Privacy & Cookies Policy

3.1. Purpose of the service

Navisio AI is an artificial-intelligence solution designed for professionals in the insurance sector. Its function is to compare the different policies available on the market in order to identify the one best suited to the consumer’s needs.

It is a minimal-risk AI system under the AI Act, as it has no actuarial database for risk-assessment activities.

3.2. Data processed

To answer queries, the data that the user enters in the questions (so-called “prompts”) and in the documents uploaded with them are processed first. This information is then cross-referenced with two collections of documents:

• Public Archive: a collection of documents selected by the company and made available to all customers. It contains no personal data: only general contract terms and insurers’ information sets.
• Private Archive: a section where the customer, whether a broker or an agent, can upload documents to improve the database available to the AI. In this case the storage space is dedicated to the user and is not shared with other customers, in compliance with confidentiality and professional secrecy.

The data needed to activate the account (first name, last name and email) and the personal details needed for accounting and payments are also processed.

3.3. Roles

It is important to note that Nano I-Tech S.r.l. acts both as an independent controller and as a processor of personal data. In particular:

• it is an independent controller for the technical development of the product, the improvement of the Public Archive and the administrative management of the relationship;
• while it is a processor, under Article 28 GDPR, for the management of prompts and of the Private Archive.

This section focuses mainly on processing as an independent controller. For the obligations of the processor, please refer to the data processing agreement (DPA) signed when the contract is activated.

3.4. Training

The contractual terms with sub-suppliers explicitly exclude prompts from the training of the artificial intelligence models (Gemini and Mistral).

Nano I-Tech S.r.l. also carries out fine-tuning only on anonymised data, excluding not only personal data but also confidential information and anything covered by professional secrecy.

3.5. Automated processing

Since the product is based on artificial intelligence, the system by its nature offers only automated processing. However, its outputs cannot have direct consequences for data subjects: they are always submitted to a human operator, who must review them before using them. They therefore do not constitute decision-making processes in the strict sense.

In particular, there is no automatic link between the artificial intelligence and the portals for activating policies.

3.6. Transfer of data to third parties

The data contained in Navisio AI prompts and archives are processed on European servers only. On request, the company provides a full list of the third-party services used.

3.7. Retention

Users can delete their search history and the documents in their private archive at any time, directly from the platform.

If they do not, all data will be deleted within 30 days of the end of the licence. The data will also be permanently removed from backups within the following 180 days.

3.8. Legal bases

For the purposes described above, as regards Navisio AI, the legal bases under Article 6 GDPR are:

• the performance of a contract (point b) for the data needed to activate accounts;
• and legal obligations (point c) for the administrative and accounting management of the relationship.

All other data handled through Navisio AI are processed by Nano I-Tech as a processor.

3.9. The Navisio app for iOS and Android

The Navisio app gives users already enabled by their organisation access to Navisio AI from their phone: it does not allow accounts to be created or services to be purchased. The rules of the previous sections apply, with the following details.

• Sign-in: authentication uses the same sign-in page as the web platform, operated by the provider Auth0 on European servers. The session credentials stay on the device, in the operating system’s protected storage (Keychain on iOS, Keystore on Android).
• Unlock with Face ID or fingerprint: biometric recognition is performed by the device’s operating system. Nano I-Tech neither receives nor stores biometric data.
• Camera, photos and files: the app accesses them only when the user chooses to attach a document. Attached documents are processed like those uploaded from the web platform (section 3.2).
• Data on the device: conversations and lists stay in the app’s memory for the duration of the session and are deleted when the user signs out. Documents opened or attached in the app are saved temporarily in the app’s cache on the device: they are deleted when the user signs out or the session expires, and in any case within 24 hours.
• Crash reports: when the app encounters an error, it sends a technical report (type of error, device model, operating system and app versions, a pseudonymous user identifier) to the Sentry service, which keeps it in the European Union for up to 90 days. Reports do not contain the text of conversations, documents, or the user’s name or email address.
• Updates: the app downloads its updates from the Expo service (EAS Update), sending technical data such as IP address, platform and app version. The data may be processed by providers located in the USA, under the protection of the EU standard contractual clauses and the Data Privacy Framework.
• Advertising and tracking: the app contains no advertising, does not use the device’s location and does not track the user across third-party apps or websites.
• Demo request: people without an account can request a demo from the app. The name and email address entered are sent to the HubSpot CRM, as with the website’s contact form (section 4.4).

The legal bases are the performance of a contract (point b) for the operation of the app and access to the account, and legitimate interest (point f) in the security and proper functioning of the service for crash reports.

Account deletion: users can ask for their account to be deleted, from the app or from the web platform, by writing to support@navisio.ai from the email address they sign in with. Within 30 days the account is deactivated and the data for which Nano I-Tech is controller (first name, last name and email) are deleted. Conversations and documents, processed on behalf of the user’s organisation, follow that organisation’s instructions and section 3.7.

