Privacy Policy

This Privacy Policy describes how Fasoli Metalli S.r.l.s. (the "Company", "we") collects, uses and protects users' personal data (the "User", "you") in connection with use of the Prevify SaaS software (the "Service"). Processing complies with Regulation (EU) 2016/679 (GDPR) and with applicable data protection law.

1. Data Controller

The Data Controller of personal data is Fasoli Metalli S.r.l.s., registered office at Via della Pineta, 2/A — 00010 San Polo dei Cavalieri (RM), Italy, VAT no. IT16808321000. For any question about the processing of personal data, or to exercise the rights set out in Section 11, you may contact us at: fasolimetalli.srls@legalmail.it. No Data Protection Officer (DPO) has been appointed, as the conditions making one mandatory under Art. 37 GDPR do not apply given the nature and size of the Company.

2. Third-Party Data Entered by the User (GDPR Art. 28)

In using the Service, the User may enter into the platform personal data belonging to their own customers and suppliers (name, company name, email, telephone, address). In that context, theUser acts as Data Controller of that data, while Prevify acts solely as Data Processor (sub-processor) under Art. 28 GDPR, processing that data only in order to provide the Service requested.

The User is responsible for: (a) having a valid legal basis for entering third-party data into the platform; (b) giving their own customers and suppliers the processing information required by Arts. 13-14 GDPR; (c) obtaining, where necessary, the consent of the data subjects before entering their data. Prevify does not use the User's customer or supplier data for its own purposes, does not pass it to third parties, and deletes it in full when the account is deleted.

3. Data We Collect

A. Data you provide directly:

• Registration and account: email address, company name, VAT number or tax code (the latter in the case of sole traders, for whom it constitutes personal data referring to a natural person), registered address, trade, telephone number, and the company size and annual turnover declared.
• Use of the platform: quotes, customer and supplier records, materials, processes, company parameters, files attached in chat (images, PDFs, Excel/CSV spreadsheets, Word documents, DXF files, text).
• Settings: company logo, company legal details (VAT number, REA, IBAN, payment terms), PDF colour preferences, operational configuration.
• Communications: messages sent through the contact and support forms on the public site.
• Waitlists: email address of anyone signing up to be notified when a not-yet-available feature launches (e.g. the autonomous AI assistant), used solely for that notification.

B. Data collected automatically:

• Authentication: JWT (access) token, refresh token (httpOnly cookie), session identifier.
• Technical: IP address, browser user agent, access logs (handled by Vercel and Supabase).
• Cookies: necessary (auth session), functional (UI preferences), analytics and performance (only with prior consent — see Section 8).
• Web push: the subscription endpoint for the browser's push notification service, if the User grants permission.

C. Data generated by use of the Service:

• History of conversations with the AI Coach, chat sessions.
• Job outcomes (ACCEPTED/DECLINED), production costings, material waste calibrations — partially anonymised.
• MemoriaCliente and MemoriaAzienda: behavioural aggregates tied to the individual account (win rate, typical budget, customer preferences), used to tailor the AI's suggestions.
• MemoriaGlobale: aggregated, anonymised benchmarks shared across all accounts on the platform, containing no identifying information, used to improve the quality of the AI's suggestions.

4. Purposes and Legal Basis for Processing

5. Artificial Intelligence and Data Processing

Data entered into the AI Coach chat — including text, attached files and quote context data — is processed by Artificial Intelligence models supplied by Google LLC through the Gemini API (Google Cloud) for the sole purpose of generating contextual replies to the User.

Google does not use Prevify users' data to train its own AI models: processing is governed by the Google Cloud Data Processing Addendum (DPA), compliant with the GDPR and with the Standard Contractual Clauses (SCC).

Prevify does not use identifiable personal data to train AI models of its own. The aggregated benchmarks in MemoriaGlobale contain no identifying information and cannot be linked back to individual users or companies.

The AI Coach's suggestions are indicative in nature and always subject to the User's review and final decision, in accordance with Art. 22 GDPR (no automated decision-making with legal effects on the User).

Attachments uploaded in the chat undergo automatic security checks (prompt injection detection, filtering of irrelevant content) before AI processing, and are not retained permanently outside the context of the chat session.

For each account, Prevify processes and retains behavioural aggregates derived from use of the Service: quote win rate, typical budget per customer, historical margins by category, waste calibration by material, seasonality of jobs. This data — referred to internally as MemoriaCliente, MemoriaAzienda and MemoriaOutcome — serves solely to tailor and improve the AI Coach's suggestions for that account. Legal basis: Art. 6(1)(b) GDPR (performance of the contract). The User may request its deletion at any time through the account deletion feature (Settings → Account → Danger zone) or by writing to fasolimetalli.srls@legalmail.it.

