Privacy Policy

Data controller and contact

OSIAX S.R.L. is the data controller for the processing described here. The identification details supplied to date appear above. For questions or to exercise a data-protection right, write to the registered office at Viale Villa Gavotti, 81/2, 16155 Genova (GE), Italia.

Data, purposes, and legal bases

We process only the data required for the interaction you choose. We do not sell personal data and we do not use client content to build advertising profiles.

• Site operation and security: IP address, request date and time, requested URL, browser and device information, response status, and security events. Purpose: deliver, secure, diagnose, and prevent abuse of the site. Legal basis: our legitimate interest in operating a secure service (art. 6(1)(f) GDPR).
• Language and interface preferences: the language cookie and local browser preferences described in the Cookie Policy. Purpose: remember choices and provide requested functionality. Legal basis: providing the service requested by the user and our legitimate interest in a usable site (art. 6(1)(b) and (f)); no consent is required for strictly necessary storage.
• Calendly booking: name, email address, chosen time, time zone, and answers or notes entered in the booking form. Purpose: arrange and hold the requested call. Legal basis: steps taken at your request before a contract (art. 6(1)(b)). Calendly also processes technical and cookie data under its own notice.
• WhatsApp contact: phone number, profile name, message content, and message metadata. Purpose: reply to the enquiry. Legal basis: steps requested by you and our legitimate interest in handling enquiries (art. 6(1)(b) and (f)). Meta also acts as an independent controller for WhatsApp.
• Live voice demos: after you actively start a demo, microphone audio, its live transcript, session events, and a pseudonymous safety identifier derived from the connection IP are processed to provide the conversation and prevent abuse. Legal basis: providing the demo you requested and our legitimate interest in service security (art. 6(1)(b) and (f)). Do not provide real names, contact details, health data, or confidential information in a public demo.
• Architect workspace: client identity and access data, interview answers, uploaded documents, generated analysis, and technical activity required to recover the work session. Purpose: provide the commissioned assessment and protect client access. Legal basis: performance of a contract (art. 6(1)(b)) and our legitimate interest in security (art. 6(1)(f)).
• Campaign measurement: only after consent, campaign parameters, advertising click identifiers, source and device category, booking-button placement, and conversion events are processed by Google Ads, the OpenAI advertising pixel and the Meta Pixel; for a booking made on our own calendar, the email address is also sent to Meta in hashed form to match the booking to the ad. Purpose and legal basis: measure campaigns with your consent (art. 6(1)(a)). No advertising measurement SDK is loaded before consent.

TikTok connection and publishing

If you choose to connect TikTok, Osiax processes the TikTok account identifier (open ID), display name and avatar, the profile statistics and public-video information made available by TikTok, and OAuth access and refresh tokens needed to keep the connection working. When you choose a video in Video Studio, Osiax also processes that video, its caption, cover and publishing settings to carry out your instruction.

The connection is used to show your TikTok profile and available metrics and videos, and to send the video and settings you select to TikTok either as a Direct Post or as a draft in your TikTok inbox. A Direct Post is sent only after your explicit confirmation. The legal basis is providing the service you request (art. 6(1)(b) GDPR) and our legitimate interest in keeping the connection secure and handling revocation requests (art. 6(1)(f) GDPR). TikTok receives the data and media needed for the selected action and processes them under TikTok’s own privacy terms. Osiax does not control TikTok’s subsequent use of content on its platform.

You can disconnect TikTok from your OSIAX administration settings. Disconnecting removes the active credentials from the connection and requests revocation with TikTok. If TikTok has not yet confirmed revocation, a limited record may be retained to finish and verify that request; it is then deleted or kept only where needed for security or legal obligations. Other connection data is kept only while needed to provide the feature or meet a legal obligation.

Required and optional data

Browsing data is generated automatically when the site is requested. Fields marked as required by Calendly or a private client workspace are necessary to provide that service; without them we cannot schedule the call or deliver the workspace. WhatsApp, the TikTok connection, the public voice demos, optional booking notes, and advertising measurement are voluntary. Refusing advertising consent does not restrict the site or booking service.

Recipients and service providers

Access is limited to authorized Osiax personnel and providers that need the data to supply their service. Depending on the service and its contractual role, a provider acts as our processor or as an independent controller.

• Vercel Inc. — website delivery, hosting, and request logs.
• Amazon Web Services — application backend and database infrastructure.
• OpenAI — AI assessment generation and the optional live Realtime voice demos. API content is not used to train OpenAI models unless Osiax separately opts in.
• Calendly LLC — scheduling and the embedded booking page; Calendly manages its own cookie choices and controller activities under its notice.
• Google Ireland Limited — Google Ads campaign and booking-conversion measurement, only after consent.
• OpenAI — ChatGPT Ads campaign and booking-conversion measurement, only after consent.
• Meta Platforms Ireland Limited: Facebook and Instagram ads campaign and booking-conversion measurement (Meta Pixel and Conversions API), only after consent.
• Meta Platforms — WhatsApp, when you choose to open a conversation.
• TikTok — account authorization, profile and video information, and the content you choose to upload or publish through the TikTok connector.
• Hetzner Online GmbH — hosting for the OSIAX service that operates the TikTok connection broker.

International transfers

Some providers and their subprocessors may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, including the EU–US Data Privacy Framework for participating recipients, or on the European Commission’s Standard Contractual Clauses and appropriate supplementary safeguards. You may request information about the safeguard applicable to your data.

Retention

Enquiry correspondence is kept for up to 24 months after the last exchange. Osiax does not save public voice-demo recordings or transcripts; OpenAI may retain Realtime API abuse-monitoring data for up to 30 days under its API controls. Client workspace data is retained for the engagement and for the period set by the client agreement or needed to establish or defend a claim. Contracts, invoices, and accounting records are retained for 10 years where Italian law requires it. Security and access logs are retained for up to 12 months. Browser preferences remain for the periods listed in the Cookie Policy or until you clear them; consented attribution records expire after 30 days or are removed when consent is withdrawn.

Your rights

You may request access, correction, erasure, restriction, objection, and—where applicable—data portability. You may withdraw consent at any time, without affecting processing already carried out lawfully; use Cookie settings for advertising measurement. To exercise another right, write to the registered office at Viale Villa Gavotti, 81/2, 16155 Genova (GE), Italia. We normally respond within one month. You may also lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Automated decisions and security

The site does not make decisions based solely on automated processing that produce legal or similarly significant effects for visitors. AI-generated assessment material supports human and client decisions; it does not make them. We use TLS in transit, access controls, hashed client access keys, short-lived credentials for voice demos, rate limits, and restricted operator access. No internet service can guarantee absolute security.