4.1. Insurance mediation

Nano I-Tech is also active in insurance mediation. A dedicated portal has been set up for this activity, with its own privacy notice, available here.

4.2. Commercial emails and calls

Nano I-Tech’s marketing campaigns are aimed at companies and businesses, as these are B2B negotiations. There is no marketing to consumers.

In this context, the names of a contact person may be processed. In that case only business email addresses, connected to the person’s job, are processed.

The legal basis is legitimate interest, under Article 6(1)(f) of EU Regulation 2016/679. The data collected are kept for two years from the last interaction.

The data may be processed by providers located in the USA, under the protection of the EU standard contractual clauses and the Data Privacy Framework.

4.3. Call recording

For convenience in taking notes, Nano I-Tech uses software that records and transcribes video calls. The tool is always visible during the call and announces its presence. It is possible to ask for it to be excluded at any time.

The legal basis is the data subject’s implied consent, under Article 6(1)(a) GDPR. Recordings are kept for 30 days, while the notes become part of the contact’s record.

The data may be processed by providers located in the USA, under the protection of the EU standard contractual clauses and the Data Privacy Framework.

4.4. Website users

Nano I-Tech S.r.l. has two websites, each with its own privacy notice.

As relevant here, the website on which this notice is published tracks IP addresses for the session and the information entered in the contact form. The legal bases are:

• negotiations and the need to perform the contract (point b) as regards the contact form;
• legitimate interest (point f) for processing the IP addresses of website users;
• and consent (point a) for profiling cookies, listed in the relevant section.

Information on ongoing negotiations, especially where a contract has been concluded, is kept for 10 years from the last interaction. For cookies, please see the last section.

The data may be processed by providers located in the USA, under the protection of the EU standard contractual clauses and the Data Privacy Framework.

4.5. Social networks

The company also has social media pages, through which users’ interests are tracked and data subjects can fill in a contact form. In this context, the legal bases are:

• negotiations and the need to perform the contract (point b) as regards the contact form;
• while for likes and follows, the data subject’s consent under Article 6(1)(a) GDPR, tacitly given by liking or following the page. Removing the like or unfollowing the page amounts to withdrawing consent.

Data on negotiations that were not concluded are kept for 2 years. Data on likes and follows are kept by the social media page until the user removes them.

The data may be processed by providers located in the USA, under the protection of the EU standard contractual clauses and the Data Privacy Framework.

4.6. Employee management

The personal data of employees are processed. This includes personal details, contact details, bank details for payments and health information for managing leave and absences as required by law. In this context, the legal bases are:

• on the one hand, negotiations for entering into the contract and, after signing, the management of the relationship and the coordination of work shifts, under Article 6(1)(b) of EU Regulation 2016/679;
• and, on the other hand, legal obligations regarding accounting and the management of employees, under Article 6(1)(c) of EU Regulation 2016/679.

The processing of special categories of data is justified by the need to comply with employment-law obligations, including health surveillance by the occupational physician, under Article 9(2)(b) and (h) of EU Regulation 2016/679.

The information is processed for 10 years after the end of the employment, as it is needed to keep the accounting records and the Libro Unico del Lavoro (LUL, the single employment register). It is also passed on to sub-processors such as the accountant and the payroll office, and to the competent bodies (INAIL, INPS and the Agenzia delle Entrate).

The data may be processed by providers located in the USA, under the protection of the EU standard contractual clauses and the Data Privacy Framework.

4.7. Relations with suppliers

The data of suppliers and self-employed workers are also processed: personal and contact details for managing the relationship.

For companies, processing concerns the information of the legal representative and of the staff responsible for entering into the contract. For natural persons, it concerns the information of the data subject. For these purposes the legal bases are:

• on the one hand, negotiations for entering into the contract and, after signing, the management of the relationship, under Article 6(1)(b) of EU Regulation 2016/679;
• and, on the other hand, legal obligations regarding accounting and invoicing, under Article 6(1)(c) of EU Regulation 2016/679.

The information is processed for 10 years. It is also passed on to sub-processors such as the accountant and the accounting software, and to the competent public bodies, for example the Agenzia delle Entrate.

The data may be processed by providers located in the USA, under the protection of the EU standard contractual clauses and the Data Privacy Framework.

4.8. Assignment of devices and accounts

The company may assign devices and accounts to employees and external professionals where this is necessary for the contractual relationship.

These accounts and devices are for professional use only. They may not be used for anything other than the relationship with the company.

The company may also access and monitor the devices remotely, including after the end of the relationship.

At the end of the collaboration, accounts are disabled within 7 days and permanently deleted within the following 60 days. Backup copies of the data are, however, kept for defensive checks and legal defence.