# Privacy Notice for the evolus.ai website **evolus.ai showcase website** **Version 1.2** **Published on 2 October 2026, effective from 2 October 2026** **SHA-256 hash of the text: [HASH SHA-256]** This notice explains, in plain words, how CodeDesign S.r.l. processes the personal data of people who visit the evolus.ai website and use its features: browsing, statistics, experience analysis (if you turn it on), the contact form, Evo (the assistant on the home page) and the Evolus chat on the other pages. It is provided pursuant to articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and to the Italian Personal Data Protection Code (Codice in materia di protezione dei dati personali, Legislative Decree no. 196/2003). This notice concerns only the showcase website. If you use the Evolus platform (app.evolus.ai), the platform's privacy notice applies, published at https://evolus.ai/en/privacy-policy. The cookies and the other information saved in your browser are described in the website's cookie policy, published at https://evolus.ai/en/cookie-policy. --- ## 1. Who we are and how to contact us {#titolare} The controller is CodeDesign S.r.l., with registered office at Via Nino Pesce 38, 18018 Taggia (IM), VAT No. IT01739830089 ("CodeDesign", "we"). Evolus is a CodeDesign product. For any question about this notice and to exercise your rights, you can write to privacy@codedesign.it. CodeDesign has not designated a data protection officer pursuant to art. 37 of the GDPR, having assessed that the conditions for doing so do not apply. The privacy@codedesign.it mailbox is monitored by the data protection contact person. --- ## 2. In short {#in-breve} The table summarises the processing operations. The details are in the sections that follow. | What happens | What data | Why we can do it | How long | Who receives it | |---|---|---|---|---| | You visit the website | IP address and technical data of the request | Legitimate interest in showing you the website and protecting it (art. 6.1.f GDPR) | Not kept in an access log; fixed-size error log, overwritten on a rolling basis | Hetzner Online GmbH (hosting, Germany) | | Cookieless statistics (Umami) | Pages viewed, referrer, browser, device, language, approximate location, events, page loading and response times; the IP address is used and discarded, never saved | Legitimate interest in understanding how the website is used (art. 6.1.f GDPR) | 24 months | No third party: the service runs on our own server in Germany | | Statistics with cookies (Google Analytics) | Identifiers in cookies, pages viewed, events, device data, approximate location | Only with your consent (art. 6.1.a GDPR and art. 122 Italian Privacy Code) | 14 months for user-level and event-level data | Google Ireland Limited and Google LLC | | Marketing (Google Ads) | Identifiers in cookies, ad clicks, conversions, membership of audience lists | Only with your consent (art. 6.1.a GDPR and art. 122 Italian Privacy Code) | Up to 90 days for the cookies on our website; for the data processed by Google, Google's retention periods | Google Ireland Limited and Google LLC, also as independent controllers | | Marketing (Meta Pixel) | Pages visited and successful submission of the contact form (never its content or contact details), technical information about the browser and device, IP address, identifier in the _fbp cookie | Only with your consent (art. 6.1.a GDPR and art. 122 Italian Privacy Code) | _fbp cookie: 90 days in your browser; for the data received by Meta, Meta's retention periods | Meta Platforms Ireland Limited, as joint controller for the collection and transmission of the data, then as independent controller; Meta Platforms, Inc. (United States) receives them from Meta Platforms Ireland (section 12) | | Experience analysis: heatmaps | Position of clicks, scroll depth, window and page size, page path | Only with your consent (art. 6.1.a GDPR and art. 122 Italian Privacy Code) | 12 months | No third party: the service runs on our own server in Germany | | Experience analysis: session recordings | How you use the pages (clicks, scrolling, mouse movements, page changes) and the content of the page as it appears on your screen, including the conversation with Evo on the home page; never the text of the fields you fill in or your voice | Only with your consent (art. 6.1.a GDPR and art. 122 Italian Privacy Code) | 30 days | No third party: the service runs on our own server in Germany | | Contact form | First name, last name, email, company, phone, subject, message | Replying to your request (art. 6.1.b GDPR) | 24 months from the last exchange, unless a contract follows | Twilio SendGrid (email delivery), Microsoft (mailbox) | | Conversation with Evo | Voice converted into text or written text, conversation context, IP address | Providing the service you asked for (art. 6.1.b GDPR); improving Evo and preventing abuse (art. 6.1.f GDPR) | Transcript: 30 days at ElevenLabs. The voice is not recorded. With experience analysis turned on, the conversation