How we handle personal data
Under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Italian version.
1. Data controller
Giovanni Caselli, Yaveno, websites and Care for independent businesses. Contact: [email protected].
2. Data we process
- Guided brief: selections and public business description stay in this page until you request an AI draft. The optional Mistral draft uses the selected needs and public description; do not enter personal details. Reloading clears the local brief.
- Contact form: when you choose “Send request”, your business name, email, message, language and source page are saved on Cloudflare D1 and sent by email to Yaveno through Fastmail. These details are not sent to the AI assistant. A request ID and a technical key prevent duplicate submissions. The form keeps your details on screen during retries; reloading clears them. Spam protection uses a keyed hash of the IP address for short-lived counters.
- AI assistant (Concierge chat): your current message and recent verified conversation turns are sent to the model to answer. Do not enter contact details, people’s names, health data or confidential information. Automated filters reject recognised identifiers and sensitive requests; they cannot guarantee detection of every personal detail. Use the brief or email for contact details.
- Chat technical data: request and usage counters, request identifiers and pseudonymous IP-derived fingerprints to contain abuse. Our counter store contains no raw IP addresses or conversation texts. Hourly counters expire after about two hours; reconciled request records after 90 days. Unreconciled reservations remain charged; usage totals are separate. Hosting providers’ technical policies also apply.
3. Purposes and legal basis
- Answering your request and handling the pre-contractual stage (Art. 6.1.b GDPR).
- Running the AI assistant (legitimate interest, Art. 6.1.f GDPR).
4. Recipients and processors
- Cloudflare, Inc.: site hosting and delivery (Cloudflare Pages), and storage of contact requests (D1), under a data processing agreement.
- Mistral AI SAS (France): generates replies through the Mistral Small API. The provider describes default EU hosting, with possible transfers for specific features and subprocessors. Data use and retention follow the Mistral DPA and organisation controls: a paid API alone does not establish exclusion from model training.
- Fastmail Pty Ltd (Melbourne, Australia): runs the email for yaveno.com. It delivers your brief and stores it in our mailbox, like any other email you write to us.
5. Transfers outside the European Union
The chat uses the standard Mistral API endpoint and does not enable web search, connectors or alternative AI providers. We do not claim that the entire processing chain excludes all transfers outside the EU. Cloudflare hosting may involve transfers to the United States, covered by Standard Contractual Clauses and/or the Data Privacy Framework. Email is run by Fastmail, an Australian company that may process data in the United States, the United Kingdom, Australia, India and Austria: those transfers too are covered by the Standard Contractual Clauses in its data processing agreement. Measures we take: a request not to enter personal data, filters before the model, no server-side application archive of conversations and usage limits.
6. Retention
Contact form details in D1 expire after 90 days and are removed by the next daily cleanup. Technical IDs, hashes and delivery status remain to prevent duplicates; they do not contain the text of the request. Spam counters expire after 20 minutes and are removed during cleanup. Email copies follow the mailbox retention described below.
Your brief sits in our mailbox like any other message, for as long as it takes to handle your request and to meet legal obligations; if nothing comes of it, we delete it. You can ask us to delete it at any time (point 9). Mistral APIs normally retain inputs and outputs for 30 days for abuse monitoring, subject to applicable settings or provider obligations; we do not claim active Zero Data Retention. YAVENO does not archive chat texts on the server. Browser sessions and counters follow points 2 and 7.
7. Cookies and local storage
The chat uses sessionStorage to keep recent messages and a signed conversation token while moving between pages, separately for Italian and English (yaveno-concierge-v1:it/en). The token expires after 30 minutes of inactivity. It is signed, not encrypted, and contains only the conversation already visible to you, never credentials or internal instructions. An expired conversation is not reused; local data is cleared when the tab closes or through browser settings. When you continue chatting, the verified conversation is sent to the AI provider. The theme preference (yaveno-candidate-theme) stays in localStorage. These tools support site functionality, not profiling.
8. AI assistant (EU Artificial Intelligence Act)
The assistant is an artificial intelligence system: we tell you so when the panel opens (Art. 50 AI Act). Answers are generated automatically, may contain inaccuracies and do not replace direct contact. To talk to a person: [email protected]. The site is not intended for children under 14.
9. Your rights
You can request access, rectification, erasure, restriction, objection and portability by writing to [email protected]. You also have the right to lodge a complaint with the Italian Data Protection Authority.
Last updated: 7 September 2026. Updated chat session, counters and provider description.
← Back to the site