Privacy policy

The controller is Raffaele Gacioppo, registered at Via Enrico Berlinguer 73, 47854 Montescudo-Monte Colombo (RN), Italia, VAT number 04518190402 ("we", "us"). For any privacy question write to [privacy email].

We have not appointed a data protection officer (DPO), because the law does not require one for our activity: the controller answers directly, at the same address.

This policy applies to the wpbuildora platform, to the WordPress plugin and theme and to the emails we send you. It follows the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Italian Privacy Code; at the end you'll find the extra parts for people living in Brazil and in the United States.

• Account: name, email, company name if you provide it, chosen language, password (stored only in non-reversible encrypted form), date you accepted the terms.
• Subscription and payments: plan, status, dates, credits and their transactions, invoices, your Stripe customer code. Card details are handled by Stripe: we don't see them.
• Content: conversations with the assistant, messages, attachments and images you upload, sites you point to as a reference, generated pages and content.
• Connected sites: the site's address and name, the connection key (stored encrypted), the site's content and settings that the builder reads or writes.
• Connected apps: which apps you've connected and the actions the builder took at your request. Access to the apps is held by our provider Composio.
• Personal AI key, if you use one: stored encrypted, used only for your requests.
• Support: tickets, messages, attachments and conversations with the support chat.
• Technical data: IP address, browser type, date and time of requests and errors, collected by the servers to run the service and protect it.
• Cancellation and withdrawal requests: what you asked for and when, and our confirmation.

We don't ask you for special categories of data (such as health or political opinions): don't put them in conversations unless your site needs them.

• Providing the service you asked for: account, builder, assistant, connected sites and apps, support, service emails. Basis: the contract (art. 6(1)(b) GDPR).
• Payments, invoices and tax and accounting obligations. Basis: the contract and legal obligations (art. 6(1)(b) and 6(1)(c)).
• Security, prevention of abuse and fraud, and defending our rights. Basis: our legitimate interest in protecting the service and its users (art. 6(1)(f)).
• Improving the service with aggregated usage data, for example which features produce the most errors. Basis: our legitimate interest (art. 6(1)(f)). You can object by writing to us.
• Responding to authorities when the law requires it (art. 6(1)(c)).

We don't send you advertising and we don't sell your data. If one day we wanted to send you newsletters, we would first ask for your separate consent.

Providing your account details is necessary for the contract: without them, we can't provide the service.

To generate replies, pages and images we send the artificial intelligence providers (OpenAI and Anthropic) the messages, materials and parts of the site needed for that request. These providers process them on our behalf and, under their contracts, do not use them to train their models. We don't use your content to train models either.

The service does not make automated decisions that produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR): the assistant proposes, and the choices are yours.

We use providers that process data on our behalf (processors), under a contract that requires them to protect it and use it only for the service:

• Render Services, Inc. (Frankfurt, EU): the platform's servers and database.
• Stripe: payments, invoices, currency conversion and tax calculation. For fraud prevention and financial obligations Stripe also acts as an independent controller, under its own policy.
• OpenAI and Anthropic: the assistant's artificial intelligence models.
• Composio: the connection with other providers' apps that you choose to connect.
• [email provider]: sending the service's emails.

Data also goes to your WordPress site, because that's where the builder writes, and to the apps you connect, when you ask the builder to use them. We may disclose data to authorities when the law requires it, or to advisers (for example our accountant) bound by professional secrecy.

Some providers (OpenAI, Anthropic, Composio, Render and partly Stripe) are based in the United States. Transfers go to providers certified under the EU-US Data Privacy Framework or, if they aren't, use the standard contractual clauses approved by the European Commission (art. 46 GDPR), with the additional measures needed. You can ask us for a copy of the safeguards by writing to [privacy email].

• Account and content: as long as the account exists. If you delete it, you have 30 days to change your mind; then we delete account, conversations, connected sites and credits from the service. Pages already written stay in your WordPress, which is yours.
• Invoices and accounting data: 10 years, as required by Italian law (art. 2220 of the Civil Code).
• Support tickets: as long as the account exists.
• Cancellation and withdrawal requests: for as long as they might be needed to prove what happened, at most 10 years.
• Server technical data: for the time needed for security and troubleshooting, normally no longer than 12 months.

At any time you can ask us to:

• access your data and get a copy;
• correct it if it's wrong;
• erase it;
• restrict its processing;
• receive it in a readable format and take it elsewhere (portability);
• object to processing based on our legitimate interest.

Many things you can do yourself in Account settings: correct your profile and email, download your data and delete your account. For everything else write to [privacy email]: we reply within one month.

If you think we're processing your data incorrectly, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of the country where you live or work.

Connections are encrypted (HTTPS). Passwords are stored in non-reversible encrypted form; connection keys and personal AI keys are encrypted. Access to data is limited to those who need it for their work, and administrators' access to conversations is logged. If a data breach that puts you at risk ever happens, we'll tell you without undue delay.

The service is reserved for people aged at least 18. We don't knowingly collect data from minors: if you think a minor has given us data, write to us and we'll delete it.

We also process your data in accordance with the Lei Geral de Proteção de Dados (Law 13.709/2018). The legal bases are performance of the contract (art. 7, V), legal obligations (art. 7, II) and legitimate interest (art. 7, IX). Our encarregado (data protection officer) can be contacted at [privacy email]. You have the rights of art. 18 of the LGPD, including confirmation of processing, access, correction, anonymisation or deletion of unnecessary data, portability and information about who we share it with; you can also contact the ANPD. International transfers take place with the safeguards provided by the LGPD (art. 33), including standard contractual clauses.

We collect the categories of data described above (identifiers, commercial information such as purchases and subscription, usage data and the content you give us) for the purposes described above. We do not sell your personal information and do not share it for cross-context behavioral advertising. Depending on the state you live in (for example California), you have the right to know what data we hold, to get a copy, to correct it and to delete it, without being treated differently for asking. To exercise these rights write to [privacy email]; we may ask you to confirm your identity.

We only use technical cookies, necessary for the service to work: the details are in the Cookie policy.

If we change this policy in an important way we'll tell you by email or in the platform before it takes effect. At the top of the page you'll find the date of the last update.