as it appears on screen is also kept in the session recording, for 30 days | ElevenLabs, Google (language model) | | Live demonstrations, reading of your website, custom switchboard | Address of the website you indicate and public text of its home page; information about your company that you give to Evo | Providing the demonstration you asked for (art. 6.1.b GDPR) | Not kept by us, except in the session recording if you turned on experience analysis | OpenRouter, Google (language model); ElevenLabs for the voice test of the switchboard | | “I'll call you” | Phone number, content of the phone call converted into text | Making the phone call you asked for (art. 6.1.b GDPR) | Call data and transcript: 30 days at ElevenLabs | ElevenLabs, VoipVoice S.r.l. (telephone operator) | | “Book a demo” | Name, email, company, note, chosen time slot | Scheduling the appointment you asked for (art. 6.1.b GDPR) | 24 months from the last contact, unless a contract follows | Microsoft (calendar and Teams) | | “Send me the board” | Email address, link to the board | Sending you the link you asked for (art. 6.1.b GDPR) | Not kept by us after sending | Twilio SendGrid | | Evo's memory in your browser | Industry, plan and name of the company you talked about | Only with your consent, given by turning on the optional “Remember me next time” switch among Evo's controls (art. 6.1.a GDPR and art. 122 Italian Privacy Code) | 30 days from the last update, in your browser | No one: it stays in your browser | | Protection against abuse | IP address, anti-bot proof | Legitimate interest in protecting the website and the costs of the services (art. 6.1.f GDPR) | Only in the server's working memory, until the service restarts | No third party | | Evolus chat on the other pages | Messages, page you are viewing, contact details if you leave them in the chat, ratings of the replies | Replying to your questions and requests (art. 6.1.b GDPR) | 12 months from the last message | Evolus platform and its providers (section 10) | --- ## 3. Browsing the website and technical logs {#navigazione} The website runs on our own server at Hetzner Online GmbH, in a data centre in Nuremberg (Germany). Communications between your browser and the website are encrypted (HTTPS). As with any website, to show you the pages the server receives from your browser the IP address, the page requested, the date and time and some technical information about the browser. The server does not keep an access log with these data. The website's software writes a technical log of its own errors, which does not contain your IP address but may contain the details of a request that failed, for example the website address given to Evo, an email address or a phone number. This log has a fixed maximum size and is automatically overwritten as it fills up. We use it only to run the website and to fix problems, on the basis of our legitimate interest (art. 6.1.f GDPR). --- ## 4. Cookieless statistics (Umami) {#statistiche-umami} To understand which pages are useful and how to improve them we use Umami, a statistics tool that we install and manage ourselves, on our own server at Hetzner Online GmbH in Germany. The same installation also measures the codedesign.it website: the data of the two websites are kept separate and are not combined. **What it collects.** When you open a page, your browser downloads a small program from our domain, which sends to our statistics server the page address, the referring page, the page title, the browser language, the screen size and some events that we measure (for example a click on a button or the submission of the contact form, never the content of what you write). The program also reads from the browser the page loading and response times (the so-called “Core Web Vitals”: how long it takes to show the main content, how much the page shifts while loading, how quickly it responds to clicks), which help us find slow pages. From the browser the server also derives the browser type, the operating system and the device type. Any campaign parameters present in the page address are also saved, for example those indicating which newsletter or ad you come from. **What it does with your IP address.** The server receives your IP address, like any web server, and uses it for two purposes only, without saving it: - deriving your approximate country, region and city, with a database installed on our server, without querying external services; - calculating a visit code, obtained by combining IP address, browser type, website visited and a secret value that changes at the start of each month. It is used to count distinct visitors during the month without knowing who they are: the IP address cannot be traced back from the code, and the following month the same visitor receives a different code. **What it does not do.