English translation for convenience; the Italian version prevails.

Privacy policy

Last updated: 5 November 2026

Data controller

Norphis SRL, Via Amendola 88, 18100 Imperia (IM), VAT no. IT01810220085, which operates under the Ordito Studio brand. Contact: ordito@norphis.it, certified email (PEC) norphis.srl@pec.it.

What data we process and why

• Estimate request: name, email, business, role, phone and the description of the project. We use them to prepare the assessment and reply to you (pre-contractual measures, Art. 6(1)(b) GDPR). The description is also processed with an artificial intelligence service (Anthropic), which processes it on our behalf and does not use it to train its models.
• Video call request: name, business, phone or email and the time you prefer, with the page you came from. We use them to set up the video call (pre-contractual measures, Art. 6(1)(b) GDPR) and keep them for 24 months if you do not become a client.
• Private area and contracts: login data, company data for the contract and invoicing, electronic signature with date, time, IP address and device, messages and requests. Legal basis: performance of the contract (Art. 6(1)(b)) and legal obligations, including tax obligations (Art. 6(1)(c)).
• Technical access for maintenance: credentials for the project's services, stored encrypted and accessed only for maintenance, with a log of every access (Art. 6(1)(b)).
• Optional communications: only if you have given your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Businesses we contact first: from public sources (Google Maps and the business's website) we collect only business data, that is the name of the business, category, address, phone, website and email published by the business, and the aggregate rating and number of reviews, in order to offer our B2B services by email, WhatsApp message or phone call, with a demo prepared for the business. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). On the presentation prepared for the business (the page behind the link) we measure, with our own server and without profiling cookies or external services, how many times it is opened, how long it stays open, which parts are viewed and whether the app is tried, to understand whether the topic is of interest and to decide whether and how to write once more. We do not measure whether emails are opened. You can object at any time by replying NO, through the link at the bottom of every email or by writing to ordito@norphis.it: we will not contact you again and we keep only the address, to remember it.
• Security: IP address and technical logs to prevent abuse (legitimate interest, Art. 6(1)(f)).
• Advertising measurement: only if you accept Meta's cookies, the request event and the signed contract event are also sent to Meta with encrypted email and phone, to measure our advertising (consent, Art. 6(1)(a), which you can withdraw from the cookie page). In the same way, only if you accept Google's cookies, we send Google Ads the identifier of the ad click you arrived from when you request an estimate or a video call or sign a contract, with the value of the contract, without name, email or phone.

How long we keep data

Requests that do not become a project: 24 months. Contracts, signatures and tax documents: 10 years, as required by law. Technical logs: 12 months. Technical access credentials are returned or deleted within 15 days of the end of maintenance.

Who processes data with us

Infrastructure and service providers, appointed as data processors: Vercel (hosting), Supabase (database, in the EU), Google Workspace (email), Anthropic (artificial intelligence). With your consent, Meta Platforms Ireland and Google Ireland (Google Ads) for advertising measurement. Some of them are based in the United States: the transfer takes place under the European Commission's standard contractual clauses or through participation in the Data Privacy Framework.

Your rights

You can request access, rectification, erasure, restriction and portability, and you can object to processing, by writing to ordito@norphis.it. You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).

Cookies

Technical cookies and, only with your consent, Meta's and Google's cookies. Details and choices on the cookie page.