Privacy Policy

1. Data Controller

The Data Controller for personal data is:

This policy applies to the processing carried out through the martes-ai.com website and through the services made available on subdomains and connected domains of the same Controller, including guida.riccardobelli.ai and the AudiTes platform (section 12). Users who fill in a form on one of these domains and open the linked privacy policy will find here the rules governing the processing of their data, even where the domain hosting the form differs from the domain hosting this policy.

2. Personal Data Collected

2.1 Data provided voluntarily by the user

Through the contact form we collect:

• First and last name, email address and, if provided, phone number
• Company name, website, annual turnover and company size
• Role, service of interest and project description
• How the user heard about Martes AI

Through the form to receive the templates we collect the email address. Through the calendar to book a call (Cal.com) we collect name, email address and any notes entered by the user. Booking data is also recorded in the Controller's Prisma CRM, which runs on Cloudflare infrastructure (section 4).

Subscribers also receive the newsletter. Its emails contain a tracking pixel, an invisible image that tells us whether the email was opened and which links were clicked, such as the attached YouTube videos. We use it to understand which topics interest readers and to improve the content. Consent to the pixel is given together with consent to receive the newsletter. Anyone who wants to keep receiving it without the pixel can choose so from the «Unsubscribe» page, reached from the link at the bottom of every email: from then on their emails go out without the pixel and with direct links.

For every form that requires consent we also keep, as proof under Art. 7 GDPR, the text and version of the consent given, the date and time, the IP address and the browser user agent.

2.2 Automatically collected data

During navigation on the martes-ai.com website, subject to user consent, the following data may be automatically collected via Google Analytics 4:

• IP address (anonymized)
• Browser type and operating system
• Pages visited and time spent
• Geographic origin (country/region level)
• Traffic source

Only if the user accepts marketing cookies:

• the Meta Pixel (Meta Platforms Ireland Limited) records the pages visited and bookings made, to measure the effectiveness of advertising campaigns on Facebook and Instagram and to show relevant ads
• the site stores on the device the source of the first and the most recent visit (campaign, link or external referring site), which is then attached to requests sent through the forms and to bookings

Even without marketing consent, requests sent through the forms include the page they were sent from, the referring page and any campaign parameters in that page's address. This information is not stored on the device. For more details on the cookies used, please refer to our Cookie Policy.

Some website resources are hosted by third-party providers which, in order to deliver them, receive the device IP address, the referring page and the technical data of the browser: Google Fonts (Google Ireland Limited), which serves the website typefaces on every page; YouTube (Google Ireland Limited) in the cookie-free mode of the youtube-nocookie.com domain, together with the i.ytimg.com domain for preview images, for the videos embedded in the pages; Cal.com, which provides the booking calendar on the pages that contain it. Google Fonts and the video preview images do not set cookies. The YouTube player is loaded when the preview is clicked and, on the corporate training page, starts automatically in muted mode: in both cases the domain used is youtube-nocookie.com, which does not set profiling cookies. The script that detects the visit source is hosted on the riccardobelli.com domain, which also belongs to the Controller, and is loaded only after consent to marketing cookies. Every page also loads the Google Tag Manager library (gtag.js, Google Ireland Limited), which runs Google Analytics in Google's consent mode and sets no cookies until the user accepts analytics cookies. Some images in articles and case studies are hosted on ImgBB and on the Hostinger content delivery network, which receive the IP address and the technical browser data in order to deliver them.

2.3 Data collected via WhatsApp Business API

As part of the Ambra service, we collect and process the following data transmitted through the WhatsApp Business platform (Meta Platforms), in compliance with the WhatsApp Business Platform Policies:

• User's phone number
• Content of messages sent and received
• Message timestamps
• WhatsApp profile name (if available)

Such data is processed exclusively on behalf of Martes AI S.R.L.'s business clients using the Ambra service, and is not used for purposes other than those indicated in this document.