** Umami does not use cookies and does not save anything in your browser, does not follow you on other websites, does not create profiles and does not transmit data to third parties. If your browser sends the “Do Not Track” signal, statistics are not collected. The statistics do not record the content of the links to Evo's boards (section 8). Heatmaps and session recordings, which the website uses only if you turn on “Experience analysis”, are described in section 6. **Why we do not ask for your consent.** We process these data on the basis of our legitimate interest in understanding how the website is used and improving it (art. 6.1.f GDPR). The tool meets the conditions under which the Guidelines of 10 June 2021 (Linee guida del 10 giugno 2021) of the Italian Data Protection Authority (Garante per la protezione dei dati personali) treat analytics tools as equivalent to technical tools, for which consent is not required: it is used only by us, produces aggregate statistics, does not combine the data with other information and does not disclose them to third parties. These conditions concern the statistics described in this section; for heatmaps and session recordings we ask for your consent instead (section 6). You can nonetheless object at any time by writing to privacy@codedesign.it, or by turning on the “Do Not Track” signal in your browser. **Retention.** We keep the statistics data for 24 months, then we delete them. --- ## 5. Statistics and advertising with your consent (Google and Meta) {#google} On your first visit a banner asks whether you accept three optional categories: “Statistics” and “Marketing”, described in this section, and “Experience analysis”, described in section 6. You can accept them all, reject them all or choose them one by one; closing the banner is the same as rejecting. **Until you accept “Statistics” or “Marketing”, no Google or Meta program is loaded and no data is sent to Google or Meta.** You can change your mind at any time from the “Cookie preferences” link at the bottom of every page: withdrawal does not make unlawful what was done before, but from that moment Google and Meta no longer receive data from the website. How the banner works and the list of cookies are described in the cookie policy, at https://evolus.ai/en/cookie-policy. With version 1.2 of this notice, which adds the Meta Pixel to the “Marketing” category, the banner is shown once again to everyone, including those who had already chosen. **Statistics (Google Analytics 4).** If you accept this category, the website loads Google Analytics, which saves in your browser cookies with a random identifier and sends to Google the pages you visit, the events we measure (the same ones described in section 4, still without the content of what you write), information about the device and the browser and the referring page. For visitors located in the European Union, Google states that it uses the IP address only to derive the approximate location, on servers in Europe, and that it deletes it without logging it. For this purpose Google Ireland Limited processes the data on our behalf, as processor. User-level and event-level data are deleted by Google after 14 months; aggregate reports may remain available for longer. **Marketing (Google Ads).** If you accept this category, we allow Google to use the data of your visit to measure whether you come from one of our ads and whether the visit ends with a contact request (conversion), and to add you to audience lists used to show you our ads on Google and on the websites that partner with Google. For these purposes Google Ireland Limited and Google LLC also act as independent controllers and process the data according to their own rules, which you can find at https://policies.google.com/privacy and, for the use of data collected on partner websites, at https://policies.google.com/technologies/partner-sites. You can also manage Google's personalised ads at https://myadcenter.google.com. **Marketing (Meta Pixel).** If you accept the “Marketing” category, the website also loads the Meta Pixel of Meta Platforms Ireland Limited (Ireland): Meta's program is downloaded only after your consent. The pixel records the pages you visit and the successful submission of the contact form (without the content of the message or your contact details), together with technical information about the browser and the device and your IP address. We use them to measure how well our campaigns on Facebook and Instagram perform and to show our ads to people who have visited the website. The pixel saves in your browser the first-party cookie _fbp, a browser identifier that lasts 90 days (and, if you arrive from one of our ads on Facebook or Instagram, also the _fbc cookie with the click code); if you are logged in to Facebook or Instagram, Meta may also use its own cookies on its domains. We do not send Meta emails, telephone numbers or any other data you enter on the website, and the pixel's automatic events are turned off. The pixel is never loaded on the shared board page (section 8). For the collection and transmission of data through the pixel, CodeDesign and Meta Platforms Ireland Limited are joint controllers (art. 26 GDPR), under Meta's joint controllership agreement (“Controller Addendum”); for subsequent processing Meta acts as an independent controller, under its own privacy policy, which you can find at https://www.facebook.com/privacy/policy. You can also exercise your rights with Meta. If you withdraw your consent from the “Cookie preferences” link, from that moment the pixel no longer sends data to Meta and the website deletes the _fbp cookie. **Legal basis.