Legal · Rechtliches · Note Legali

Privacy Policy & Legal Notice

Last updated:

What changed on 24 September 2026. The contact form is gone: you now write to us by email, as sections 2, 3 and 8 describe. Section 10 now describes the AI Assistant demo as it works today, including the questions we keep for our statistics, the contact requests you can make through it and its optional map. Section 11, on job applications, is new, so the former section 11 is now section 12. Section 5 now names the theme preference the AI Assistant page stores.

Legal Notice (Impressum)

Demitas SRL

Address: Via Praruf 90, 39046 Ortisei (BZ), Italy

VAT / P.IVA: IT03345820215

Tax Code (Codice Fiscale): 03345820215

REA Number: BZ-252174

Share Capital: EUR 10.000,00 i.v.

DUNS Number: 302550258

Email: info@demitas.io

Certified Email (PEC): demitasgmbh@legpec.it

Legal form: Società a responsabilità limitata (SRL)

Represented by: Daniel Demetz, Administrator (Legal Representative) and Daniel Mahlknecht, Administrator

Place of Registration: Camera di Commercio di Bolzano

Content Responsibility

The content of this website is provided with care but without guarantee of accuracy or completeness. We assume no liability for the content of external links. The operators of linked pages are solely responsible for their content.

Privacy Policy

The protection of your personal data is important to us. This Privacy Policy explains what data we collect via this website, how we use it, who processes it on our behalf, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR) and the Italian Privacy Code (Codice Privacy, D.Lgs. 196/2003).

1. Data Controller

The controller responsible for data processing on this website is Demitas SRL (see Legal Notice above). Contact: info@demitas.io. We have not appointed a Data Protection Officer; the conditions of Art. 37 GDPR do not apply to our processing activities. For all data-protection requests, please contact us at info@demitas.io.

2. Data We Collect

When you email us at info@demitas.io, we receive your email address, your name if your message includes it, and the content of your message, together with anything else you choose to tell us, such as your company name. We need your email address to reply to you; everything else you send us is voluntary.

The lawful basis is Art. 6(1)(f) GDPR (legitimate interest in receiving, evaluating, and responding to business inquiries). We have weighed this interest against the rights and freedoms of data subjects and concluded that, given (i) the data subject voluntarily initiates contact, (ii) only minimal data is collected, and (iii) no profiling occurs, the processing is proportionate (balancing test per EDPB Guidelines 1/2024).

3. How We Process Your Email

This website has no contact form: you write to us directly from your own email account. Our mail runs on Microsoft 365 (Microsoft Ireland Operations Limited), which acts as our data processor under Art. 28 GDPR.

4. Hosting and Server Logs

This website is hosted by Hostinger International Ltd. on infrastructure located in Germany (primary server) with backups in France. Both endpoints are within the European Union, so the data transfer is intra-EU and no Art. 46 GDPR Standard Contractual Clauses are required for the host.

When you visit this website, Hostinger automatically collects technical data for security and operational purposes: IP address, browser type and version, date and time of access, and pages requested. This data is used solely for security, abuse prevention, and operational diagnostics. The lawful basis is Art. 6(1)(f) GDPR (legitimate interest in operating a secure, reliable website). Hostinger acts as our data processor under Art. 28 GDPR.

Hostinger's Data Processing Agreement: hostinger.com/legal/dpa; privacy policy: hostinger.com/legal/privacy-policy.

5. Cookies and Tracking

This website does not use tracking cookies, analytics cookies, advertising cookies, or any profiling technologies. We do not use Google Analytics, Meta Pixel, or any similar service. We do not load any third-party scripts that could set cookies on your device.

We may use functional/technical storage strictly necessary for website operation (for example, the URL hash that remembers which privacy-policy tab you selected). The AI Assistant page also remembers whether you chose its light or dark theme: when you use its theme switch, it stores a single entry in your browser's local storage, named demitas-theme and holding only the value light or dark, so that the page opens in the theme you chose. Only that page reads it, and you can delete it at any time by clearing this site's data in your browser. Under the Italian Garante's Cookie Guidelines (10 July 2021) and Art. 122 of the Italian Privacy Code (Codice Privacy, D.Lgs. 196/2003), such strictly-necessary technical storage does not require user consent and does not trigger a cookie banner. Accordingly, this website does not display a cookie banner.