2.4 Data collected via the AI self-assessment questionnaire

The self-assessment questionnaire available at guida.riccardobelli.ai allows the user to receive a personalized report on the adoption of artificial intelligence within their company. As part of this service we collect:

• Eight to nine multiple-choice answers about the user's company: business sector, number of people working at a computer, number of people using artificial intelligence tools, tools already in use, business areas to start from, internal attitude towards artificial intelligence, software on which the work is carried out, how the last training programme was measured
• Up to three descriptions of repetitive activities carried out in the company, each with its weekly hours range. These descriptions are free text: the content is written directly by the user and may concern their company in unstructured form
• Further optional free text fields: business sector when the user selects the "Other" option, CRM name, ERP name, main software used
• Company name and email address
• IP address and browser user agent, stored in clear text within the consent record as proof of the consent given pursuant to Art. 7 GDPR

Consent is collected through a checkbox that is not pre-ticked and that refers to this policy. The text of each version of the consent is recorded by the Controller for evidentiary purposes.

2.5 Data collected via Google APIs

As part of the Ambra service, when the Client connects their Google account, we access the following data through Google APIs:

• Google Calendar: calendar events (read and write) for automated appointment management
• Google Sheets: the data contained only in the spreadsheets the Client explicitly selects through the Google file picker (Google Picker), or that the application creates at their request (read and write), for contact import and synchronization with the integrated CRM
• Scope of the authorization: the authorization requested is limited to the drive.file scope, which grants access only to files created by the application or chosen by the Client through the Google Picker. We do not access the listing, the metadata or the content of any other file in the Client's Drive

Such data is processed exclusively on behalf of the Client who authorized the integration and for the purposes indicated above.

Data received from Google APIs is not:

• sold, transferred, or shared with third parties for purposes other than service delivery
• used for advertising or profiling purposes
• used to develop, improve, or train artificial intelligence or machine learning models, whether generalized or personalized
• transferred to third-party services that use such data to train their own AI/ML models

The use of data received from Google Workspace APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

3. Purposes and Legal Basis of Processing

Personal data is processed for the following purposes:

4. Data Recipients

Personal data may be shared with:

• Google Ireland Limited (Google Analytics 4), for statistical analysis of web traffic, subject to consent
• Meta Platforms Ireland Limited (Meta Pixel), for measuring advertising campaigns, subject to consent to marketing cookies
• Netlify, hosting of the website and of the functions that receive the contact and template forms
• Cal.com, calendar management for booking calls
• Google Ireland Limited (Google Fonts), delivery of the website typefaces; it receives the IP address and the technical browser data needed to serve the files, without setting cookies
• Google Ireland Limited (YouTube, cookie-free mode, and i.ytimg.com for previews), playback of the videos embedded in the website pages
• Google Ireland Limited (Google Tag Manager), loading of the library that runs Google Analytics in consent mode
• ImgBB and Hostinger International Ltd, services that host some images in articles and case studies
• Prisma, the CRM developed and run by the Controller, where the data submitted through the contact form, the call bookings and a copy of the consent proofs are stored. Prisma runs on Cloudflare infrastructure (Workers and D1 databases)
• Make, automation platform with servers in the European Union, which forwards sign-ups to receive the templates
• Kit, sending the requested templates and related communications to subscribers
• Amazon Web Services EMEA SARL (Amazon SES, Ireland region), delivery of the newsletter emails; it receives the recipient's email address
• Meta Platforms Ireland Limited (WhatsApp Business API), for message transmission via the WhatsApp Business platform, as part of the Ambra service
• Cloudflare, provider of the infrastructure the Controller's applications run on: the Prisma CRM, the Ambra services, the application (Worker) that serves the AI self-assessment questionnaire the AudiTes platform (section 12) and the newsletter platform, with subscribers' addresses, opens and clicks, together with their D1 databases, whose instances are configured with a primary region in the European Union. Cloudflare also provides the Turnstile service protecting the forms against automated submissions
• OpenRouter, routing of requests to the Deepseek artificial intelligence model, used to generate two paragraphs of the report. The questionnaire answers are transmitted, including the free text descriptions of repetitive activities. Company name and email address are not transmitted to the model. For the AudiTes platform, OpenRouter routes requests to the model described in section 12.5
• Airtable, storage of the complete contact record, including company name and email address (AI self-assessment questionnaire), of waiting list sign-ups and of the consent proof log
• Resend, which relies on Amazon SES for delivery, sending of the email message containing the link to the report; it receives the recipient's email address. It also sends the emails of the AudiTes platform (section 12.6)
• Google Ireland Limited (Google Calendar API, Google Sheets API), for the synchronization of calendar events and of the spreadsheets chosen by the Client only, upon explicit Client authorization via OAuth
• Legal and tax consultants of the Controller, for compliance with legal obligations
• Technical service providers (hosting, email) strictly necessary for service delivery

Data is not sold, transferred, or disclosed to third parties for purposes other than those indicated.

