Privacy notice
Version 1.4 of 9 October 2026. This is a translation: the Italian text prevails.
This notice explains how we process the personal data of visitors to media.algon.one and of users of Algon Media, the service that prepares content plans and social media content (images, carousels, stories, reels and copy) for businesses. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003.
1. Data controller
IMANAGER S.R.L., Viale Monza 256, 20126 Milan (MI), Italy — VAT IT10275570967 — REA MI-2518617 — certified email (PEC) imanager@legalmail.it — email morettiteo@gmail.com. Algon Media is a brand and service of IMANAGER S.R.L.. You can also write to ciao@media.algon.one.
The controller has not appointed a Data Protection Officer, as none of the cases requiring one applies (Art. 37 GDPR).
2. What we process, why, on what basis and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Website visitors: IP address, technical browser data, pages requested, country derived from the IP address | Serve and protect the website, offer the right language (Italian or English) | Legitimate interest (Art. 6(1)(f)) | Cloudflare technical logs: up to 7 days. The country is not stored |
| Account: name, email, company, phone if given, password (stored only as a salted cryptographic hash, PBKDF2, non-reversible) | Create and manage your dashboard | Contract and pre-contractual steps (Art. 6(1)(b)) | Account lifetime; see §6 |
| Brief and material: website, social profiles, goals, audience, tone, products, dates, copy, logo, photos, videos | Prepare the plan and content | Contract (Art. 6(1)(b)) | Account lifetime |
| Content produced for you, approvals, change requests and the studio’s working notes on your brand (preferences, things to avoid, decisions taken) | Deliver, revise, keep history, work consistently on your brand | Contract (Art. 6(1)(b)) | Account lifetime |
| Subscription: plan, length, status, dates; billing data once payments are active | Manage the subscription, invoice, meet tax and accounting duties | Contract (6(1)(b)) and legal obligation (6(1)(c)) | Subscription: account lifetime. Accounting records: 10 years (Art. 2220 Italian Civil Code) |
| Emails you send us (ciao@media.algon.one): sender, subject, text | Reply and support | Contract (6(1)(b)); legitimate interest (6(1)(f)) | 24 months from receipt |
| Service emails we send (recipient, type, outcome; never the text) | Prove service communications were sent | Legitimate interest (6(1)(f)) | 24 months |
| Marketing: email and name | Send news and offers from Algon Media | Optional consent (6(1)(a)), withdrawable anytime | Until withdrawal |
| Record of acceptances: email, date, version of documents accepted, choices (privacy, terms, specific clauses, marketing), cryptographic hash of the IP address | Prove acceptances and consents (Art. 7(1) GDPR; Arts. 1341-1342 Italian Civil Code) | Legitimate interest in proof and defence of rights (6(1)(f)) | Account lifetime plus 10 years after closure (Art. 2946 Italian Civil Code) |
| Security data: login sessions, attempt counters (keyed to the email for login and to the IP hash for sign-up: never the IP in clear), account event log, anti-bot check | Security, abuse and fraud prevention, troubleshooting | Legitimate interest (6(1)(f)) | Sessions up to 30 days; counters up to 1 day; event log 24 months |
Legitimate interest. Where we rely on legitimate interest (security, support, proof of communications and acceptances) we have assessed that processing is limited to what is necessary, expected by users of an online service, and does not override your rights. You may object at any time (§8).
3. Data about other people
Material you upload may contain other people's data: faces in photos and videos, names in copy or reviews. For that data you are the controller and IMANAGER S.R.L. processes it on your behalf as processor (Art. 28 GDPR) under Terms §11. Only upload material you have a valid legal basis for and, for images of people, their consent (Art. 10 Italian Civil Code; Arts. 96-97 Italian Copyright Law). We may read public pages of the website and social profiles you indicate to understand your brand (Art. 14 GDPR), without extracting personal data.
4. Providing data
Account and brief data are necessary to provide the service. Billing data is required by law when you buy. Marketing consent is optional and does not affect the service.
