Legal notes

Privacy Policy

Last updated: 8 August 2026

This notice explains how personal data is collected and used on fromzeroai.com and in the context of consulting and development services. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.

1. What data is collected

Data you provide

• Contact form: name, company (optional), email address, selected topic and message text.
• Virtual assistant (chat): the messages you write to the site's AI assistant and any contact details you choose to leave. Details in section 2.
• Email, phone and messaging: the personal data contained in the messages you send, including your contact details and signature.
• Professional relationship data: for clients and prospective clients, the information exchanged during meetings, proposals, contracts and invoicing (billing data, VAT number, addresses).

Data collected automatically

• Server logs: the hosting provider records IP address, date and time of the request, requested page, browser and operating system, for security and service continuity.
• Technical cookies: see section 8.

This website is not directed at minors and does not knowingly collect data from persons under 16.

2. The website's virtual assistant (artificial intelligence)

This website features an AI-based virtual assistant, which discloses its artificial nature when the chat is opened, as required by Art. 50 of Regulation (EU) 2024/1689 (AI Act). Using it is optional.

• Data processed: the content of the messages you write and, if you choose to provide them, your name and email address; the language and page you write from; a technical session identifier stored in your browser (localStorage) to keep the conversation continuous.
• Purpose and legal basis: answering your questions, following up if you request it and, if you choose, booking an appointment on real slots of our calendar — pre-contractual measures taken at your request, Art. 6(1)(b) GDPR.
• Where it is stored: conversations are recorded in From Zero AI's systems, on infrastructure located in the European Union (Germany), and are periodically reviewed by a person to improve the service.
• Providers involved: responses are generated through OpenAI (United States) acting as data processor; appointments are booked through Google Calendar. Conversation data is never used to train models, neither ours nor third parties'.
• Retention: up to 24 months, then deleted; if a professional relationship arises from the conversation, the terms of section 5 apply.

The assistant does not provide legal, tax or financial advice and takes no decisions with legal effects on you. You can ask to be contacted by a person at any time. More details in the AI Transparency Statement.

3. Why data is used and on which legal basis

Purpose	Legal basis
Responding to your enquiry and assessing a possible project	Pre-contractual measures at your request — Art. 6(1)(b) GDPR
Handling conversations with the virtual assistant, following up and booking appointments at your request	Pre-contractual measures at your request — Art. 6(1)(b) GDPR
Providing consulting, development and support services and invoicing them	Performance of a contract — Art. 6(1)(b) GDPR
Keeping accounting records, invoices and tax documentation	Legal obligation — Art. 6(1)(c) GDPR
Keeping the site available, secure and free from abuse (including the form's anti-spam filter)	Legitimate interest in service security — Art. 6(1)(f) GDPR
Establishing, exercising or defending legal claims	Legitimate interest — Art. 6(1)(f) GDPR

Providing your name, email and message is necessary to receive a reply: without them the form cannot be submitted. All other fields are optional.

4. No marketing without consent

Contact details submitted through this site are not added to newsletters or marketing lists. If a newsletter is introduced in the future, it will require separate, explicit consent, revocable at any time.

5. How long data is kept

• Enquiries that do not lead to a project: up to 24 months from the last exchange, then deleted.
• Conversations with the virtual assistant: up to 24 months from the last exchange, then deleted.
• Client and project documentation: for the duration of the relationship and up to 10 years afterwards, in line with Italian civil and tax law.
• Accounting and billing data: 10 years, as required by law.
• Server logs: kept by the hosting provider for a limited period for security purposes, normally no longer than 12 months.

6. Who else can see it

Data is never sold or traded. It may be shared with a limited number of providers acting as data processors under Art. 28 GDPR, or with authorities where the law requires it:

• Hosting and email provider (Aruba S.p.A., Italy) — website hosting and mail delivery.
• OpenAI, L.L.C. (United States) — generation of the virtual assistant's responses, as data processor.
• Contabo GmbH (Germany) — infrastructure on which the assistant's conversations are stored.
• Accounting and tax advisors — invoicing and legal compliance.
• Software and infrastructure providers used to deliver a project, where the client contract requires it. In client projects, the choice of providers and the location of data are agreed in writing before any processing begins.

The up-to-date list of processors is available on request by writing to info@fromzeroai.com.

7. Transfers outside the European Economic Area

The website and email are hosted in the European Union. Where a service used for a specific project involves a transfer outside the EEA, it takes place only on the basis of an adequacy decision or Standard Contractual Clauses adopted by the European Commission, with any supplementary measures required, and is agreed with the client in advance. The ordinary exception concerns the virtual assistant: responses are generated through OpenAI (United States), on the basis of the EU-U.S. Data Privacy Framework and, where necessary, Standard Contractual Clauses.

8. Cookies and measurement tools

This site uses technical cookies, strictly necessary to serve the pages and keep them secure, which require no consent.

It also uses Google Analytics 4 for aggregate statistics on pages visited, and Google Ads tags to measure advertising performance. These tools are activated only after your consent, collected through the banner shown on your first visit: until then they are blocked via Google's consent mode, and no measurement cookie is installed. If you choose «Necessary only», the site works in exactly the same way.

IP addresses are processed in anonymised form. The data collected is aggregated and serves to understand which content is useful and which channels enquiries come from: it is not used to identify you, nor combined with other sources. For these tools Google Ireland Ltd acts as a processor under Article 28 GDPR; some transfers to the United States take place on the basis of the EU-U.S. Data Privacy Framework.

You can change your mind at any time: clear the site data from your browser settings and the banner will reappear on your next visit.

Fonts are loaded from Google Fonts: your browser therefore sends a request to Google's servers, which includes your IP address. If you prefer to avoid this, the fonts can be self-hosted on request; page readability remains guaranteed either way.

The virtual assistant stores a random session identifier in the browser's localStorage, technical and necessary for conversation continuity: it is not a profiling tool and does not track your browsing.

You can block or delete cookies at any time from your browser settings.

9. Automated decision-making

No decision producing legal effects on you is taken solely on the basis of automated processing, and no profiling of website visitors is carried out. The website's virtual assistant provides information and, on request, books appointments: it takes no decisions with legal effects. AI systems built for clients include human review wherever decisions concern natural persons, and each system's configuration is defined in the relevant project contract.

10. Security

Appropriate technical and organisational measures are applied: encrypted connections (HTTPS), access control on devices and accounts, up-to-date software and confidentiality obligations in every client contract. No system is entirely free of risk, but data is handled with the care expected of a professional practice.

11. Your rights

Under Articles 15 to 22 GDPR you have the right to:

• obtain confirmation that your data is being processed and receive a copy of it;
• have inaccurate data rectified and incomplete data completed;
• obtain the deletion of your data, where the conditions apply;
• request the restriction of processing;
• receive your data in a structured, machine-readable format and have it transmitted to another controller;
• object to processing based on legitimate interest;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of prior processing.

To exercise these rights, write to info@fromzeroai.com. A reply arrives within one month, extendable by two further months for complex requests, with reasons for the delay communicated.

If you believe your data has been processed unlawfully, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.

12. Data processed on behalf of clients

When I build or operate artificial-intelligence systems for a client, the personal data contained in their systems is processed in the capacity of data processor, on the basis of their documented instructions and of an agreement signed under Art. 28 GDPR. In those cases the controller remains the client, to whom data subjects' requests should be addressed.

13. Changes to this notice

This notice may be updated as services, providers or legal obligations change. The applicable version is always the one published on this page, with the date shown at the top.