Privacy Policy

1. Data controller

AIBender is a project developed by Goutte d’eau S.r.l., the controller of personal data, reachable at the email address admin@gouttedeau.it. For any request concerning your personal data you can contact us at this address.

2. Data we collect

We collect only the data necessary for the service to function:

• Registration data: name, email address and, if you authenticate via Google OAuth, the public avatar of your Google account.
• Profile data: preferences (language, theme, default AI model), role within an organization, personal settings.
• Content you upload: documents uploaded to the knowledge base (PDFs, text), configured moods and instructions, messages exchanged with the AI.
• Usage data: tokens consumed, AI models used, associated costs, date and time of each interaction. Used for billing and aggregate analytics.
• Technical data: IP address, browser type, error logs. Retained for security reasons.

3. Google OAuth and Gmail/Calendar

If you choose to sign in with Google, we receive from your Google account only the strictly necessary information: unique identifier, email, name and profile picture. We do not access your Gmail messages, your calendar, your Drive files or other data in your Google account unless you have explicitly authorized a feature that requires it.

You can revoke your consent at any time from the Your permissions on Google.

4. Purposes of processing

• Provide the AIBender service (authentication, saving configurations, mood management, access to documents).
• Process the content you send to third-party AI models (Anthropic Claude, OpenAI GPT, Google Gemini) to return the responses you request.
• Calculate token consumption and the related costs, for billing and monitoring purposes.
• Improve the service, prevent abuse, ensure security.
• Comply with legal obligations (tax, accounting, security).

5. Legal basis

Processing is based on: (a) performance of the contract (Art. 6.1.b GDPR) for the provision of the service; (b) consent (Art. 6.1.a) for any optional features that explicitly require it; (c) legitimate interest (Art. 6.1.f) for the security of the service and the prevention of abuse; (d) legal obligation (Art. 6.1.c) for the retention of tax data.

6. Vendors and subprocessors

To provide the service we rely on third-party vendors that may process personal data on our behalf:

• Anthropic, OpenAI, Google (AI models) — they receive the text of the requests and the relevant documents to generate the responses. No identifying data is sent together with the content.
• Stripe (payments) — handles billing and payment data if you activate a subscription or purchase credits.

The technical infrastructure (hosting, database) is managed through vendors that do not access the content of your data except in anonymized and aggregated form for operational purposes. We do not sell or transfer your data to third parties for marketing purposes.

7. Retention

Personal data is retained for as long as strictly necessary: (a) for the entire duration of your account; (b) up to 30 days after account deletion for backups and any legal obligations; (c) 10 years for tax data, as required by Italian law. Technical logs are rotated every 90 days.

8. Your rights

At any time you can exercise the following rights (Art. 15-22 GDPR):

• Access to your personal data and request for a copy.
• Rectification of inaccurate data.
• Erasure (“right to be forgotten”) — directly from the account settings or by writing to us.
• Restriction of and objection to processing.
• Portability: export of your data in a readable format.
• Withdrawal of consent at any time.
• Lodging a complaint with the Italian Data Protection Authority.

To exercise these rights write to admin@gouttedeau.it. We respond within 30 days.

9. Security

Data is protected with encryption in transit (TLS 1.3) and at rest. Third-party API keys, if provided by the user (BYO-Key mode), are encrypted with AES before being stored. Access to the database is restricted and logged. We perform regular, segregated backups.

10. Minors

The service is not intended for minors under 16. We do not knowingly collect data from minors. If you discover that a minor has provided us with data, contact us: we will remove it.

11. Changes

This policy may be updated to reflect changes to the service or to the law. In the event of material changes we will notify you by email and via a banner on the site. The date at the top of the page always indicates the last update.

12. Contacts

For any question regarding this policy or your personal data, write to admin@gouttedeau.it.