6. Sub-processors

To provide the Service, Prevify relies on the following technology suppliers, appointed as sub-processors under Art. 28 GDPR. Data transfers outside the EU are safeguarded by Standard Contractual Clauses (SCC) under Art. 46(2)(c) GDPR.

Prevify does not sell, transfer or rent Users' personal data to third parties for those third parties' own purposes.

Stripe payments: payment details (card number, expiry, CVV) never pass through Prevify's servers. Stripe collects them directly through an isolated, PCI-DSS Level 1 certified iframe. Prevify receives only an anonymised payment token. Stripe's privacy policy can be read at stripe.com/privacy.

Prevify enters into a formal data processing agreement with each sub-processor under Art. 28(3) GDPR (a Data Processing Agreement — DPA), setting out the subject matter, duration, nature and purposes of the processing, the type of personal data processed, and the mutual obligations on security, confidentiality and breach handling. The DPAs are available on request by writing to fasolimetalli.srls@legalmail.it.

7. Data Retention

• Account and platform data: kept for the duration of the contractual relationship. On account deletion it is removed immediately, with no further retention period, save for data subject to the legal obligation set out below.
• Invoicing and tax data: 10 years under Art. 2220 of the Italian Civil Code. This legal obligation overrides the right to erasure and concerns accounting documents only, not platform usage data.
• Technical and access logs: 90 days.
• AI chat and attachments: deleted at the same time as the account.
• Subscription data and usage counters: deleted at the same time as the account.

Account deletion (right to erasure — GDPR Art. 17): the User may delete their account at any time from Settings → Account. The procedure immediately and irreversibly removes all business data (quotes, customers, suppliers, materials, configurations, chats, AI memories, subscription, usage counters and recorded cookie preferences) and revokes the authentication account. A full download of the data is offered before proceeding. No residual data remains, save the accounting documents subject to the ten-year obligation set out above, which remain held by the payment service provider and in the Controller's accounts.

Export before you delete: deletion is final and the data cannot be recovered afterwards. Before proceeding you can export quotes, price lists and catalogue to Excel from the platform (see also the right to portability in Section 11).

Cancelling the subscription: is not the same as deleting the account and involves no loss of data whatsoever. If you stop renewal, then when the period already paid for expires the account stays active and returns to the free plan: all data remains where it is. Features return to the free plan's limits, and the sections that show a shorter time window on that plan return in full the moment you move to a higher plan.

8. Cookies and Tracking Technologies

For detailed information about the cookies Prevify uses, please see the Cookie Policy. In summary:

• Necessary (always on): authentication session cookies, essential preferences. Required for the Service to work; no consent needed.
• Functional (consent): UI preferences, cookie banner choice.
• Analytics (consent): PostHog for platform usage analysis (sessions, funnels, retention). Active only with prior explicit consent.
• Performance (consent): not currently in use.

Consent to non-necessary cookies can be managed at any time using the cookie icon at the bottom left of the public site, or from the "Manage consent" panel in your account.

9. Web Push Notifications

If the User grants permission in their browser, Prevify sends push notifications for Service-related events (quotes about to expire, commercial follow-ups, financial alerts, weekly digests). The subscription token is stored in Supabase against the User's account. Consent may be withdrawn at any time from the browser settings or from the Account page within the platform.

10. Email Marketing and Communications

Prevify may send commercial communications — weekly digest, newsletter, product updates, offers — to the email addresses of Users who have given explicit consent at registration or afterwards. Consent may be withdrawn at any time using the unsubscribe link in every commercial email, or from account settings. Email is handled through Resend Inc. (sub-processor, see Section 6). Service emails (operational notifications, payment confirmations, critical alerts) are not affected by withdrawal of marketing consent, as they are necessary for performance of the contract.

Email integration (optional, coming soon): we plan to introduce the option for the User to authorise Prevify to access their own mailbox via OAuth 2.0 (Gmail, Outlook or another compatible provider) solely in order to send quotes and operational communications to their customers. When available: Prevify will not read, store or analyse the content of emails not generated by the platform, and consent will be revocable at any time from account settings. Legal basis: Art. 6(1)(a) GDPR (explicit consent). As of today the feature is not active and no email data is processed.