** For both categories the legal basis is your consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code). If you reject, you can use the website exactly like someone who accepts. **Transfers.** Google may also process the data in the United States: the transfer takes place on the basis of the EU-US Data Privacy Framework, under which Google LLC is certified (section 12). Meta may also process the data in the United States, through Meta Platforms, Inc., which is certified under the EU-US Data Privacy Framework (section 12). --- ## 6. Experience analysis, only with your consent (heatmaps and session recordings) {#analisi-esperienza} In the banner you will also find the optional “Experience analysis” category. Only if you turn it on does the website use two additional features of Umami, the same tool used for the statistics in section 4: it runs on our own server at Hetzner Online GmbH in Germany, we install and manage it ourselves and it does not involve third parties. The same installation also measures the codedesign.it website, with the data kept separate. **Heatmaps.** The program collects the position of clicks on the page, how far you scroll down the page, the size of the window and of the page and the page path, without the part of the address after the “#” symbol. We look at these data in aggregate form, to understand which parts of the pages are used and which are not. We keep them for 12 months, after which they are automatically deleted. **Session recordings.** The program records how you use the pages (clicks, scrolling, mouse movements, moving from one page to another) and the content of the page as it appears on your screen, **including the conversation with Evo and the notes on its board on the home page**: so also what you write or say to Evo, once it has appeared on the screen as text. **The following are never recorded:** - the content of the fields you fill in: the text inside the fields is always hidden; - the Evolus chat on the other pages; - the shared board page, that is the one you open with the board link; - the audio of your voice. Texts that repeat your email address or your phone number on the screen are hidden in the recording. Each recording stops automatically after 5 minutes at most. We keep the recordings for 30 days, after which they are automatically deleted. **What they are for.** Heatmaps and recordings are viewed only by us, to understand what does not work and to improve the website. They are not used to profile you, we do not combine them with other data and we do not disclose them to third parties. **No cookies.** These features do not use cookies either and do not save anything in your browser. Your choice is remembered in the technical consent cookie, evolus_consent, described in the cookie policy, at https://evolus.ai/en/cookie-policy. **Legal basis.** The legal basis is your consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code), because the program reads from your device information that goes beyond what is strictly necessary. It is optional: if you do not give it, the website works exactly the same way. If the “Do Not Track” signal is turned on in your browser, nothing is recorded. **Withdrawal and deletion.** You can withdraw your consent at any time from the “Cookie preferences” link at the bottom of every page: the page reloads and from that moment the website stops collecting heatmaps and recordings. Withdrawal does not make unlawful what was done before. To ask us to delete a recording of your visit before it expires, write to privacy@codedesign.it (section 16). --- ## 7. Contact form and direct requests {#modulo-contatto} When you write to us from the contact form we process the data you enter: first name, last name, email address, message and, if you provide them, company, phone and subject. The website sends them by email to the info@codedesign.it mailbox through the Twilio SendGrid email service; the mailbox is hosted on Microsoft 365. The website does not keep a copy of the message. We process these data to reply to your request and, if you wish, for the negotiations that follow, on the basis of steps taken at your request prior to entering into a contract (art. 6.1.b GDPR). The same applies if you write to us directly at one of our email addresses or phone us. We keep the correspondence for 24 months from the last exchange. If the request leads to a contract, the data are kept for the duration of the contract and then for the periods required by law. --- ## 8. Evo, the website's assistant {#evo} On the home page of the website you can talk or write to Evo, an