Privacy Policy

Uploaded documents (PDF, DOCX, images) are temporarily processed in RAM and destroyed immediately after analysis. Before processing via AI, a Named Entity Recognition (NER) and regex system obfuscates personal data (names, addresses, emails, phones, financial data) locally in RAM. Data transit between client, server, and AI engines is fully protected using TLS 1.3 encryption (HTTPS), ensuring maximum safety against interception.

NakedPact does not store original documents (PDF, DOCX, images), which are processed in RAM and immediately destroyed. We only store final reports in the DB for sharing purposes. Anonymization of reports is irreversible and GDPR-compliant (personal data is replaced by generic placeholders). Storing the anonymized report is limited to 1 year and is operationally and technically necessary to ensure service continuity, allowing users to access and share their historical reports without re-uploading documents and avoiding repeated data processing cycles in RAM (minimizing processing cycles). As fully anonymized data (Recital 26 GDPR), they fall outside personal data. Nonetheless, upon user request sent via the contact form, the deletion of the anonymized report from our database will be immediate and permanent. The use of data transmitted to Anthropic or OpenAI for training, fine-tuning, or improvement of their AI models is absolutely excluded, under the signed Data Processing Addenda (DPA).

NakedPact processes data within the EEA (Germany). Transfers to third countries (such as the US for Anthropic and OpenAI AI engines) are covered by Standard Contractual Clauses (SCCs - Module 2) with supplementary measures (pre-anonymization in RAM and TLS 1.3 encryption), binding sub-processors to challenge non-EU access requests. Given the volatility of the US transfer legal context post-Schrems II, NakedPact continuously monitors the regulatory status and will suspend or redirect transfers if SCCs or adequacy decisions are revoked by the CJEU. Regarding Google profiling cookies, transfers are covered by Google's self-certification under the EU-US Data Privacy Framework (DPF), whose active status is monitored by NakedPact; in case of revocation or invalidation of the DPF, we will immediately deactivate third-party profiling cookies, without prejudice to NakedPact's independence from Google's infrastructure.

We adopt strict physical and logical security measures. In compliance with Art. 33 and 34 of the GDPR, in the event of a data breach involving a risk to user rights, NakedPact will notify the competent supervisory authority within 72 hours. If the breach involves a high risk to the rights and freedoms of individuals, we will also notify affected users promptly and directly via email (to the address provided during support or request) and publish a prominent security notice on the homepage. This communication will contain the nature of the breach, the DPO's contacts, the likely consequences, and detailed step-by-step instructions on protective measures users can take independently (such as changing credentials or disregarding suspicious communications).

You have the right to access, rectify, limit, oppose, port, and delete your data (DPO: [email protected]). We manage requests without delay and within 30 days (Art. 12(3) GDPR). Only in exceptional or particularly complex cases, the term can be extended by a maximum of an additional 30 days (for a maximum total of 60 days). In case of a deletion request (right to be forgotten), execution is immediate and in any case not exceeding 7 days, excluding such requests from any extension. To avoid discretion, we define the objective and exhaustive complexity criteria justifying the maximum 30-day extension for other requests: 1) access request involving multiple historical reports in different languages, requiring manual and individual verification by an operator to confirm correct NER masking; 2) requests requiring database queries for cryptographic hashes of documents where the user has lost the original sharing link; 3) exceptional volumes of concurrent requests (more than 5 requests in 30 days by the same data subject).

Our sub-processors include IONOS SE (Germany) and Anthropic/OpenAI (AI engines under SCCs with pre-anonymized data). In the event of changes in the regulatory scenario regarding transfers to third countries (such as the US), NakedPact will take immediate countermeasures, including suspending transfers, migrating AI services to providers based entirely within the European Economic Area (EEA), or adopting local open-source models. For any dispute regarding privacy or personal data processing, the applicable law is Italian law and the exclusive competent court is the Court of Benevento, without prejudice to the consumer's right to appeal to the authorities and courts of their place of residence in accordance with EU regulations.

NakedPact does not perform autonomous user profiling. We use technical cookies and third-party profiling cookies (such as Google) to deliver personalized advertisements. Consent for profiling cookies is collected explicitly and granularly (Art. 7 GDPR) through our tracking banner upon first access, allowing the user to reject them freely. For more details and to disable cookies, please refer to our complete Cookie Policy available at the page /cookies.