5. Recipients
Data is processed by persons authorised by the controller and bound to confidentiality, and by the following recipients, only as necessary:
- Cloudflare, Inc. and affiliates, processor under its data processing agreement (DPA) — website and dashboard infrastructure (computing, database, file storage), gateway to AI models, automated production engine, service email, anti-bot check (Turnstile).
- Third-party AI model providers, reached only through Cloudflare, which provides our access to them: currently Google (Gemini, which writes the plan; Veo, which animates an already generated image) and ByteDance (Seedream, which creates images; Seedance, which animates an already generated image, also in place of Veo when it is unavailable). The model writing the plan receives the text of the brief, including brand name, sector, city and website. The image model receives instructions derived from the plan and, only for content staging your product, up to 3 photos you uploaded. Video models receive only already generated images. None receives your email or login data.
- Google LLC, provider of the controller's mailbox, where studio alerts arrive: for a new brief, brand name and client email; for a change request, client email and the request text; for a new incoming email, only sender and subject. Google processes this data under the terms of its email service; the transfer to the United States relies on the EU-US adequacy decision (Data Privacy Framework).
A payment provider will be listed here before online payments are activated. Data may also be shared with the controller's tax advisor and with authorities where required by law. We do not sell personal data or use it for third-party advertising.
6. Where data is stored and for how long
The client database and the archive of material and content are hosted on Cloudflare under European Union jurisdiction. The model gateway is set not to store request content: it records only usage data (model, duration, cost). The state of automated jobs, which contains the brief, is kept by Cloudflare for at most 7 days.
Cloudflare and model providers may process data outside the EEA, including in countries without a European Commission adequacy decision. Transfers rely on the safeguards of Cloudflare's DPA: the EU-US adequacy decision (Data Privacy Framework) where applicable, otherwise the Commission's standard contractual clauses (Art. 46 GDPR). You may request a copy of the safeguards.
Retention is as per §2, applied nightly by an automated procedure. You can ask to delete your account at any time. Accounts with no active subscription and no logins for 24 months are deleted automatically with their material and content. Data needed for tax duties and the record of acceptances are kept, separately, for the legal periods. Emails you sent us and the log of service emails (recipient, type, outcome) remain until their 24 months expire, even after account deletion. Database backups expire within 30 days.
7. AI and automated decisions
We use AI systems to produce copy, images and videos; decisions on the plan and quality control stay with the studio. No decision based solely on automated processing producing legal or similarly significant effects is taken about you (Art. 22 GDPR). As required by Regulation (EU) 2024/1689 (Art. 50): generated images (JPEG and PNG) carry the standard machine-readable "AI-generated" marker (IPTC "trainedAlgorithmicMedia" metadata); videos currently carry no embedded marker; images and videos are labelled "AI-generated" in the dashboard and in the file name.
8. Your rights
You may exercise free of charge the rights under Arts. 15-22 GDPR: access and copy, rectification, erasure, restriction, portability in a structured machine-readable format, objection to processing based on legitimate interest, and withdrawal of marketing consent at any time without affecting prior processing — from your dashboard ("Communications" section) or by writing to us. Write to ciao@media.algon.one, morettiteo@gmail.com or PEC imanager@legalmail.it. We reply within one month, extendable by two for complex requests (Art. 12 GDPR), and may ask you to confirm your identity. You may lodge a complaint with the Italian Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome — garanteprivacy.it) or the authority of the country where you live or work.
9. Security
Encrypted connections (HTTPS), salted password hashes, protected session cookies, each client's files accessible only to the client and the studio, IP addresses stored only as hashes, anti-bot check at sign-up, login attempt limits. We will notify you of personal data breaches posing a high risk, as required by Art. 34 GDPR.
10. Minors
The service is for businesses and professionals aged 18 or over and is not aimed at minors.
11. Changes
We publish any new version here with its date; previous versions remain available at /en/privacy/<version>/. We notify you of material changes before they apply.
IMANAGER S.R.L. · Viale Monza 256, 20126 Milan (MI), Italy · VAT IT10275570967 · REA MI-2518617 · PEC imanager@legalmail.it
Privacy · Terms · Cookie · Legal notice