing of personal data:

• Data Controller: IKIweb Internet Media s.r.l. — VAT IT02848390122
• Registered office: Via Varzi 6, Busto Arsizio (VA), Italy
• Operating office: Vicolo della Assunta 5, Busto Arsizio (VA), Italy
• Email: info@ikiweb.it
• Web: ikiweb.it