Privacy Policy

1. Data controller

The data controller is Oxequa S.r.l., with registered office at Via delle Tagliate di San Marco 525, 55100 Lucca (LU), Italy — VAT no. IT02488100468 (“Oxequa”, “we”, “us”). To exercise your rights or for any request concerning the processing of your data, you can write to info@prototipiamo.com.

2. What data we process

• Data you provide to us: when you use the assistant or contact us, we collect your name, email, phone number, company, the description of your project/needs, the content of the conversation and any files you attach (e.g., sketches, photos, technical documents).
• Data collected automatically: for technical and security reasons, we record your IP address, your browser/device type (user agent) and essential usage data. For information on cookies and similar technologies, see the Cookie Policy.

We do not request, nor do we intend to process, special categories of personal data (Art. 9 GDPR): please do not include any such data in the conversation or in attachments.

3. Purposes and legal bases

• Responding to your requests, providing you with information about the service, evaluating your project and contacting you about it. Legal basis: performance of pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) and/or consent (Art. 6(1)(a) GDPR) given by ticking the relevant box.
• Sending you commercial and marketing communications about Oxequa/Prototipiamo services (e.g., newsletters, updates). Legal basis: specific consent, which is optional and revocable (Art. 6(1)(a) GDPR). This consent is separate and is not required to receive a response.
• Measuring the effectiveness of our advertising campaigns (Google Ads). Only if you have accepted marketing cookies, when you submit a request we inform Google that the request took place, together with your email address in pseudonymized form (SHA-256 hash, not readable in plain text), which is used to attribute the request to the ad through which you reached us. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from the Cookie Policy.
• Security of the Site and prevention of abuse or misuse of the assistant. Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR).
• Compliance with legal obligations (e.g., accounting/tax obligations if a business relationship is established). Legal basis: legal obligation (Art. 6(1)(c) GDPR).

4. The conversational assistant (AI)

The assistant's responses are generated with the help of artificial intelligence models provided by third parties (Anthropic and OpenAI). The content you enter in the chat and your attachments are transmitted to these providers for the sole purpose of generating the response.

No automated decision-making. The assistant facilitates the conversation and records your request, but the evaluation of the request and any follow-up (quote, contact) are carried out by Oxequa staff. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

5. Who we share data with

Data is processed by Oxequa's authorized personnel and may be disclosed to service providers acting as data processors (Art. 28 GDPR), including:

• DigitalOcean — hosting and infrastructure (data center in Germany, EU);
• Brevo (Sendinblue SAS) — sending transactional emails and contact management (EU, France);
• Anthropic, PBC — AI model for the assistant (USA);
• OpenAI — AI model for the assistant, as a fallback (USA);
• Google Ireland Limited — advertising campaign measurement (Google Ads), only with your consent to marketing cookies (EU, with possible transfers to the USA).

Data is not disseminated, nor transferred to third parties for their own independent purposes.

6. Transfers to countries outside the EU

For the assistant to function, certain data (the content of the conversation and attachments) is transferred to the United States to the AI providers (Anthropic, OpenAI). If you have accepted marketing cookies, campaign measurement data processed by Google may also be transferred to the United States. Such transfers take place in compliance with Articles 44 et seq. GDPR, on the basis of appropriate safeguards — such as the Standard Contractual Clauses adopted by the European Commission and/or the providers' certification under the EU-U.S. Data Privacy Framework. You may request a copy of these safeguards by writing to info@prototipiamo.com. The other providers store data within the European Union.

7. How long we keep data

We retain data relating to your request and contacts for as long as necessary to handle it and, in any case, until you withdraw your consent or request erasure. Data processed for marketing purposes is retained until you withdraw your consent or object. Technical logs (IP address, user agent) are retained for a limited period, as necessary for security purposes. If a contractual relationship is established, the related data is retained for the periods required by law (e.g., tax obligations). We periodically review whether retention is still necessary and delete or anonymize data that is no longer needed.

8. Your rights

As a data subject, you may at any time exercise the rights provided for by Articles 15–22 GDPR: access to your data, rectification, erasure (“right to be forgotten”), restriction, objection, portability, as well as withdrawal of consent previously given (without affecting the lawfulness of processing carried out before withdrawal). To exercise these rights, write to info@prototipiamo.com. You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

9. Whether providing data is mandatory

Providing your data in order for us to respond to your request is optional, but if you do not provide it we will be unable to follow up on your request. Providing data for marketing purposes is entirely optional: you can use the service without giving this consent.

10. Minors

The service is intended for professionals, businesses and startups and is not directed at minors. We do not knowingly collect data from persons under the age of majority.

11. Changes to this notice

We may update this notice from time to time: the current version is always published on this page together with its last-updated date. We encourage you to review it periodically.