5. International Data Transfers

Google Analytics, Google Fonts and YouTube may involve the transfer of data to servers located in the United States. Such transfer is based on the European Commission's adequacy decision regarding the EU-US Data Privacy Framework, which ensures an adequate level of protection pursuant to Art. 45 GDPR.

Meta Platforms (Meta Pixel), Netlify, Cal.com, Kit and ImgBB may also process data on servers located in the United States. Such transfer is based on the EU-US Data Privacy Framework (Art. 45 GDPR) for providers that adhere to it and, failing that, on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR).

Data transmitted via the WhatsApp Business API is subject to Meta Platforms Ireland Limited's Privacy Policy. Meta adheres to the EU-US Data Privacy Framework, ensuring an adequate level of protection for data transfers to the United States.

The providers Cloudflare, OpenRouter, Airtable and Resend are established outside the European Union, and relying on them involves a transfer of personal data to third countries. The transfer takes place on the basis of the European Commission's adequacy decision regarding the EU-US Data Privacy Framework pursuant to Art. 45 GDPR for those providers that adhere to it and, failing that, on the basis of the Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR. The D1 database instances used by the Controller, including those of the Prisma CRM and the one storing the questionnaire answers, are configured with a primary region in the European Union and the data remains stored there; the database and the file storage of the AudiTes platform are created in the EU jurisdiction. Cloudflare, as the provider, may access them through its authorized personnel under the agreed contractual terms and the Standard Contractual Clauses in place. Requests sent to the Deepseek model through OpenRouter, and those of the AudiTes platform (section 12.5), may instead be processed on infrastructure located outside the European Union.

6. Data Security and Protection Measures

Martes AI S.R.L. implements appropriate technical and organizational measures to protect the personal data it processes, in accordance with Art. 32 of the GDPR:

6.1 Encryption

• In transit: all communications between clients, servers, and third-party services use TLS 1.2 or higher (HTTPS). No data is transmitted in plaintext.
• At rest: data stored in the Controller's databases and storage systems is protected by infrastructure-level encryption (AES-256), managed by the hosting provider (Cloudflare, Inc.).

6.2 Access Control

• Multi-tenant isolation: each business client can only access their own data. Isolation is enforced at the application level through a unique client identifier, verified on every request.
• Authentication: platform access requires unique credentials (email and password). Sessions are protected by digitally signed tokens (JWT) with time-based expiration.
• OAuth authorization: access to Google data (Calendar and Sheets) occurs exclusively upon explicit user authorization via the OAuth 2.0 protocol. Access tokens are stored in encrypted storage and are never exposed to the frontend.

6.3 Token and Credential Management

• OAuth refresh tokens are stored in an encrypted key-value store, separate from the main database.
• Third-party API credentials (Meta, Google) are managed through protected environment variables and are never included in source code.
• User passwords are stored as cryptographic hashes (scrypt) and are never stored or transmitted in plaintext.

6.4 Data Minimization

The Controller collects and processes only the data strictly necessary for service delivery. In particular, access to Google data is limited to the declared operations only (creating and managing calendar events, reading and writing only the spreadsheets chosen by the Client through the Google Picker) and does not extend to any other file or data in the user's Google account.

6.5 Staff Access

Access to production systems and client data is restricted to the Controller's authorized technical personnel, solely for maintenance and support purposes. No employee or contractor has direct access to end users' Google data outside of the platform's automated operations.

