Privacy notice
How we process the personal data of people who visit this site, try AnonyAI or buy a licence. In short: as little as possible, and never the content of your documents.
1. Data controller
The data controller is Luciano Di Lauro. For any question about personal data you can write to .
2. What data we process and why
Browsing the website
The site uses no cookies, neither profiling nor analytics, and embeds no third-party tracking tools, advertising pixels or external resources. Like any web server, the hosting provider logs technical request data (IP address, date and time, page requested, browser) to ensure the security and operation of the service. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
To know how many people visit the site and download the application, we keep anonymous visit statistics, on our own servers and without cookies: page visited, language, referring site (the site name only), any campaign parameters in the link, country, device type, browser and operating system. We do not store the IP address or the full browser identifier. To count unique visitors we use an encrypted code that changes every day and from the next day can no longer be traced back to anyone. We build no profiles and do not combine this data with anything else. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention: 13 months.
On your first visit the site is shown in the language set in your browser. If you choose another language, the preference is saved only in your browser (local storage, not a cookie) and is not sent to us.
Free trial and licence activation
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Issuing and managing the licence | Contract (Art. 6(1)(b)) | Duration of the relationship | |
| Company name | Issuing the trial licence | Contract (Art. 6(1)(b)) | Duration of the relationship |
| Licence key | Verifying the purchase | Contract (Art. 6(1)(b)) | Duration of the licence |
| Computer fingerprint (salted hash) | Binding the licence to a workstation | Legitimate interest (Art. 6(1)(f)) | Duration of the activation |
| Computer name, operating system | Letting you recognise your PC in support | Legitimate interest (Art. 6(1)(f)) | Duration of the activation |
| IP address and country | Preventing fraud and abuse | Legitimate interest (Art. 6(1)(f)) | 90 days |
| Application version | Notifying updates | Legitimate interest (Art. 6(1)(f)) | Not stored |
The computer fingerprint is computed on the computer itself from hardware identifiers, transformed with an irreversible cryptographic function (SHA-256) and a product-specific value. The original identifiers never leave the machine. The update check transmits neither the licence key nor the computer fingerprint.
Purchases and invoicing
When you buy online, payment takes place on Stripe's page: card details and other payment details are collected and processed by Stripe and never reach us. From Stripe we receive the data needed to deliver your licence and issue the invoice: email, name, company, billing address, VAT number if you give one, recipient code or PEC, number of workstations, amount paid and payment reference. We also keep your request for immediate delivery of the licence, in which you acknowledged the loss of the right of withdrawal.
When instead you fill in the purchase request we process the data you enter (email, name, company, country, VAT number, recipient code or PEC, number of workstations, notes) to issue the invoice and deliver your licence.
In both cases the legal basis is pre-contractual measures and performance of the contract (Art. 6(1)(b)) and compliance with tax obligations (Art. 6(1)(c)). Billing data is kept for the period required by tax law, normally ten years.
If you explicitly choose to, we will also use your email to send you news about AnonyAI updates. Legal basis: consent (Art. 6(1)(a)), which can be withdrawn at any time.
Email communications
If you write to us, we process the data in your message to reply. Please never attach confidential documents: for support a description of the problem is enough.
3. What we do not process
By design, we never receive: documents or parts of them, file names or paths, extracted text, detected values, placeholders, restore maps, document fingerprints, counts of findings, usage statistics or telemetry.
4. Recipients and providers
Data is processed with the support of providers acting as processors (Art. 28 GDPR):
- Vercel Inc.: hosting of the website and the licensing service.
- Supabase Inc.: licensing service database, hosted in the London region (United Kingdom).
- Plus Five Five, Inc. (Resend): sending the email with the licence key.
- ImprovMX Incorporated: forwarding of messages sent to @anonyai.app email addresses.
For online payments we use Stripe Payments Europe, Limited (Ireland), which also processes payment data as an independent controller, for fraud prevention and for its own legal obligations: see its privacy policy.
Billing data is also sent to the Italian Revenue Agency through the Sistema di Interscambio, for electronic invoices, and may be shared with the accountant who assists the data controller with tax and bookkeeping obligations.
Some providers are based or have infrastructure outside the European Economic Area. In such cases the transfer is based on an adequacy decision of the European Commission (as for the United Kingdom or for US companies certified under the EU-U.S. Data Privacy Framework) or on standard contractual clauses (Art. 46 GDPR). Data is not sold or passed on to third parties for marketing purposes.
5. Your rights
You can at any time request access to your data, its rectification or erasure, restriction of processing and portability, and object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. Write to .
You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of your country.
6. Security
Communications with the website and the licensing service are encrypted (HTTPS with HSTS). Access to licensing data is restricted with row-level controls and dedicated roles. IP addresses are deleted automatically after 90 days.
7. Changes
Any changes to this notice will be published on this page, with the date of the latest update.