6. Fonts

The typefaces used on this site (Space Grotesk, Inter Tight, JetBrains Mono) are served from our own hosting at demitas.io. When you load this site, your browser does not connect to Google Fonts, Adobe Fonts, or any other third-party font service. No font-related data is transmitted to any third party.

7. Your Rights Under GDPR

You have the following rights under the EU General Data Protection Regulation (GDPR):

  • Right of access (Art. 15 GDPR): to know what data we hold about you
  • Right to rectification (Art. 16 GDPR): to correct inaccurate data
  • Right to erasure (Art. 17 GDPR): to request deletion of your data
  • Right to restriction (Art. 18 GDPR): to limit processing in certain cases
  • Right to data portability (Art. 20 GDPR): to receive your data in a portable format
  • Right to object (Art. 21 GDPR): to object to processing based on legitimate interests
  • Right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it)

To exercise any of these rights, please contact us at info@demitas.io.

8. Data Retention

We retain email inquiries for 12 months after the last meaningful exchange unless (i) the inquiry leads to an ongoing business relationship, in which case we retain it for the duration of that relationship plus the legally-mandated record-retention period under Italian law (typically 10 years for accounting documents under Art. 2220 of the Italian Civil Code), or (ii) you ask us to delete it earlier. Server logs are retained by our hosting provider per their data-processing agreement. Demo conversations are deleted automatically 30 minutes after the last message. Questions from the demo kept for our statistics are deleted 90 days after the last time anyone asked them, and contact requests made through the demo are deleted after 90 days. The usage records described in section 10 contain no personal data.

9. Data Security

We use appropriate technical and organisational measures to protect your data against unauthorised access, loss, or misuse. All data transmission between your browser and this website is encrypted via HTTPS (TLS).

10. The AI Assistant Demo

Our AI Assistant page carries a working demonstration of the assistant we build. It answers questions from our own material published on this website. It loads with that page, as it would on any website that uses it: your browser fetches the assistant's launcher from the assistant's own servers, which receive your IP address and the address and language of the page in order to deliver it, and a short offer of help appears beside the launcher after a few seconds. Nothing you type is sent until you open the chat window and send a message. You can use it without an account, and we do not ask for your name, your email address or any other contact detail in order to use it.

When you use the demo we process the questions you type and the answers generated in reply. The lawful basis is Art. 6(1)(f) GDPR (legitimate interest in demonstrating our own product to prospective customers). The same legitimate interest covers delivering the launcher when the page loads.

Your conversation is kept for 30 minutes. It is held in temporary storage for 30 minutes from your last message, so that the assistant can understand follow-up questions, and is then deleted automatically. The only exceptions are the questions we keep for our statistics and a contact request you choose to make, both described below. Apart from these, we do not store the text of your questions or of the assistant's answers anywhere else, and nobody at Demitas can read a conversation back afterwards.

Questions we keep for our statistics. When the assistant cannot answer a question, that question alone (not the answer, and not the rest of your conversation) is kept and grouped with similar questions from other visitors, so that we can see what our website does not yet explain. A question the assistant could answer is kept in the same way and grouped with identical questions, so that we can see what visitors come to us for. Each kept question is deleted 90 days after the last time anyone asked it, so a question that keeps being asked is kept for as long as it keeps recurring. People at Demitas can read these questions, but not the conversations they came from. The lawful basis is Art. 6(1)(f) GDPR (legitimate interest in improving our website and our product).

If you ask us to contact you. The assistant may offer to have us contact you directly, for example when it has not been able to help you or when you ask to be contacted. You can always decline and keep chatting. If you accept, you give your name and either an email address or a telephone number, and nothing else. We then receive your name, the contact detail you gave and the questions you asked in that conversation, but not the assistant's replies. They are sent by email to our own inbox and kept for 90 days, after which they are deleted automatically. If the email cannot be delivered, your details are still stored so that we can follow up, and the assistant tells you so. The lawful basis is Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract). To have your details deleted sooner, write to us using the contact details in the legal notice on this page.

What is stored in your browser. The assistant sets no cookies and uses no local storage, no fingerprinting and no tracking pixel, and loading the page stores nothing. It writes at most two entries into your browser's session storage, each only after something you do, and your browser discards both at the latest when you close the tab. On this website, when you open the chat window or dismiss its offer of help, a marker holding only the value 1 records that the offer has been shown, so that it does not appear again during your visit. Inside the chat window, which runs on the assistant's own domain, once you send a first message it keeps the running conversation (at most the last 50 messages), a random session reference, any ratings you gave and whether you accepted or declined an offer to be contacted, so that the conversation is not lost when you move to another page; this entry is deleted after 30 minutes without activity, and this website cannot read it. Because each entry is created only by an action of yours and is used only to carry out what you asked for, both are strictly necessary for a service you have requested and do not require your consent (Art. 122 of the Italian Privacy Code).

