PERSONAL DATA PROTECTION NOTICE
These legal documents are drafted in Italian. The versions in other languages are courtesy translations: in case of any discrepancy, the Italian version prevails.
1. DATA CONTROLLER
The controller for the personal data collected through the Platforms (as defined in the Software's Terms and Conditions) is Living Off AI, with registered office at Via Francesco Paolo Bonifacio 203, 00156 Rome, Italy, VAT number 18074011000 (hereinafter the “Controller”). For any request concerning the processing of personal data, the data subject may contact the Controller at hello@livingoffai.com.
2. LOCAL PROCESSING OF DOCUMENTS AND DATA MINIMIZATION
This Notice is built on a simple principle: collect the minimum amount of personal data necessary to provide the Service, and nothing more. RedactForAI is designed so that the processing of Documents uploaded by the User takes place entirely and exclusively on the User's own device. The Controller never receives, views or stores the content of the Documents processed by the Software, nor the identifying information that may be redacted within them. For this reason, with respect to the Documents processed by the User, the Controller does not act as a data processor under art. 28 of Regulation (EU) 2016/679 (“GDPR”): the User remains the sole controller of any personal data contained in their own Documents, consistent with art. 5.3 of the Software's Terms and Conditions. The following sections therefore concern exclusively the personal data the Controller collects in connection with the download of the Software, the provision of the Service and the operation of the Platforms — not the content of the User's Documents.
3. DATA WE NEVER COLLECT
The Controller does not collect, receive or have access to: • the content of Documents uploaded or processed by the User through the Software; • the identifying information detected or redacted by the Software as part of the functionalities described in art. 5.2 of the Terms and Conditions (names, addresses, bank details, tax codes and similar data); • the content of the Private Folder or any other file saved locally by the User.
4. DATA COLLECTED THROUGH THE DOWNLOAD FORM
To download the Software, the User may be invited to fill in an electronic download form (the “Download Form”, as defined in the Terms and Conditions), on which occasion the Controller collects: • first and last name (or company name, if the User acts on behalf of a company); • e-mail address and, where provided, company affiliation; • any optional information about the User's professional profile, voluntarily provided under art. 6 of the Terms and Conditions.
5. DATA COLLECTED AUTOMATICALLY
In the course of using the Platforms, the Controller may automatically collect aggregated technical logs (for example: date and time of the Software's download or installation, installed version, automatically reported malfunctions), used exclusively for security, diagnostic and Service-improvement purposes. These technical logs never include the content of the User's Documents. The Software's website (redactforai.com) may also use technical cookies necessary for the website to function, as well as any analytics cookies in aggregated form. Detailed information on these tools is available in the dedicated Cookie Policy published on the website.
6. PURPOSES AND LEGAL BASES OF PROCESSING
The Controller processes the User's personal data for the following purposes and on the following legal bases under art. 6 GDPR: • management of the download and provision of the Software — legal basis: performance of the contract (art. 6(1)(b) GDPR); • technical support and responses to User requests — legal basis: performance of the contract and the Controller's legitimate interest in ensuring the proper functioning of the Service (art. 6(1)(b) and (f) GDPR); • IT security and prevention of fraud or unlawful use of the Software — legal basis: legitimate interest of the Controller (art. 6(1)(f) GDPR); • compliance with legal obligations (e.g. accounting, tax) — legal basis: legal obligation (art. 6(1)(c) GDPR); • communications regarding any Premium Services or product updates — legal basis: the User's specific consent (art. 6(1)(a) GDPR), which may be withdrawn at any time.
7. PROCESSING METHODS AND SECURITY MEASURES
Personal data collected through the Platforms is processed using IT tools, adopting technical and organizational measures appropriate to ensure a level of security commensurate with the risk, pursuant to art. 32 GDPR, including data encryption and restricted access to data limited to authorized personnel.
8. DATA RETENTION
Personal data collected through the Download Form is retained for the entire duration of the contractual relationship with the User and, after its termination, for the period necessary to comply with legal obligations (including tax and accounting obligations) or to establish, exercise or defend a legal claim, and in any event for no longer than 10 (ten) years from termination of the relationship. The aggregated technical logs referred to in art. 5 are retained for a maximum period of 12 (twelve) months, unless a different period is required for security or regulatory reasons.
9. DISCLOSURE AND TRANSFER OF DATA TO THIRD PARTIES
The User's personal data may be disclosed to third parties that carry out outsourced activities on behalf of the Controller, such as the provider of the hosting and backend infrastructure for the website and the Download Form (Lovable Cloud / Supabase) and any e-mail delivery service providers, appointed as data processors under art. 28 GDPR where applicable. These parties process the data exclusively for the purposes indicated above and within the limits of the instructions received from the Controller. Personal data is never sold to third parties, nor used for advertising profiling purposes.
10. TRANSFER OF DATA OUTSIDE THE EEA
Where any of the providers referred to in art. 9 are located outside the European Economic Area, the transfer of personal data takes place on the basis of an adequacy decision of the European Commission, or through the adoption of the Standard Contractual Clauses approved by the European Commission, or another appropriate safeguard under Chapter V of the GDPR.
11. DATA SUBJECT RIGHTS
With respect to the processing of their personal data, the User may exercise, against the Controller and within the limits set out in arts. 15-22 GDPR, the following rights: • the right to access their personal data (art. 15 GDPR); • the right to rectification of inaccurate or incomplete data (art. 16 GDPR); • the right to erasure (“right to be forgotten”), within the limits set out in art. 17 GDPR; • the right to restriction of processing (art. 18 GDPR); • the right to data portability (art. 20 GDPR); • the right to object to processing based on the Controller's legitimate interest (art. 21 GDPR); • the right to withdraw, at any time, any consent given, without affecting the lawfulness of processing carried out before the withdrawal (art. 7(3) GDPR). These rights may be exercised by sending a request to hello@livingoffai.com. The Controller will respond to the request without undue delay and, in any event, within one month, which may be extended by a further two months in the event of particular complexity.
12. COOKIES AND TRACKING TECHNOLOGIES
The Software's website uses only technical cookies necessary for the website to function and, where present, analytics cookies in aggregated and anonymized form. The Software installed locally on the User's device does not use cookies or equivalent tracking technologies. Detailed information on the type, purpose and duration of the cookies used by the website is available on the Cookie Policy page available at redactforai.com.
13. MINORS
The Software and the Platforms are not directed at individuals under 18 years of age. The Controller does not knowingly collect personal data from minors and, should it become aware of having collected data from a minor without the consent of the holder of parental responsibility, it will delete such data.
14. CHANGES TO THIS NOTICE
The Controller reserves the right to amend this Notice at any time, by publishing the updated version on the Platforms with an indication of the last update date. Users are invited to periodically review this page.
15. COMPLAINTS AND SUPERVISORY AUTHORITY
Without prejudice to any other administrative or judicial remedy, a data subject who believes that the processing of their personal data infringes applicable law has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), located at Piazza Venezia n. 11, 00187 Rome, Italy, or with the supervisory authority of their Member State of habitual residence, place of work or place of the alleged infringement.
16. CONTACT
For any question regarding this Notice or the processing of personal data, the User may contact the Controller at hello@livingoffai.com. Last updated: July 26, 2026