Data controllers

AlmaStack is a brand, not a company. Joint controllers are Alessandro D'Antoni (VAT 02072120856) and Manfredi Mauro Marrone (VAT 07109120829), Palermo, Italy. For any request about your data write to info@almastack.it: we answer within 30 days.

Which data we process and why

We process only the data needed to answer your requests and to run the site. No data is sold or passed to third parties for marketing purposes.

Contact form. Name, email, company, phone (optional), service of interest, message, plus any parameters of the campaign you came from (utm, gclid). Purpose: answer the request and propose a consultation. Legal basis: pre-contractual measures taken at your request (art. 6.1.b GDPR).
Alma assistant (chat). The text of your messages, the documents you choose to upload, the page you write from, the language, a random session identifier and, if you provide them, name, email, company and phone. Purpose: answer questions, estimate time and cost of a process, book an appointment, get back to you if you ask. Legal basis: pre-contractual measures (art. 6.1.b) and, for keeping the conversation for service quality, legitimate interest (art. 6.1.f).
Booking a call. Name, email, phone, chosen date and time. Purpose: organise and remind the appointment. Legal basis: art. 6.1.b.
Handover to a person. If in the chat you ask to talk to a human, the conversation (messages and files) is forwarded to the founders via Telegram and their replies come back into the chat. Legal basis: art. 6.1.b.
Shareable report. If you ask Alma for a report, we generate a page with an unguessable link summarising the conversation and the estimate. The link stays active for the period stated in the report.
Browsing data. IP address, browser, pages visited, recorded in the server's technical logs for security and diagnostics. Legal basis: legitimate interest (art. 6.1.f). Statistics and measurement cookies are described in the Cookie Policy.

Documents uploaded in the chat

You can upload invoices, orders, emails or other documents to see how Alma reads them. The content is sent to the AI model to extract the data and show you the result. Do not upload documents containing third parties' data unless you are authorised to do so.

Documents used only for the extraction demo are not saved on our servers: they stay in memory for the time of processing. Files you send during a conversation with a human operator are instead kept on our server for 7 days, so that staff can read them, and then deleted automatically.

Artificial intelligence

Alma uses language models provided by OpenAI through its API. Conversation messages and uploaded documents are sent to OpenAI to generate the answers. Under OpenAI's API terms this data is not used to train models and is kept by OpenAI for at most 30 days for abuse monitoring. Alma takes no decisions with legal effects on you: its estimates are indicative and every commercial proposal goes through a person.

How long we keep data

Contact requests and bookings: 24 months from the last contact, unless a contract follows (then for the duration of the relationship and the legal terms).
Conversations with Alma: 12 months from the last message, then deleted automatically.
Files exchanged with an operator: 7 days.
Server technical logs: up to 12 months.
Cookie choices: 6 months, on your device.

Who we share data with

Data is processed by the joint controllers and by providers acting as processors (art. 28 GDPR) under contracts that bind their use to our instructions.

Brevo (Sendinblue SAS, France): contact storage and sending of notification and confirmation emails. Servers in the European Union.
OpenAI (OpenAI Ireland Ltd. / OpenAI LLC, USA): generation of Alma's answers and document reading. Transfer to the United States covered by the EU-US Data Privacy Framework certification and standard contractual clauses.
Telegram (Telegram FZ-LLC, United Arab Emirates): channel through which the founders receive and answer requests to talk to a person. Only the contents of the conversation concerned are transmitted. Transfer necessary to perform your request (art. 49.1.b GDPR).
Google (Google Ireland Ltd.): reCAPTCHA to protect the form and, only with your consent, Google Analytics 4 and Google Ads. Details in the Cookie Policy.
Microsoft (Microsoft Ireland Operations Ltd.): Clarity, only with your consent, for scroll and click maps and anonymous session recordings with text fields masked. Details in the Cookie Policy.
Meta (Meta Platforms Ireland Ltd.): Meta Pixel, only with your consent, to measure contact requests coming from Meta ads and build remarketing audiences. Transfer to the United States covered by the EU-US Data Privacy Framework certification. Details in the Cookie Policy.
Simple Analytics (Simple Analytics B.V., Netherlands): aggregated statistics without cookies and without personal data.
Hosting: the site, the API and the database run on dedicated servers located in the European Union, managed by us.

Data is never published. It may be disclosed to public authorities only where the law requires it.

Transfers outside the European Union

Some providers (OpenAI, Google) process data in the United States under the EU-US Data Privacy Framework and the standard contractual clauses approved by the European Commission. Handing a conversation to an operator via Telegram involves a transfer to the United Arab Emirates, limited to the messages of that conversation and necessary to perform your request. If you prefer to avoid it, write to us directly at info@almastack.it.

Security

Connections to the site and the API are encrypted (HTTPS). Access to data is limited to the two joint controllers. Report links are generated with unguessable random tokens. Uploaded files are deleted automatically at the stated expiry.

Your rights

At any time you can request access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest (articles 15-22 GDPR). You can also ask us to delete a conversation with Alma by telling us the email or the period in which it took place. Write to info@almastack.it. If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Minors

The site and services are aimed at companies and professionals. We do not knowingly collect data of children under 16.

Changes

This notice may change when services or providers change. The update date at the top indicates the version in force; substantial changes are announced on the site.

Legal notice

AlmaStack is a brand, not a company: behind it operate the founders Alessandro D'Antoni (VAT no. IT02072120856) and Manfredi Mauro Marrone (VAT no. IT07109120829), independently.

Privacy Policy