Privacy policy

This is an English translation provided for convenience. In case of discrepancies, the Italian version prevails.

This privacy policy describes how Itomori processes users' personal data, pursuant to Regulation (EU) 2016/679 ("GDPR"). Itomori is an AI second brain: you capture thoughts as voice, audio or text; the AI transcribes, structures and connects them.

1. Data controller

The data controller is Start Me Hub srl, a limited liability company (società a responsabilità limitata), with registered office at via Galasso da Carpi 1, 62100 Macerata (MC), Italy, VAT number IT01935510436, represented by its legal representative Valerio Fioretti. Privacy contact person: Valerio Fioretti. For any request regarding your data: info@itomori.com (certified email/PEC: startmehubsrl@pec.it).

2. What data we process

• Account data: email address (and, if you sign in with Google, the name and profile picture provided by Google).
• Content you create: text notes, audio files uploaded or recorded, the transcripts and the content generated by the AI from your notes.
• Usage and technical data: usage metrics (transcription minutes, number of generations and notes) to apply plan limits; minimal technical data (logs, request times) for security and abuse prevention.

3. Purposes and legal bases

• Providing the service (capture, transcription, semantic search, connections, content generation) — legal basis: performance of a contract (Art. 6(1)(b)).
• Authentication and security, including rate limiting and abuse prevention — legal basis: legitimate interest (Art. 6(1)(f)) and performance of a contract.
• Enforcement of plan limits and subscription management — legal basis: performance of a contract.

4. Providers and data processors

To provide the service we rely on providers acting as data processors:

• Supabase (database, authentication, server functions) — EU region (Frankfurt).
• Hetzner Object Storage (storage of audio files) — EU data center.
• OpenAI (audio transcription, generation of embeddings and content): the text and audio of notes are sent to OpenAI to be processed. OpenAI is a provider based in the United States.
• Google (only if you choose to sign in with Google): processes the OAuth login.
• Lovable (deployment of the web application).
• MailerLite (sending of transactional and marketing emails): we process email and name to manage registration, onboarding and communications. Servers in the European Union.
• HeyMetrica (traffic statistics): aggregated, cookieless analytics, with servers in the European Union.
• Meta Platforms (Meta Pixel and Conversions API): to measure the effectiveness of advertising campaigns and conversions. Events (e.g. visit, registration) are sent to Meta with technical identifiers and the email in hashed form. Meta is a provider based in the United States.
• Kajabi (CRM of our website Valerio.it): when your account is confirmed, your email is sent to Kajabi to check whether you are already one of our contacts and, if so, to apply a tag. Kajabi is a provider based in the United States.

5. Where data is stored and transfers outside the EU

Accounts, notes, transcripts and embeddings are stored in the European Union (Supabase – Frankfurt). Audio files are stored on Hetzner Object Storage in the EU. AI processing takes place through OpenAI (USA): this transfer is governed by appropriate safeguards (Standard Contractual Clauses of the European Commission). Emails and communications (MailerLite) and statistics (HeyMetrica) remain on servers in the European Union. For advertising measurement, some events are sent to Meta (USA) and the email for the contact check is sent to Kajabi (USA), both on the basis of appropriate safeguards (SCCs). We do not sell your data and we do not use it to train third-party AI models.

6. Retention

• Notes, transcripts and content are kept until you delete them or close your account.
• Audio files are automatically deleted 30 days after recording or upload, on all plans. Deletion is permanent and takes place every night. The text transcript remains as part of the note: you lose the recording, not the content. In the note itself, below the player, you will find the exact date and time at which that audio will be deleted.
• When the account is closed, the associated data is deleted within a reasonable time, unless otherwise required by law.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Arts. 15-22 GDPR). To exercise them, write to info@itomori.com. You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

8. Cookies, tracking and advertising

Itomori uses the browser's local storage for essential technical purposes: keeping your login session and your interface preferences (theme, text size).

To measure the effectiveness of our advertising campaigns we use Meta's Meta Pixel and Conversions API, which may set cookies and collect identifiers to attribute visits and registrations to ads. We also use traffic analysis tools in aggregated form. You can object to advertising tracking through the settings of your Meta account and of your browser.

For the complete and detailed list, see the Cookie Policy.

9. Changes

We may update this policy; material changes will be communicated through the application or by email. The date at the top indicates the latest revision.

10. Contact

For any question about the processing of your data: info@itomori.com.