artificial intelligence-based assistant that introduces Evolus to you and builds, while you talk, a “board” of notes with the information you are interested in. You can also choose to watch the presentation without talking to Evo: in that case no data is sent to the assistant's providers. ### Before you start You do not have to accept anything to talk to Evo: you just choose whether to speak or write. Below the buttons, Evo reminds you that it is an artificial intelligence and links to this notice. During the conversation, among Evo's controls, you will find the optional “Remember me next time” switch, off by default: only if you turn it on does Evo save in your browser the memory described below; if you leave it off, the conversation works in the same way. The browser asks for the microphone only after you have chosen to speak by voice; you can always write instead of speaking. ### The conversation When the conversation starts, our server asks ElevenLabs for temporary access and your browser connects directly to ElevenLabs, which for this reason also receives your IP address. - **By voice**: ElevenLabs converts your voice into text while you speak, to understand what you say. **Your voice is not recorded** and is not used to identify you. - **In writing**: ElevenLabs receives the text you write. Evo's replies are produced by a Google language model (Gemini family), which we choose and ElevenLabs operates, and are spoken by a synthetic voice. To make the conversation relevant, together with your messages ElevenLabs receives some context information: the content of the board, the website language, the local time, whether your browser asks to reduce animations, the industry of the advertising campaign you may come from, the data in Evo's memory (if you turned it on) and, if you have just received the test call, the number you indicated. The transcript of the conversation (the text, not the voice) is kept at ElevenLabs for 30 days and then automatically deleted. During this period we may read it to improve Evo's replies and to detect improper use. If you turned on “Experience analysis” (section 6), the recording of your visit also contains the conversation with Evo as it appears on the screen, with the notes on the board, and is kept on our server for 30 days. The text you are typing in the message field and your voice are not recorded; what you write or say to Evo appears in the recording once it is shown on the screen as text of the conversation. ### Live demonstrations Evo can show you examples generated on the spot: a reply to an email, the reading of a document, the card of a custom switchboard. The sample emails and documents are texts prepared by us, which do not contain your data. - **Reading your website.** If you give Evo the address of your company's website, our server downloads its public home page and sends its text to the language model, which derives a short description of the company and a few usage examples. - **Custom switchboard.** If you describe your company to Evo (name, business, what the switchboard must handle, opening hours, other instructions), the language model prepares the switchboard card. If you then choose “Call your switchboard”, you talk from the browser with an ElevenLabs demonstration switchboard that uses that card, with the same rules as the conversation with Evo. For these demonstrations our server sends the text to OpenRouter, Inc., which forwards it to a Google language model (Gemini family). We keep neither the text sent nor the reply, which lives only in your page, except for what appears on the screen in the session recording, if you turned on “Experience analysis” (section 6). Avoid entering other people's personal data in the description. ### “I'll call you” If you ask for it and confirm with the dedicated box, the Evolus demonstration switchboard calls you at the number you indicate: we accept only Italian numbers. Our server passes the number to ElevenLabs, which places the call from our company number through the telephone operator VoipVoice S.r.l. (Florence). During the phone call you are answered by an artificial intelligence-based assistant, with a synthetic voice, which knows only the industry, the plan and the needs that emerged in the conversation with Evo. We use the number only for this phone call: we do not save it on the website and we do not use it for other contacts. ElevenLabs keeps the number called, the call data and the transcript of the phone call for 30 days; the voice is not recorded. VoipVoice S.r.l., as telephone operator, processes the call's traffic data (number called, date and duration) as an independent controller, for the periods that the law imposes on operators. ### “Book a demo” To offer you an appointment, Evo reads from our sales team's calendar only which time slots are free. If you choose one and give your name, email and, if you wish, company and a note, we create a Microsoft Teams meeting in the calendar of the sales@evolus.ai mailbox and Microsoft 365 sends you the