Privacy Policy

1. Data Controller

The data controller is Ivan Cardillo, a natural person, reachable at ivan@quotx.ai. Use this address for any privacy request.

2. What data we collect

When you submit the contact form, we collect the personal data you provide:

• Full name
• Work email address
• Company name
• The content of your message
• The language in which you used the site, so we can reply in the same language

3. Data collected when you browse

When you visit the site, our hosting provider automatically processes technical data needed to deliver the pages (for example IP address, date and time, requested URL, and browser user-agent). This is ordinary server logging.

We also use Vercel Web Analytics and Vercel Speed Insights. These tools do not use cookies. They collect aggregated, privacy-oriented measurements such as page URL, referrer, approximate location (country/region), device type, operating system, and browser, plus Core Web Vitals. Visitors are distinguished with a hash derived from the request, which is discarded after 24 hours and is not used to identify you across days or other websites.

4. Purpose and legal basis

Contact form: we process your data solely to handle your demo request and to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR). Submitting the form is optional; the fields are required only if you want us to reply.

Hosting, security, and site operation: Art. 6(1)(f) GDPR (legitimate interest in delivering a working, secure website).

Audience measurement and performance (Vercel Web Analytics and Speed Insights): Art. 6(1)(f) GDPR (legitimate interest in understanding how the site is used and keeping it fast). You may object to this processing as described in section 9.

5. Processors and recipients

To operate this website and handle your request, we rely on the following processors, who act on our behalf under data processing agreements:

• Vercel Inc. — website hosting, logs, Web Analytics, and Speed Insights. Compute is configured in the EU (Frankfurt, fra1).
• Resend — transactional email delivery for the contact form, configured on EU infrastructure.
• Zoho Mail — business email hosting for the inbox that receives contact form submissions, configured on EU infrastructure.

6. Who reads contact requests

Messages from the contact form are delivered to the QuotX team inbox used to handle demo requests. They are read only by people who need them to reply to you.

7. Data location and transfers

We configure hosting, email delivery, and the business inbox to use European infrastructure where the providers allow it.

Vercel, Resend, and Zoho belong to groups established outside the EU/EEA (United States and, for Zoho, also India). Even with an EU region, limited extra-EU access or support can occur. Where personal data is transferred outside the EU/EEA, we rely on an adequacy decision where applicable (including the EU–US Data Privacy Framework for certified US organisations) and/or Standard Contractual Clauses, together with a data processing agreement.

8. Retention

Contact form messages: kept for 12 months from the last related contact, then deleted, unless a longer period is required to handle an ongoing discussion or a legal obligation.

Analytics visitor hash: discarded after 24 hours. Aggregated statistics that no longer identify a visitor may be kept longer.

Hosting logs: kept only as long as needed for security and troubleshooting, and in any case no longer than 30 days, unless a longer period is required to investigate an incident.

9. Your rights

You have the right to access, rectify, erase, restrict, or object to the processing of your personal data (including processing based on legitimate interest, such as analytics), as well as the right to data portability. To exercise these rights, contact ivan@quotx.ai. We do not take automated decisions that produce legal or similarly significant effects on you.

10. Complaints

If you believe your data is being processed unlawfully, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).