Privacy Policy

1. Data Controller

The data controller is:

2. Types of Personal Data Collected

The controller collects, directly or through third parties, the following categories of personal data:

2.1 Data Provided Voluntarily by the User

• Identification data: name, surname
• Contact data: email address, phone number
• Professional data: company/organization affiliation, job title
• Content of communications sent via the contact form

2.2 Automatically Collected Data

• Navigation data: IP address, browser type and version, operating system, screen resolution
• Usage data: pages visited, visit duration, referral page, navigation path
• Technical data: date and time of access, device identifier
• Cookies and similar technologies (see Cookie Policy)

2.3 Data Relating to Our Products

For specific Arcano Zero products (Plant Management AI, QuarterTales, OralAI, Health360, Once Upon A Time, LexClaw, StartApp), additional data necessary for service delivery may be collected. In such cases, users will receive dedicated and specific notices before service activation.

Important Note for OralAI: OralAI is classified as a DSS (Diagnostic Support System). The processing of any health-related data (special categories of data pursuant to Article 9 GDPR) will be conducted exclusively with prior explicit and informed consent of the data subject, in compliance with applicable regulations (MDR 2017/745).

3. Purposes and Legal Basis for Processing

Purpose	Legal Basis (GDPR)
Website navigation and technical operation	Legitimate Interest (Art. 6.1.f)
Response to contact requests and inquiries	Performance of Pre-contractual Measures (Art. 6.1.b)
Provision of requested services and products	Contract Performance (Art. 6.1.b)
Compliance with tax, accounting, and legal obligations	Legal Obligation (Art. 6.1.c)
Sending commercial communications and newsletters	Consent (Art. 6.1.a)
Aggregate statistical analysis of site usage	Consent (Art. 6.1.a) / Legitimate Interest (Art. 6.1.f)
Processing health data (OralAI)	Explicit Consent (Art. 9.2.a)
Fraud prevention and cybersecurity	Legitimate Interest (Art. 6.1.f)

4. Nature of Data Provision

Provision of navigation data is necessary for the website to function. Provision of data through the contact form is optional, but failure to provide it may make it impossible to respond to the user's request. Provision of data for marketing purposes is always optional and refusal does not result in any consequences for the use of the website or services.

5. Data Recipients

Personal data may be communicated to:

• Authorized Personnel of Arcano Zero - AI Lab Srl, in the capacity of data processors
• Service Providers acting as Data Processors pursuant to Article 28 GDPR (hosting, technical maintenance, email services), bound by specific Data Processing Agreements (DPA)
• Competent Authorities, where required by applicable law or by orders from authorities

Data will not be disclosed to unspecified third parties nor sold to third parties.

6. International Data Transfers

Personal data is processed primarily at the controller's offices and at service provider servers located in Italy and the European Union. Should data transfer to third countries become necessary, this will occur in compliance with GDPR safeguards (Chapter V), through:

• European Commission Adequacy Decisions (Art. 45 GDPR)
• Standard Contractual Clauses (SCC) approved by the European Commission (Art. 46.2.c GDPR)
• Other appropriate safeguards provided by Articles 46-49 GDPR

7. Data Retention Period

Data Type	Retention Period
Navigation data and technical logs	Maximum 24 months from collection
Contact form data	12 months from request, unless commercial relationship established
Contract and tax data	10 years from relationship termination (tax obligations pursuant to Art. 2220 of Italian Civil Code)
Marketing data (with consent)	Until consent revocation, maximum 24 months from last interaction
Cookies	See Cookie Policy

Upon expiration of the periods indicated above, data will be deleted or irreversibly anonymized.

8. Data Subject Rights

Pursuant to Articles 15-22 of GDPR, the data subject has the right to:

• Access (Art. 15): obtain confirmation of the existence of processing and access to personal data
• Rectification (Art. 16): obtain correction of inaccurate data or completion of incomplete data
• Erasure (Art. 17): obtain deletion of personal data ("right to be forgotten"), in applicable cases
• Restriction (Art. 18): obtain restriction of processing in certain circumstances
• Portability (Art. 20): receive personal data in a structured, commonly used, and machine-readable format, and transmit it to another controller
• Objection (Art. 21): object at any time to processing for direct marketing purposes
• Consent Withdrawal (Art. 7): withdraw consent at any time, without affecting the lawfulness of processing based on consent prior to withdrawal

To exercise these rights, the data subject may send a written request to:

The controller undertakes to respond within 30 days of receiving the request, as provided by Article 12 GDPR.

9. Right to Lodge a Complaint

Any data subject who believes that the processing of personal data violates GDPR has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali):

10. Cookies

This website uses cookies and similar technologies. For detailed information on types, purposes, duration, and cookie management methods, please refer to the dedicated Cookie Policy, which is an integral part of this notice.

11. Security Measures

The controller adopts technical and organizational measures appropriate to guarantee an adequate level of security relative to risk, pursuant to Article 32 GDPR, including:

• Encryption of communications using HTTPS protocol (SSL/TLS)
• Access control based on the principle of least privilege
• Backup and disaster recovery procedures
• Personnel training on data protection
• Periodic evaluation of the effectiveness of measures adopted

12. Modifications to This Notice

The controller reserves the right to modify this notice at any time, publishing it on this page. In case of substantial modifications, the controller will provide users with adequate notice. It is recommended to check this page periodically to verify any updates.

Last Update: April 2026
Version: 1.0