invitation by email. The data are used to schedule and hold the meeting you asked for (art. 6.1.b GDPR). We keep the appointment and the related data for 24 months from the last contact; if a contract follows, for the duration of the contract and then for the periods required by law. ### “Send me the board” You can take the board away with a link. The content of the notes (for example industry, plan, name and description of your company, if you gave them to Evo) is written, in encoded form, in the final part of the link, the part after the “#” symbol, which the browser never sends to our server: we do not save the link on our servers and the website's statistics tools (Umami and, if you accepted them, Google Analytics, Google Ads and the Meta Pixel) do not receive the content of the link. **Anyone who has the link can see the board**: share it only with whom you want. The shared board page, the one that opens from the link, is never recorded and the Meta Pixel is never loaded on it. However, if you turned on “Experience analysis”, the board you see on the home page during the conversation with Evo appears in the session recording, kept on our server for 30 days (section 6). If you ask to receive the link by email, we use your address only for that sending, through Twilio SendGrid, and we do not keep it. Twilio SendGrid keeps technical delivery data, such as the recipient's address and the outcome of the sending, for a limited period. ### Evo's memory in your browser If during the conversation you turn on the optional “Remember me next time” switch, your browser remembers the industry, the plan and the name of the company you talked about, including those that came up before you turned it on, so that on your next visit Evo can pick up where you left off; as long as the memory is there, the switch shows as on. These data stay in your browser's storage, not on our servers; when you start a new conversation they are sent to ElevenLabs together with the other context information. 30 days after the last update Evo no longer uses them and deletes them. The legal basis is your consent, given by turning on the switch (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code). If you leave it off, Evo works in the same way but remembers nothing of the conversation. You can withdraw it at any time by turning the switch off, which immediately deletes the memory from your browser, or by clearing the website's data from the browser settings. ### Protection against abuse Every conversation with Evo and every phone call has a cost for us. To prevent automated use and abuse: - before opening a conversation your browser solves a small calculation, a “proof of work”, which our server verifies. The system, ALTCHA, runs entirely on our servers: it does not involve third parties, does not use cookies and does not collect data about you; - we count how many requests arrive from each IP address to Evo's features and to the contact form. The count lives only in the server's working memory, is not written to disk or to a database, takes into account only the requests of the last hour (of the last 15 minutes for the contact form) and is reset at every restart of the service; - we set overall daily caps on conversations and phone calls, which do not concern individual visitors. The legal basis is our legitimate interest in protecting the website and containing its costs (art. 6.1.f GDPR). ### Evo is an artificial intelligence Evo and the demonstration switchboard are artificial intelligence systems: you are talking to a program, not to a person. Their replies may contain errors or inaccuracies: before making decisions, check important information, such as prices and conditions, on the website's pages or with our sales team. --- ## 9. Provision of data {#conferimento} Providing us with data is optional. Without the mandatory fields of the contact form, however, we cannot reply to you; without a phone number we cannot make the test call; without name, email and time slot we cannot schedule the demo. You can browse the website and watch the presentation without providing any data and without turning on the optional categories of the banner. --- ## 10. The Evolus chat on the other pages {#widget-chat} On the pages other than the home page you will find the Evolus chat, the same tool we offer our customers for their websites. Its program is downloaded from the servers of the Evolus platform (api.evolus.ai) only after your first interaction with the page, for example when you scroll or touch the screen; from that moment the platform's servers receive your IP address and the technical data of the browser, as for any request. If you use the chat, we process: - the messages you write and the replies you receive; - the address, the title and the list of links of the page you are viewing and, if you ask for information about the page, its text, so that the assistant can reply to you relevantly; - name, email and phone, if you enter them in the chat's contact form; - the ratings you give to the