Privacy Policy

1. Data controller

The data controller is:

• Company name: Stratosfera S.r.l.
• Registered office: Via Vincenzo Monti, 11, 20123, Milano MI
• VAT number: 11809210963
• Tax code (codice fiscale): 11809210963
• REA (Economic and Administrative Index) number: MI-2625712
• Certified email (PEC): stratosfera@legalmail.it

Any request concerning the processing of personal data or the exercise of the rights provided for by the GDPR may be sent to the certified email (PEC) address above.

2. Types of data collected

R-Set processes the following categories of personal data:

• Contact and identification data: first name, last name, email address and telephone number, provided when requesting access and registering.
• Company data: company name, VAT number, business sector, company size and the user's role within the company.
• Authentication data: login credentials (passwords stored in encrypted form) and temporary OTP codes, managed through Supabase Auth.
• Uploaded financial documents: financial statements and company registry extracts (visure camerali) in PDF format uploaded by the user to the platform.
• Extracted data: structured financial information (balance sheet and income statement items, KPIs) automatically extracted by AI from the uploaded documents.
• Usage data: history of the simulations carried out (forecast, budget and decision-scenario analyses), and the inputs and results of the processing.
• Cookie preferences: choices regarding cookies stored on the user's device.
• Technical logs: IP address, user agent and service access logs, kept for security and diagnostic purposes.

3. Purposes of the processing

The data collected is used to:

• Manage users' access requests, registration and authentication.
• Provide the platform's services: automatic extraction of data from the uploaded documents, quantitative simulations, assessment of the impact of decisions on the prospective credit rating and benchmark comparisons.
• Manage transactional communications with the user (emails approving or rejecting the access request, login OTPs, support requests).
• Ensure the security of the platform and prevent abuse.
• Comply with legal obligations.

4. Legal basis for the processing

Personal data is processed on the basis of:

• Performance of a contract (Art. 6(1)(b) GDPR) for the provision of the platform's services, including the AI processing applied to the documents and financial data provided by the user.
• Consent (Art. 6(1)(a) GDPR) for cookies that are not strictly necessary and for any further purposes not related to the performance of the contract.
• Legal obligations (Art. 6(1)(c) GDPR) for the retention of data required by applicable law.
• Legitimate interest (Art. 6(1)(f) GDPR) to ensure the security of the platform and prevent abuse.

5. Third-party services

R-Set uses the following providers, who act as data processors (or sub-processors) pursuant to Art. 28 GDPR:

6. Automated processing and artificial intelligence

R-Set uses Google's generative artificial intelligence models (Gemini family) for two features:

• Extraction of data from documents: the uploaded financial statements and company registry extracts are sent to the model, which extracts their economic, financial and company information in structured form. The user undertakes not to upload special categories of personal data within the meaning of Art. 9 GDPR, except where strictly necessary and lawful.
• Decision simulations: the extracted financial data is used as context to generate quantitative projections of the impact of the scenarios hypothesised by the user.

The data sent to the model is not used by the provider to train public models. The results produced by the artificial intelligence models are merely forecasts intended to support the user's decisions and do not constitute official ratings, financial advice or binding automated decisions within the meaning of Art. 22 GDPR: every result is a tool supporting a decision that remains with the user.

7. Transfers outside the EU

Data is processed by the artificial intelligence models within the European Union, through Google Cloud's European endpoint. The provider Google, listed in section 5, is based in the United States: any access to the data by the provider from outside the European Union takes place on the basis of the Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Art. 46 GDPR, or where an adequacy decision is in place (e.g. the EU-U.S. Data Privacy Framework). Additional technical and organisational measures are adopted to ensure an adequate level of protection.

8. Data retention

Personal data and the financial information uploaded or extracted are kept for the entire duration of the contractual relationship with the user and, thereafter, for the time strictly necessary to comply with legal or tax obligations or to protect the controller's rights.

If the account is deleted, the data will be deleted or anonymised within a reasonable period, unless retention is required by law or is necessary for the defence of legal claims.

Technical logs are kept for a maximum of 90 days for security and diagnostic purposes.

9. Rights of the data subject

Under Articles 15 to 22 GDPR, the user has the right to:

• Access their personal data (Art. 15)
• Request the rectification of inaccurate data (Art. 16)
• Request the erasure of their data (Art. 17)
• Restrict the processing (Art. 18)
• Object to the processing (Art. 21)
• Request data portability (Art. 20)
• Withdraw their consent at any time
• Lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali)

To exercise these rights, please write by certified email (PEC) to stratosfera@legalmail.it. Requests are handled within the time limits set by applicable law.

10. Data security

R-Set adopts appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, loss or alteration. In particular:

• Encrypted communications via TLS/HTTPS.
• Encryption of data at rest at the database provider (Supabase).
• Data isolation policies by role and by tenant (Row-Level Security).
• Irreversible hashing of passwords and separate management of service credentials.
• Access to data limited to strictly necessary staff.

11. Cookies

For detailed information on the use of cookies, please see the Cookie Policy.

12. Changes to this notice

R-Set reserves the right to update this notice to reflect changes in legislation or technological or organisational developments. Updated versions will be published on this page together with the date of the last update.