7. Retention Period

• Contact form and booking data: retained for the time necessary to handle the request and, in the case of a contractual relationship, for the duration of the contract plus 10 years (tax obligations).
• Newsletter data (email address, opens and clicks): retained until the subscriber unsubscribes. After unsubscribing only the address is kept, so that we do not write to them again.
• Analytical data (Google Analytics): retained for 14 months from collection, in aggregated and anonymized form.
• Source stored on the device: 180 days for the first visit, 30 days for the most recent one, or until marketing consent is withdrawn, which deletes it. Meta Pixel cookies last as stated in the Cookie Policy.
• Contractual data: retained for 10 years from the end of the contractual relationship.
• WhatsApp data (messages and metadata): retained for the duration of the contract with the business client and deleted within 30 days of termination.
• AI self-assessment questionnaire data: the answers, the free text descriptions, the company name and the email address are retained in the database and in the contact archive until deleted by the Controller or upon request of the data subject.
• Generated report: it remains reachable at its own web address for an indefinite period. This is a service design choice, so that the recipient can reopen the report and share it. The data subject may request its removal at any time by writing to contact@martes-ai.com.
• Consent record (consent text, IP address, user agent, date and time): retained as proof of consent pursuant to Art. 7 GDPR for the entire duration of the processing and for the subsequent period necessary to establish or defend a legal claim.
• Google data (calendar and the spreadsheets chosen by the Client): retained for the duration of the active integration. Upon disconnection of the Google account or service termination, synchronized data is deleted within 30 days.
• AudiTes platform data: attachments, answers and personal data follow the periods stated in section 12.7.

8. Data Subject Rights

Under Articles 15–22 of the GDPR, the data subject has the right to:

• Access (Art. 15): obtain confirmation of whether processing is taking place and access to personal data
• Rectification (Art. 16): obtain correction of inaccurate data or completion of incomplete data
• Erasure (Art. 17): obtain deletion of data, in the cases provided by law
• Restriction (Art. 18): obtain restriction of processing
• Portability (Art. 20): receive data in a structured format and transmit it to another controller
• Objection (Art. 21): object to the processing of data
• Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal

To exercise your rights, send a request to contact@martes-ai.com. A response will be provided within 30 days.

9. Data Deletion

Users may request the deletion of their personal data at any time. For users of the Ambra service (WhatsApp Business), a deletion request will result in the removal of:

• Phone number and identifying information
• WhatsApp conversation history
• Metadata associated with messages

To request data deletion, send an email to contact@martes-ai.com with the subject line "Data Deletion Request". Deletion will be completed within 30 days of receiving the request, subject to any legal retention obligations.

Note: deletion of data may make it impossible to continue the service.

10. Right to Lodge a Complaint

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it.

11. Provision of Data

Providing personal data via the contact form is optional. However, failure to provide data marked as mandatory may make it impossible to handle the request. Providing data within the Ambra service is necessary for service delivery.

12. AudiTes platform

This section covers the Martes AI AudiTes platform, currently at martes-auto-audit-web.martes-ai.workers.dev. It is accessed through a personal link, sent to people named by a company that asked Martes AI for an audit of its work processes. The platform asks one question at a time about the person's repetitive work: what it is, how long it takes, how often it recurs, how it is carried out and what wastes time.

The Data Controller is Martes AI S.R.L., with the contact details given in section 1. For anything this section does not cover, the other sections of this policy apply, in particular the protection measures (section 6), the rights (section 8) and the complaint (section 10).

12.1 What data we process

• First and last name, role, department and, if we have it, the email address.
• The answers to the questions about one's work: the tasks carried out, the steps, the software used, the estimated duration and frequency, what goes wrong or wastes time.
• About the colleagues the person works with: role, department, the type of working relationship and what they deal with together. First and last name only if the person chooses to give them.
• The files the person chooses to attach, which may contain data about other people.
• Date and time of the answers and of the uploaded files.
• The technical connection data, such as the IP address and the browser type, which the infrastructure provider processes to run and protect the platform.

Name, role, department and email are provided to us by the company that requested the audit. Everything else is written by the person who answers, including the colleagues' data.

About the company we also use its name, its logo and a short description of its business and of the software it uses, so that the platform does not ask about things already known. The logo appears at the top of the page and is visible only to the people invited by that company.

We do not ask for health data, political or religious opinions, trade union membership or other special categories of data under Art. 9 GDPR, and we ask people not to enter them. We also ask people not to enter customers' personal data (names, licence plates, tax codes) unless needed and, in attachments, to cover them: an example with the data covered is enough.

This section also serves as the privacy notice for the colleagues who are named: their data is used to understand how work moves between people and departments, it is processed for the same purpose, retained for the same periods and gives the same rights (sections 12.3, 12.7 and 12.9).