replies. In the current configuration the website's chat does not accept files or voice messages. The conversations are kept in the Evolus platform, whose infrastructure is located in the European Union, and the replies are generated by artificial intelligence models reached through OpenRouter, Inc., with the providers listed on the platform's sub-processors page, at https://evolus.ai/en/subprocessors. If you leave your contact details or ask to be contacted, our sales team uses them to reply to you. We process these data to reply to your questions and follow up on your requests (art. 6.1.b GDPR). We keep the conversations and the contact details for 12 months from the last message; if a business relationship follows, the contact details are kept as indicated in section 7. The information that the chat saves in your browser is described in the cookie policy, at https://evolus.ai/en/cookie-policy. --- ## 11. Who receives the data {#destinatari} The data are processed by our authorised staff, bound by confidentiality, and by the providers listed below. Except where indicated, the providers act as our processors pursuant to art. 28 GDPR, bound by a data processing agreement. | Provider | What it does for the website | Where it processes the data | |---|---|---| | **Hetzner Online GmbH**, Germany | Server of the website, of the Umami statistics and, only with your consent, of the heatmaps and session recordings | Germany (Nuremberg) | | **Twilio Inc.** (Twilio SendGrid service), United States | Sending the emails of the contact form and the links to the boards | United States | | **Microsoft Ireland Operations Limited**, Ireland, Microsoft Corporation group, United States | info@codedesign.it mailbox, calendar and Teams meetings of the sales@evolus.ai mailbox; cloud infrastructure of the Evolus platform that hosts the chat | European Union; the provider's support may also take place outside the Union | | **Eleven Labs Inc.** (ElevenLabs), United States | Conversations with Evo, demonstration switchboard, test call | United States | | **Google LLC**, United States | Language model used by ElevenLabs for Evo and model service (Vertex AI) reached through OpenRouter for the demonstrations | United States | | **OpenRouter, Inc.**, United States | Routing of requests to the language model for the live demonstrations and for the Evolus chat | United States | | Model providers of the Evolus platform | Replies of the Evolus chat, according to the list published at https://evolus.ai/en/subprocessors | As indicated on that page | | **Google Ireland Limited**, Ireland, and **Google LLC**, United States | Only with your consent: Google Analytics (as processor) and Google Ads (also as independent controllers) | European Union and United States | | **Meta Platforms Ireland Limited**, Ireland | Only with your consent: Meta Pixel (as joint controller for the collection and transmission of the data, then as independent controller) | European Union | | **Meta Platforms, Inc.**, United States | Only with your consent: receives the Meta Pixel data from Meta Platforms Ireland Limited (section 12) | United States | | **VoipVoice S.r.l.**, Florence | Telephone operator of the number from which the test call is placed, as independent controller of the traffic data | Italy | We do not sell your data and we do not disclose them to third parties for their own independent purposes, except as described for Google Ads and the Meta Pixel with your consent and for the telephone operator. --- ## 12. Transfers outside the European Economic Area {#trasferimenti} The website, the Umami statistics, the heatmaps and the session recordings run in Germany. **Some features, however, involve a transfer of data to the United States**: the conversations with Evo and the test call (ElevenLabs and Google), the live demonstrations and the Evolus chat (OpenRouter and the model providers), the sending of emails (Twilio SendGrid), any technical support from Microsoft (section 11) and, only with your consent, Google Analytics, Google Ads and the Meta Pixel. The transfers take place with these safeguards: - to Eleven Labs Inc., Google LLC, Twilio Inc., Microsoft Corporation and Meta Platforms, Inc.: the EU-US Data Privacy Framework, adequacy decision of the European Commission of 10 July 2023, under which these companies are certified. You can check this at https://www.dataprivacyframework.gov; - to OpenRouter, Inc.: the Standard Contractual Clauses approved by the European Commission with Implementing Decision (EU) 2021/914, incorporated into the data processing agreement with the provider; - to the model providers of the Evolus chat: the safeguards indicated for each of them on the sub-processors page, at https://evolus.ai/en/subprocessors. You can ask us for information about the safeguards adopted by writing to privacy@codedesign.it. --- ## 13. How long we keep the data {#conservazione} - **Website error log**: fixed maximum size, automatically overwritten on a rolling basis. - **Count of requests per IP