Your IP address and your browser. Your IP address is used for two purposes and is never written to a database: it counts your requests against a rate limit for 60 seconds, which protects the demo against automated abuse and the costs it would cause, and, as an irreversible hash, it groups consecutive questions into a single conversation for 5 minutes. Both expire on their own. Your browser's identification (its user agent) is read once to derive a device class and is then discarded. The lawful basis is Art. 6(1)(f) GDPR (legitimate interest in operating the demo securely within a predictable budget and in understanding how it is used).

What we keep. For each answered question we keep one usage record: the time, the outcome of the request, the language, which model answered, how long the answer took, a device class (mobile, tablet, desktop or unknown) and a randomly generated conversation reference. These records contain no part of your question, no part of the answer, no IP address and no identifier that leads back to you, and they are kept indefinitely. If you rate an answer with a thumbs up or thumbs down, the rating is attached to the same record; it is one of two values, with no free text, and rating is optional. We use these records to understand how the demo is used and what it costs to operate.

Who processes your data. Your conversation is handled by specialist providers, each acting as our data processor under Art. 28 GDPR: one generates the answers, one matches your question against our published material, one operates the servers in Finland on which the assistant runs, and one delivers the email when you ask us to contact you. Every one of them is established in the European Union and processes your conversation there. Any transfer outside the EU is covered by an adequacy decision or by Standard Contractual Clauses.

Your questions are not used to train AI models. The account used to generate answers is configured to exclude submitted data from model improvement, and the provider that matches your questions is contractually bound not to train on them. The first is an account setting rather than a contractual guarantee, and the second has not been independently verified for machine-generated input; we state both as they are.

Error reporting. Separately from your conversation, we monitor our servers for technical faults using an error-reporting provider established in the United States, with data stored in the European Union. The content of your messages is excluded: the chat reports no errors to it at all, and request bodies, headers and IP addresses are removed before anything is sent. For the residual possibility of access from the United States, this relies on the EU-US Data Privacy Framework, under which the provider is certified, and on the Standard Contractual Clauses as a fallback.

The map. If you tap “Show map” under an answer of our assistant, your browser loads a map from Google; Google then receives your IP address and the address of this website as an independent controller. The legal basis is your consent, given by that tap (Art. 6(1)(a) GDPR). The map is subject to the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy.

Who our processors are. We will name our processors, and provide the relevant data processing agreements, on request: write to us using the contact details in the legal notice on this page.

Please do not enter personal data. The demo exists to show how the assistant answers questions about our own material. Apart from the contact details you choose to leave when you ask us to contact you, there is no reason to type anyone's name, contact details or other personal information into it, and we ask you not to.

11. Job Applications

When you apply for a position with us, you send your application to info@demitas.io. We process the personal data contained in the message you send us: your name, your contact details, your CV and any other material you choose to include.

The lawful basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and, for keeping an application on file beyond a single vacancy, Art. 6(1)(a) GDPR (your consent, which you may withdraw at any time).

Please do not send us special categories of data. Health information, trade-union membership, religious or political views, and the other categories listed in Art. 9 GDPR are not relevant to any role we advertise. Please leave them out of your application, and out of any photograph you attach.

How long we keep it. There is no fixed deletion date. We keep your application on file after the position is filled or the search is closed, so that we can answer questions about the process and consider you for future roles, until you ask us to delete it. You can ask at any time, and we will then delete it.

Who sees it. Applications are read by the two founders only. We do not use an applicant tracking system, we do not run automated screening or automated decision-making on applications, and we do not share them with anyone outside Demitas SRL.

Where it is processed. Our mail runs on Microsoft 365 (Microsoft Ireland Operations Limited), which acts as our data processor under Art. 28 GDPR. All seven rights listed in section 7 apply to your application data in the same way.

12. Changes to This Policy

We may update this Privacy Policy and Legal Notice to reflect changes in our services, the law, or our processors. The current version is always available at https://demitas.io/privacy with a "Last updated" date clearly indicated. Material changes will be summarised at the top of the page for a reasonable period after the change.