Privacy Notice

English

1. Data controller

The controller is Giandomenico Azzone, Bari, Italy. For privacy requests, withdrawals or deletion requests, email info@getsosia.ai.

2. Data we collect

We collect your email address, business type, optional activity details when you select other, language, consent status and version, request time and newsletter and service-email delivery status. Activity details are stored in the site database and included in the notification sent to the controller through Resend; they are not stored as newsletter contact properties or repeated in your confirmation email. The access request is also synchronised with the SOSIA platform for review by authorised operators. Historical names remain with the corresponding request. We do not store your IP address in clear text: short-lived, keyed identifiers are used solely to limit abuse, expire within one hour and are removed by automatic maintenance. These identifiers are excluded from backups.

Cloudflare Turnstile processes browser and connection signals used to identify automated abuse. These may include your IP address, user-agent, TLS fingerprint, site key and page origin. It does not receive the name or email you enter in this form. Cloudflare also processes these signals under its own notice to operate and improve bot detection. See the Cloudflare Turnstile Privacy Addendum.

When you choose a language manually, we store a first-party functional cookie named sosia_locale for up to 12 months so the site can remember that choice. It contains only it or en and is not used for analytics, advertising or profiling.

3. Purposes and legal basis

We process your data to:

• manage your SOSIA access request, notify the controller, send you a neutral confirmation and, after operator approval, invite you to the platform in your chosen language;
• subscribe you to the SOSIA newsletter through Resend and share service news and access updates, in your selected language.

Handling your access request and its service emails is necessary to take steps at your request before entering into a contract under Article 6(1)(b) GDPR. Newsletter enrollment and updates rely on your consent under Article 6(1)(a). Providing data is optional, but without it we cannot process the request. The first fresh request after activation generates one confirmation and one internal notification; retries do not send them again. The confirmation does not create an account or certify newsletter enrollment. Only an authorised operator can grant access and issue the separate welcome invitation. Prior unsubscribe preferences are preserved. Unexpired historical requests may be recovered into the operational queue without a new newsletter subscription, account or notification.

We use Turnstile on the basis of our legitimate interest under Article 6(1)(f) GDPR in protecting the form and service from abuse. This technical security processing is separate from your consent to join the waitlist and receive updates.

4. Recipients and international transfers

Access is limited to the controller, authorised SOSIA operators and service providers: Sites and Cloudflare host the site, database, security services and private encrypted backups; Resend manages newsletter contacts and delivers service emails. Resend receives email, business type and language for newsletter contacts, and the recipient, message content and delivery metadata for service emails. The internal notification includes optional activity details and uses your address as Reply-To; the controller receives it at info@getsosia.ai. Consent evidence stays in the site database. We do not sell data or disclose it for third parties’ commercial purposes. Transfers outside the EEA rely on an adequacy decision or appropriate GDPR safeguards.

5. Retention

We retain waitlist data until you withdraw consent and, in all cases, for no longer than 12 months from registration. Automatic daily maintenance removes expired records after provider cleanup and deletes the related notification records. Expiry or deletion also scrubs personal data from access-request copies in the site and platform; technical identifiers remain to prevent deleted requests from reappearing. Newsletter opt-out does not cancel a separate access request. A fresh request can renew newsletter consent only if there is no existing opt-out. Webhook receipt IDs are retained for 30 days. Private encrypted recovery backups expire after 30 days and are not used for marketing; deletion requests and current unsubscribe choices must be reapplied before restored data is used. The controller includes notification copies in the mailbox and provider in the retention and deletion procedure. Messages retained in your own mailbox remain under your control. Activated account data and separate services follow their own notices.

6. Your rights

You may request access, correction, deletion, restriction or portability, object where applicable, and withdraw consent at any time by emailing info@getsosia.ai. You may also unsubscribe using the link in each newsletter. Previous unsubscribe preferences are respected and are not reset by retrying this form. Withdrawal does not affect processing already carried out. You may also lodge a complaint with the Italian Data Protection Authority.

7. Profiling, tracking and minors

We do not sell your data, profile you, or make decisions producing legal or similarly significant effects. Turnstile is used for technical bot detection; Cloudflare processes the security signals described above under its own notice. Landing statistics require prior consent and are described in the following section. The waitlist is not directed to minors; contact us if you believe a minor submitted personal data.