Privacy Policy

1. Data controller

Maiora AI Lab
Moretti Tony Junior
Ditta individuale
Via Papa Celestino V 68, Petacciato (CB), Italia
IT01944440708
Email: info@maioraailab.it
Website: www.maioraailab.it

2. Data collected

Through the booking form we collect the following personal data:

• First and last name
• Email address
• Phone number (optional)
• Goal and industry of interest (non-personal data)

Through the community testimonials form we may also collect:

• Name
• Role or professional industry
• Email address
• Instagram handle (optional)
• Testimonial content

Browsing data (collected automatically)

During your visit, the systems required to operate the website process technical data generated by the connection:

• IP address and technical logs processed by the hosting provider for security and operation
• User agent, browser language, referrer and device information
• Aggregated navigation events, without persistent personal identifiers, through Vercel Web Analytics
• Optional analytics events (pageviews, internal search, CTA interactions and conversions) collected by Google Analytics 4 only after explicit consent
• Core Web Vitals (anonymous performance metrics)

3. Cookies & local storage

Vercel Analytics and Speed Insights run in cookieless mode: they do not install cookies on your device.

Google Analytics 4 and its tags remain completely blocked until you give explicit consent. Before your choice, no request is sent to Google for analytics purposes.

After acceptance, Google Analytics may use first-party analytics cookies and receive navigation events. Your choice is stored in your browser's localStorage to remember the preference between visits.

You can update or revoke your consent at any time using the Analytics Preferences button in the footer. On revocation we stop optional tracking and attempt to remove the main analytics cookies from the browser.

For the gallery Like feature, we store a random identifier (UUID) in localStorage only when you use the button for the first time. This functional storage is requested by the user's action and is used to limit duplicate votes and remember likes between sessions.

You can delete this identifier at any time by clearing site data in your browser settings.

4. Third-party tools

• Vercel (Vercel Inc., USA): hosting, security logs, Web Analytics and Speed Insights. Web Analytics statistics are aggregated, cookieless and do not use persistent personal identifiers. Legal basis: legitimate interest in the security, operation and improvement of the service (Art. 6(1)(f) GDPR).
• Google Analytics 4 (Google Ireland Limited / Google LLC): the tag loads only after explicit consent and measures pageviews, internal searches, CTA clicks and conversion events. Legal basis: the data subject's consent (Art. 6(1)(a) GDPR).
• Convex (cloud infrastructure): stores booking form submissions, community reviews and gallery like counts. Region: eu-west-1 (Ireland).
• Resend (Resend, Inc., USA): sends email notifications generated by booking and review forms.
• Sanity (Sanity AS): manages and distributes editorial content and may process standard CDN request data.

5. Purposes of processing

Booking form data is processed to answer your request, contact you, evaluate the project and arrange a possible appointment.

For community testimonials, data is processed to verify the authenticity of the contribution, moderate it and, if approved, publish it on the site as a community editorial testimonial.

Form data is not used for newsletters or marketing without separate consent and is not sold.

6. Legal basis

Processing of booking form data is necessary to answer your request and take pre-contractual steps at your request (Art. 6(1)(b) GDPR). The checkbox confirms that you have read this notice and is not consent for additional purposes.

Processing of data sent through the review form is also based on the data subject's express consent (Art. 6(1)(a) GDPR).

Processing of data collected via Google Analytics 4 is based on the data subject's express consent (Art. 6(1)(a) GDPR) and can be revoked at any time using the Analytics Preferences button in the site footer.

For necessary technical data, security and Vercel's aggregated statistics, the legal basis is the controller's legitimate interest in operating, protecting and improving the service (Art. 6(1)(f) GDPR).

7. Nature of data provision

Fields marked as required are necessary to handle the request or review the testimonial. If they are not provided, the form cannot be submitted. Phone number and Instagram handle are optional.

8. Processing methods & retention

Data is processed electronically by authorized persons. Booking requests are retained for the time needed to manage the contact and, as a rule, for no longer than 12 months after the last interaction, unless required by law or a contractual relationship begins.

Rejected testimonials are deleted when no longer needed for moderation. Approved testimonials remain published until consent is withdrawn or erasure is requested; the verification email is not displayed publicly.

The Like identifier remains in the browser until site data is cleared. Associated records remain in the database while the function is active or until a technically identifiable erasure request is received.

9. Recipients and transfers outside the EEA

Data may be processed by the technical providers listed above, appointed as processors where required. Convex stores application data in the eu-west-1 region (Ireland); other providers may process technical data or email in the United States.

Transfers outside the European Economic Area rely on GDPR safeguards such as applicable adequacy decisions or Standard Contractual Clauses. Current safeguards are described in each provider's privacy notice and data processing agreement.

Data is not sold or disclosed to third parties for commercial purposes.

10. Data subject rights

Under Articles 15–22 of the GDPR, you have the right to:

• Access your personal data
• Obtain rectification or update of your data
• Request erasure ("right to be forgotten")
• Object to processing or request its restriction
• Receive data in a portable format
• Withdraw consent at any time

To exercise these rights, write to info@maioraailab.it.

11. Complaint to the supervisory authority

You have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) if you believe the processing of your data violates the GDPR.