address**: only in the server's working memory; it counts the requests of the last hour (last 15 minutes for the contact form) and is reset at every restart of the service. - **Umami statistics**: 24 months. - **Google Analytics**, only with your consent: 14 months for user-level and event-level data. - **Google Ads cookies**, only with your consent: up to 90 days in your browser; the data processed by Google as independent controller follow Google's retention periods. - **Meta Pixel**, only with your consent: _fbp cookie (and _fbc, if present) for 90 days in your browser; the data received by Meta follow Meta's retention periods. - **Heatmaps**, only with your consent: 12 months, then automatically deleted. - **Session recordings**, only with your consent: 30 days, then automatically deleted; they include the conversation with Evo as it appears on the screen. - **Requests from the contact form, by email or by phone**: 24 months from the last exchange. - **Appointments booked with Evo**: 24 months from the last contact. - **Transcripts of the conversations with Evo, of the demonstration switchboard and of the test call**: 30 days at ElevenLabs, then automatically deleted. The voice is not recorded. - **Texts sent for the live demonstrations**: not kept by us, except for what appears on the screen in the session recording, if you turned on experience analysis. - **Link to the board sent by email**: address not kept by us after sending; technical delivery data kept by Twilio SendGrid for a limited period. - **Evo's memory**, only if you turned on the “Remember me next time” switch: in your browser, for 30 days from the last update, then Evo deletes it; you can delete it earlier by turning the switch off. - **Conversations and contact details of the Evolus chat**: 12 months from the last message. If a request leads to a contract, the necessary data are kept for the duration of the contract and then for the periods required by law, for example for accounting and tax obligations. We may keep for longer the data strictly necessary to establish, exercise or defend a legal claim. --- ## 14. Automated decisions {#decisioni-automatizzate} We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you. Evo and the chat use artificial intelligence to reply to you, but they do not decide anything about you. --- ## 15. Minors {#minori} The website is aimed at businesses and professionals. Evo, the test call, the demo booking, the chat and the contact form are reserved for adults: if you are under 18, do not use them and do not send us personal data. --- ## 16. Your rights {#diritti} At any time you can exercise the rights provided for by articles 15 to 22 of the GDPR, and in particular: - access your personal data and receive a copy of them; - obtain the rectification of inaccurate data and the completion of incomplete data; - obtain the erasure of the data, where the conditions of art. 17 GDPR apply; - obtain the restriction of processing; - receive the data you provided to us in a structured, commonly used and machine-readable format, and transmit them to another controller; - **object at any time to the processing based on our legitimate interest**, including the Umami statistics; - withdraw your consent at any time, from the “Cookie preferences” link for Google Analytics, Google Ads, the Meta Pixel and experience analysis and by turning off the “Remember me next time” switch for Evo's memory, without affecting the lawfulness of the processing carried out before the withdrawal. To exercise them, including to ask us to delete a recording of your visit before it expires, write to privacy@codedesign.it. We reply without undue delay and in any case within one month of the request. Some data, such as Evo's memory and the information saved by the chat, stay only in your browser: we cannot see or delete them ourselves, but you can delete them as explained in the cookie policy. For the data processed through the Meta Pixel, for which we are joint controllers with Meta Platforms Ireland Limited, you can also exercise your rights with Meta (https://www.facebook.com/privacy/policy). --- ## 17. Complaint to the supervisory authority {#reclamo} If you believe that your data are processed in a way that does not comply with the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, https://www.garanteprivacy.it) or with the supervisory authority of the Member State of the Union in which you habitually reside, work or where the alleged infringement took place. --- ## 18. Changes to this notice {#modifiche} We may update this notice when the website's features, the providers or the rules change. We publish each new version on this page, with the version number and the date. If a change concerns processing based on your consent, we ask you for it again when needed. --- CodeDesign S.r.l., evolus.ai website. Registered office: Via Nino Pesce 38, 18018 Taggia (IM), VAT No. IT01739830089. Data protection contact: privacy@codedesign.it. Text of the notice: https://evolus.ai/en/website-privacy.