How we handle personal data
Under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Versione italiana.
1. Data controller
Giovanni Caselli, Yaveno, atelier for Italian hospitality. Contact: [email protected].
2. Data we process
- "Request a brief" form: your name, the name of your business, your email and the answers you pick in the guided steps (kind of place, guests, current site, what isn't working, timing), plus any notes you add. When you press "Send" the data comes straight to us: the site posts it to its own server, which delivers it by email to [email protected] with your address set as the reply-to. While you fill it in, your answers stay in the page and are not stored on your device: reload and you start over. If delivery fails, the page offers a link that opens your email app with the message ready: in that case the data reaches us only if you send it.
- Site analysis request: your name, business name, current website address and email. Same path as the brief: it comes straight to us, into the same mailbox, with the same fallback if delivery fails.
- Request register: every brief and every analysis request is also written to a database of ours, together with the page it came from and the moment it arrived. It serves two purposes and no other: not losing a request if the email fails, and knowing which page generated it. Your IP address never enters the register, in any form.
- AI assistant ("Concierge" chat): the text you type. Contact identifiers (email, phone, tax or VAT numbers, IBAN) are blocked automatically before being sent to the assistant: use the brief for contact details.
- Technical data: minimal logs (timestamp, model, token count) for operation and security; any personal data in logs is redacted. To curb automated submissions we keep a cryptographic fingerprint of your IP address (not the address itself) for about an hour, after which it expires on its own.
3. Purposes and legal basis
- Answering your request and handling the pre-contractual stage (Art. 6.1.b GDPR).
- Running the AI assistant (legitimate interest, Art. 6.1.f GDPR).
4. Recipients and processors
- Cloudflare, Inc.: site hosting and delivery (Cloudflare Pages), under a data processing agreement.
- Mistral AI SAS (Paris, France): provides the AI model behind the assistant. Data is processed within the European Union, is not used to train models, and is kept at most 30 days for abuse monitoring only, then deleted (DPA with EU contractual clauses).
- Fastmail Pty Ltd (Melbourne, Australia): runs the email for yaveno.com. It delivers your brief and stores it in our mailbox, like any other email you write to us.
- Supabase, Inc.: hosts the database holding the request register. The instance we use is in its European region (Ireland): register data is stored there.
5. Transfers outside the European Union
Messages sent to the AI assistant are processed in the EU (Mistral AI, France): for the chat there is no transfer outside the EU. Cloudflare hosting may involve transfers to the United States, covered by Standard Contractual Clauses and/or the Data Privacy Framework. Email is run by Fastmail, an Australian company that may process data in the United States, the United Kingdom, Australia, India and Austria: those transfers too are covered by the Standard Contractual Clauses in its data processing agreement. The request register sits in Supabase's European region (Ireland); any US access for technical support is covered by the Standard Contractual Clauses of its data processing agreement. Measures we take: data minimisation (contact identifiers blocked before anything reaches the assistant), a requested retention cap of 30 days and no training on the data.
6. Retention
Your brief sits in our mailbox like any other message, for as long as it takes to handle your request and to meet legal obligations; if nothing comes of it, we delete it. The row in the request register follows the same fate: it is deleted together with the message. You can ask us to delete it at any time (point 9). Text sent to the AI assistant is kept at most 30 days by the provider (Mistral), then deleted; Yaveno keeps nothing beyond technical logs (with personal data redacted).
7. Cookies and local storage
This site uses no profiling cookies and no third-party tracking or analytics: as a result no cookie banner is required. It only uses technical browser storage: your light/dark theme preference (tm-theme in localStorage) and the ongoing assistant conversation (tm-assist in sessionStorage, cleared when you close the tab). These are technical values, they do not identify you, and they are not shared with anyone. You can remove them by clearing the site data in your browser settings.
8. AI assistant (EU Artificial Intelligence Act)
The assistant is an artificial intelligence system: we tell you so when the panel opens (Art. 50 AI Act). Answers are generated automatically, may contain inaccuracies and do not replace direct contact. To talk to a person: [email protected]. The site is not intended for children under 14.
9. Your rights
You can request access, rectification, erasure, restriction, objection and portability by writing to [email protected]. You also have the right to lodge a complaint with the Italian Data Protection Authority.
Last updated: 15 August 2026. Requests are also recorded in a database of ours with the page of origin and the moment of arrival (points 2, 4, 5, 6); the businesses form is no longer a mailto.
← Back to the site