WhatsApp (optional, coming soon): we plan to introduce a notification channel via the WhatsApp Business API (Meta Platforms, Inc.) for operational communications (quote updates, commercial follow-ups, deadline alerts). When available, the channel will be switched on and off at any time from account settings. Legal basis: Art. 6(1)(a) GDPR (explicit consent). As of today the feature is not active and no telephone number is transmitted to Meta Platforms.

11. Your Rights as a Data Subject

Under Arts. 15-22 GDPR, the User has the right to:

• Access (Art. 15): obtain confirmation of processing and a copy of the personal data processed.
• Rectification (Art. 16): correct inaccurate or incomplete data (available directly from the Settings section of the platform).
• Erasure / right to be forgotten (Art. 17): request deletion of the data — which you can carry out yourself from Settings → Account → Danger zone.
• Restriction of processing (Art. 18): obtain restriction of processing in the circumstances set out in the legislation.
• Data portability (Art. 20): receive your data in a structured, machine-readable format — which you can do yourself from Settings → Account → “Download my data”, producing a single JSON file with quotes, customers, records and configurations. The export is always available, uses none of your plan allowance, and is also offered before account deletion.
• Objection (Art. 21): object to processing based on legitimate interest, or to direct marketing.
• Not to be subject to automated decision-making (Art. 22): the AI Coach's suggestions are always indicative and subject to human review before any concrete action.

To exercise these rights, write to fasolimetalli.srls@legalmail.it. A reply is guaranteed within 30 days of receipt of the request. If no reply is received, or you are dissatisfied, you have the right to lodge a complaint with the the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it).

12. Data Security

Prevify applies appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration or destruction:

• Data in transit: HTTPS with TLS 1.3 on all communications.
• Data at rest: AES-256 encryption managed by Supabase.
• Authentication: JWTs expiring after 1 hour and httpOnly refresh tokens with automatic renewal; two-factor authentication (2FA) via authenticator apps (Google Authenticator, Authy, etc.) coming soon.
• Multi-tenant isolation: Row Level Security (RLS) at Supabase database level — each account accesses only its own data, with no possibility of reading across tenants.
• Internal access: no member of the Prevify team accesses a User's data except at that User's specific written request for technical support purposes.
• Attached files: automatic security scanning (prompt injection detection, format validation, size limits) before AI processing.

13. Minors

The Service is intended exclusively for professionals and companies (B2B use). Prevify does not knowingly collect personal data from anyone under 18. Should we become aware of personal data belonging to a minor, we will delete it immediately and, where necessary, notify the competent authorities.

14. Notes for Users Outside the EU

California users (CCPA/CPRA): in accordance with the California Consumer Privacy Act, California residents have the right to know the categories of personal information collected, to request its deletion and to opt out of the "sale" of their information. Prevify does not sell personal data to third parties for those third parties' own purposes. To exercise these rights: fasolimetalli.srls@legalmail.it.

United Kingdom users (UK GDPR): processing complies with the UK GDPR (Data Protection Act 2018). Transfers of data from the EU to the United Kingdom are covered by a European Commission adequacy decision.

Other countries: the GDPR is the minimum standard Prevify applies globally, regardless of the User's jurisdiction.

15. Updates to this Privacy Policy

Prevify reserves the right to update this Privacy Policy at any time. Where changes are substantial and affect Users' rights, Users will be informed by email at the address linked to their account at least 14 days in advance before the changes take effect. The date of the last update is always shown at the top of this page. Continuing to use the Service after the changes have been notified constitutes acceptance of them.

16. Governing Law and Jurisdiction

This Privacy Policy is governed by Italian law and by Regulation (EU) 2016/679 (GDPR). For any dispute concerning the application of this Policy, and without prejudice to the jurisdiction of the Italian Data Protection Authority, the Court of Tivoli (RM), Italy has exclusive jurisdiction.

17. Contact and Record of Processing Activities

For any question about this Privacy Policy or about exercising the rights set out in Section 11, contact us at:

Fasoli Metalli S.r.l.s.
Via della Pineta, 2/A — 00010 San Polo dei Cavalieri (RM), Italy
Email: fasolimetalli.srls@legalmail.it

Under Art. 30 GDPR, Prevify maintains an up-to-date Record of Processing Activities , documenting for each activity: the purposes, the categories of data and data subjects, the sub-processors involved, the security measures applied and the retention periods. The Record is available on request to the Italian Data Protection Authority or, as relevant extracts, to data subjects who make a reasoned request by writing to fasolimetalli.srls@legalmail.it.

---

For commercial enquiries, contact us at info@prevify.ai.