Data controller: ETACARINAE S.R.L. · VAT IT02552640068 · Via Cavour 71, 15011 Acqui Terme (AL), Italy ·
Contact: privacy@assumiai.it · PEC: etacarinaesrl@pec.it
Last updated: 13 February 2026 · Product: Alba by AssumiAI (assumiai.it)
This policy explains what personal data ETACARINAE S.R.L. ("we", "Alba", "AssumiAI") collects when you use the
Alba SaaS platform and related communication channels, why we collect it, how we use it, who we share it with,
and the rights you have. This policy is designed to support obligations under the EU General Data Protection Regulation (GDPR, Reg. EU 2016/679),
the EU AI Act (Reg. EU 2024/1689 art. 50 – transparency of AI-generated content), the California Consumer
Privacy Act (CCPA), the Brazilian LGPD, and the Swiss LPD.
1. Data we collect
1.1 Account & billing data
Name, business name, VAT number, email, password (hashed with Argon2id).
Billing address, invoice details, payment history (Stripe tokenised — we do not store card numbers).
1.2 Conversation data (per tenant)
Messages, calls, transcripts, attachments processed through the channels you connect (WhatsApp, Voice,
SMS, Email, Telegram, Instagram, Messenger, Web Widget).
Metadata: timestamps, channel identifiers, IP hashes, phone numbers, email addresses of your end-customers.
Consent records (opt-in / opt-out per channel, timestamped) required for compliance with GDPR art. 6-7 and
TCPA / 10DLC (US SMS).
1.3 Technical & diagnostic data
Browser, IP address (stored as salted SHA-256 hash), device type, session cookies.
Error logs and audit trail for security (retention 90 days).
2. Why we process your data (legal bases)
Contract (art. 6(1)(b) GDPR) — to provide the Alba SaaS to you.
Legitimate interest (art. 6(1)(f)) — service security, fraud prevention, product improvement
(with balancing test performed).
Consent (art. 6(1)(a)) — marketing emails, non-essential cookies, transcription of voice
calls for model tuning (opt-in only).
3. AI processing & automated decision-making
Alba uses large language models (GPT family, hosted by OpenAI and by Google Gemini under our data-processing
agreements) to generate replies to inbound messages. In line with AI Act art. 50:
End-users interacting with Alba on your channels are informed that they are talking to an AI assistant.
You (the business owner) retain a human-in-the-loop approval mode; you can require explicit review of every
AI-generated reply.
We do not use your conversation content to train foundation models. Zero-Data-Retention
contracts are in place with OpenAI (via Emergent) and Google Gemini.
4. Sharing & sub-processors
We share data only with these sub-processors, each bound by GDPR art. 28 DPA:
Withdraw consent at any time without affecting the lawfulness of prior processing.
Lodge a complaint with the Italian Garante (www.gpdp.it) or your local DPA.
California residents: right to know, delete, correct, and opt-out of sale/share (we do not sell).
To exercise any right, email privacy@assumiai.it. We respond within 30 days.
7. Cookies
We use only essential cookies for authentication and, subject to your consent via the cookie banner (managed by
Iubenda), analytics cookies (PostHog, GA4). Full cookie table:
iubenda.com/privacy-policy/29034041/cookie-policy.
8. Security
TLS 1.3 in transit, AES-256 at rest, password hashing with Argon2id, tenant isolation enforced by
require_current_tenant dependency at every API endpoint, append-only decision ledger
(action_decision_events) for auditability, RBAC (Admin/Editor/Viewer), 2FA available.