Privacy Policy
Last updated: September 13, 2026
This privacy policy describes how personal data of users of the website tuuning.ai and related services (the “Service”) is processed, in accordance with Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
1. Data Controller
TUUNING.AI S.R.L. SEMPLIFICATA
VAT: IT06239530873
Email: privacy@tuuning.ai
2. Data Collected
The Data Controller collects the following categories of personal data:
- Registration data: name, email address, password (cryptographic hash), avatar. If you use Google or Apple sign-in, we receive your name and email from the provider.
- Usage data: conversations with the AI assistant, uploaded files (images, documents), session metadata (date, time, duration).
- Technical data: IP address, browser type, operating system, pages visited, technical cookies and, with consent, analytics and marketing cookies.
- Payment data: payments are processed by Stripe, Inc. We do not store credit card data on our servers.
- Newsletter subscription data: email address, preferred language, date and IP address at the time of subscription and confirmation. This data is also collected from people without an account and serves to demonstrate the consent given.
3. Purposes and Legal Bases
| Purpose | Legal basis |
|---|---|
| Service delivery (account, AI chat, subscriptions) | Contract performance (Art. 6.1.b GDPR) |
| Security and abuse prevention | Legitimate interest (Art. 6.1.f GDPR) |
| Aggregate statistical analysis | Consent (Art. 6.1.a GDPR) |
| Direct marketing | Consent (Art. 6.1.a GDPR) |
| Tax and accounting obligations | Legal obligation (Art. 6.1.c GDPR) |
4. Data Recipients
Personal data may be shared with:
- Cloud service providers (hosting, database) located in the EU or countries with an adequacy decision.
- Stripe, Inc. for payment processing (GDPR-compliant via SCCs).
- Sendinblue SAS (Brevo), based in the EU, for sending email communications.
- AI providers for conversation processing. Messages are sent in pseudonymized form.
- Competent authorities, when required by law.
5. Extra-EU Transfers
Where data is transferred outside the European Economic Area, the Data Controller adopts appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission or verifies the existence of an adequacy decision.
6. Retention Period
- Account data: until the user deletes their account.
- Conversations and files: until account deletion or upon user request.
- Payment data: 10 years for tax obligations.
- Technical logs: maximum 12 months.
- Newsletter subscription data: until consent is withdrawn. Subscriptions not confirmed within 7 days lapse. Proof of consent and of its withdrawal is retained for as long as needed to demonstrate lawfulness.
7. Data Subject Rights
Under Articles 15-22 of the GDPR, you have the right to:
- Access your personal data
- Request rectification or erasure
- Restrict or object to processing
- Data portability
- Withdraw consent at any time
- Lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it)
To exercise your rights, contact us at: privacy@tuuning.ai
8. Newsletter and Marketing Communications
If you subscribe to the newsletter, we use your email address to send you product updates, tuning-related content and subscriber-only offers. The legal basis is your consent (Art. 6.1.a GDPR), given by submitting the subscription form.
Subscription uses double opt-in: after submitting the form you receive an email with a confirmation link, and until you use it no marketing communication is sent to you. The confirmation link is valid for 7 days.
You can withdraw your consent at any time, without giving reasons, through the unsubscribe link at the bottom of every email we send you, or by writing to privacy@tuuning.ai. Withdrawal does not affect the lawfulness of processing carried out before it.
Subscribing to the newsletter is optional and independent from your use of the Service: not subscribing, or unsubscribing later, does not limit any feature available to you.
9. Security
We adopt appropriate technical and organizational measures to protect personal data, including encryption in transit (TLS) and at rest, password hashing, role-based access controls, and regular backups.
10. Changes
The Data Controller reserves the right to modify this policy. The updated version will always be available on this page with the date of the last update.