Privacy Policy

Data controller

The data controller is Niccolò Scotellaro, sole proprietorship, VAT no. 02818680031. For any request regarding the processing of data: info@publiqoapp.com.

What data we collect

• Registration and account data: first name, last name, company, phone number, email address.
• Credentials: the password is stored exclusively in encrypted form (hash) and is never visible to the Provider or to third parties. If you enable two-factor authentication, we store the technical data needed (e.g. the authenticator app secret; codes sent by email are stored only as a temporary hash).
• Brand data and content: the information you enter about the brands you manage (name, description, tone of voice, website, social profiles, editorial notes), the media you upload (images, videos) and the generated content (editorial plans, texts, visuals).
• Usage and technical data: information relating to your use of the Service (e.g. number of plans generated, consumption metrics) and technical data needed for operation and security.
• Contact preferences: your optional consent to receive marketing communications.

We do not intentionally request or process special categories of data («sensitive» data). Please do not enter unnecessary data or special-category data in the content you upload.

Purposes and legal bases

• Providing the Service (account management, content generation, support): legal basis is the performance of the contract (art. 6.1.b GDPR).
• Security and abuse prevention (authentication, 2FA, technical logs): the Provider's legitimate interest in a secure Service (art. 6.1.f GDPR).
• Service communications (transactional emails such as welcome, verification, password reset): performance of the contract and legitimate interest.
• Marketing (only if you give consent): consent of the data subject (art. 6.1.a GDPR), revocable at any time.
• Legal obligations (e.g. accounting and tax obligations for paid plans): legal obligation (art. 6.1.c GDPR).

Processing through artificial intelligence

To generate content, the texts and materials you provide (brand information, texts, uploaded images) are transmitted to the artificial intelligence model providers listed below, solely to produce the requested output. Please do not enter unnecessary personal data in such content. According to the information provided by the providers, data sent through their APIs is not used to train the models; for details, please refer to their respective policies.

Providers and data processors

To provide the Service we rely on third-party providers that process data on our behalf, as data processors, on the basis of specific agreements:

• Railway — Hosting and infrastructure for the application.
• Supabase — Managed database (hosted in the European Union) where account and content data are stored.
• Anthropic (Claude) — Text generation through artificial intelligence.
• OpenAI — Text and image generation and automatic analysis of uploaded media.
• Resend — Sending of transactional emails (welcome, verification codes, password reset).

Transfers outside the EU

The database where account and content data is stored is hosted in the European Union. Some other providers — in particular the artificial intelligence models and the email sending service — may also process data outside the EU (e.g. in the United States). In that case, the transfer takes place on the basis of adequate safeguards provided for by the GDPR, such as the European Commission's Standard Contractual Clauses or, where applicable, adequacy decisions. You can ask us for more information about the safeguards adopted.

Retention periods

We retain account data and content for as long as necessary to provide the Service and while the account is active. When the account is closed, data and content are deleted within a reasonable time, unless a different legal obligation applies (e.g. retention of accounting documents). Data processed on the basis of consent (marketing) is retained until consent is withdrawn. Temporary verification and reset codes expire and are invalidated automatically.

Security

We adopt appropriate technical and organizational measures to protect the data: encrypted connections (HTTPS), passwords stored only as a hash, protected temporary tokens, optional two-factor authentication and separation of data between accounts. However, no system is 100% secure: we urge users to choose strong passwords and to safeguard their credentials.

Cookies

The Service uses exclusively technical cookies necessary for operation (e.g. to maintain the login session and security). We do not use profiling cookies or advertising tracking tools; for this reason no cookie consent banner is required. Should we introduce analytics or marketing tools in the future, we will update this policy and request consent where necessary.

Rights of the data subject

As a data subject you have the right, within the limits provided by the GDPR, to obtain: access to your data, rectification, erasure, restriction of processing, portability and objection to processing; you also have the right to withdraw at any time the consent given (without affecting the lawfulness of prior processing). To exercise these rights, write to info@publiqoapp.com. Finally, you have the right to lodge a complaint with the supervisory authority (in Italy, the Garante per la protezione dei dati personali — www.garanteprivacy.it).

Minors

The Service is aimed at professionals and companies and is not intended for minors under 18. We do not knowingly collect data from minors.

Changes to this policy

We may update this policy to align it with developments in the Service or in the law. Material changes will be communicated by appropriate means and the «last updated» date at the top will be updated accordingly.