12.2 Taking part

• Answering is optional. Anyone who does not take part, or stops halfway, suffers no consequence from Martes AI.
• The answers are used to describe work processes, not to assess the person who describes them.
• The audit can be paused and resumed from the same link. The link contains a random code and is personal: whoever has it can open the answers, so it should not be forwarded.

12.3 Purpose and legal basis

We process the data to map the work processes of the company that requested the audit and estimate the time they take, in order to prepare a proposal of services for that company.

The legal basis is the legitimate interest of Martes AI and of the requesting company in assessing and designing the services the company asked for (Art. 6(1)(f) GDPR).

12.4 Who sees the answers

The requesting company has no access to the platform. Each person's answers, times and files are seen only by authorized Martes AI staff, from a restricted area with protected access.

To the company we present the processes that emerged and results aggregated by department or by process. We do not hand over the answers, times or files of any individual person.

12.5 Artificial intelligence

The platform's questions are generated by an artificial intelligence system. The same system reads the answers and the attachments to write the next question and fill in the record of each task.

We send the system the company's name and description, the role, the answers and the attachments. We do not send the person's first name, last name or email, nor the colleagues' data entered on the dedicated screen. The text of the answers, however, is sent as written: this is why we ask people not to enter other people's data unless needed.

From the attachments the system extracts only the facts useful to describe the work, with the instruction not to report names, licence plates, tax codes and addresses. When we combine the tasks described by several people of the same company, we send the system only the names and descriptions of the tasks, without the people.

The hours per year of each task are calculated with a fixed formula from the duration and frequency given by the person. The platform gives the person no assessment or score, and neither the system nor Martes AI takes decisions based solely on automated processing that produce legal effects concerning the person or similarly significantly affect them (Art. 22 GDPR).

The model is reached through OpenRouter (section 12.6). Every request admits only providers that do not retain the data sent (zero data retention) and do not collect it for other purposes, such as model training. Martes AI does not use this data to train artificial intelligence models.

12.6 Who we share the data with

The data is processed on behalf of Martes AI, as processors, by:

• Cloudflare, Inc., for the infrastructure the platform runs on, the database and the file storage, both created in the EU jurisdiction: the data remains stored in the European Union
• OpenRouter, Inc. (United States) and the provider that runs the model, chosen by OpenRouter among those with no data retention (the model currently used is by OpenAI), for the artificial intelligence processing described in section 12.5. These requests may be processed in the United States
• Resend, Inc. (United States), which relies on Amazon SES, for sending emails. If the person asks for the link to be sent again, Resend receives name, email and personal link. At the end of the audit it sends Martes AI a notice with the person's name, role and company, the number of tasks, the estimated hours per year and the names of the three heaviest tasks

Transfers to the United States follow section 5: the EU-US Data Privacy Framework (Art. 45 GDPR) for providers that adhere to it and, failing that, the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR). For information on the safeguards in place you can write to contact@martes-ai.com.

12.7 How long we keep it

• Attachments: deleted 90 days after the last activity on the audit (the last answer or the last uploaded file), whether the audit is finished or not. A file the person removes is normally deleted the following night.
• People, answers and task records: deleted 24 months after the last activity on the audit, whether the audit is finished or not.
• If the requesting company becomes a Martes AI client: answers and task records are kept for the duration of the contractual relationship. When it ends they are deleted, or when the 24 months from the last activity run out if that comes later.

12.8 Cookies and browser storage

The platform uses a single technical cookie, sessione, which lets the person resume the audit where they left off. It lasts 30 days.

In the browser storage it saves the choice between light and dark theme (auto-audit:tema, until it is cleared) and, only while the tab stays open, the text of an answer not yet sent (auto-audit:bozza:*).

It uses no analytics or profiling cookies and loads no resources from other sites. This is why it does not ask for consent. The details are also in the Cookie Policy.

12.9 Rights

The person who answers, and every colleague named, can request access to their data, rectification, erasure and restriction of processing by writing to contact@martes-ai.com.

Right to object. Everyone can object at any time, on grounds relating to their particular situation, to processing based on legitimate interest (Art. 21 GDPR), by writing to the same address.

The right to lodge a complaint with the Garante per la protezione dei dati personali remains (section 10).

13. Updates

This Privacy Policy may be updated to reflect regulatory changes or variations in the services offered. The date of the last update is indicated at the top of the page.