Privacy policy

In the event of any discrepancy, the Italian version prevails. Read the Italian version

In brief

We use your data only to reply to you, for the contract and for legal obligations.
No sale of data, no profiling, no marketing cookies.
The data you upload to Graphorum is yours: there, we are only the processor.
Your data never trains anyone else's AI models.
Write to [email protected] for any right.

Who the data controller is

The controller of the data described in this notice is:

Controller: AM Solutions di Vera Alexandru Nicolae
Legal form: Sole proprietorship
Registered office: Via Potenza 12, 25125 Brescia (BS)
VAT number: 04419500980
Tax code: VRELND86B24Z129Y
Email: [email protected]
Website: www.amsolutionsbs.it

For any privacy question, or to exercise your rights, write to [email protected].

What this notice covers

This notice applies to processing where AM Solutions decides why and how data is processed, that is, when it is the controller:

browsing the graphorum.com site, including the live demo;
requests sent through the “Support and suggestions” form or by email;
registration, purchase, payment and invoicing of the Local PC and Cloud plans;
support, maintenance, on-site visits and technical management of installations;
customer accounts and platform security.

What data we process

Browsing data. IP address, date and time, page requested, browser and operating system, recorded automatically by the servers and the Cloudflare network to run and protect the site.
Request data. Type of request, first and last name, email, company, phone, chosen plan and the text of the message. If you request an on-site visit, also the address and times you give.
Registration and purchase data. Identification and tax details (company name or name, VAT number or tax code, registered office, e-invoicing recipient code or certified email (PEC)), contact persons, installation address, plan, subscription, payment and invoice history.
Payment data. Stripe collects it directly: we neither see nor store the full card number or bank credentials, only the outcome, amount, date and the last characters needed to recognise the payment method.
Support data. Ticket contents, date and duration of interventions, support access to your platform (always recorded in your instance's log).
Account and security data. Username, email, two-step verification settings, sign-in log.
Technical installation data. Every installation sends our console a signed signal with its version, health status, disk space, model status and number of users. Never the content of emails, chats, documents or the brain.

Why we process them, on what basis and for how long

Purpose	Legal basis (art. 6 GDPR)	Retention
Answering requests for information and sales questions	Pre-contractual measures requested by you (point b)	24 months from the last contact, if you do not become a customer
Reading and assessing suggestions	Legitimate interest in improving the product (point f)	24 months
Registration, activation, installation, maintenance and support	Performance of the contract (point b)	Duration of the contract and 10 years after it ends (art. 2946 of the Italian Civil Code)
Electronic invoicing, accounting and tax obligations	Legal obligation (point c)	10 years (art. 2220 of the Italian Civil Code and tax rules)
Payments, non-payment notices, suspension and reactivation	Performance of the contract (point b) and legitimate interest in collecting payment (point f)	Duration of the contract and 10 years after it ends
Security of the site and the platform, prevention of abuse and spam (filters, rate limits, honeypot field in the form)	Legitimate interest in security (point f)	Technical site logs for up to 90 days, unless an incident is being investigated
Technical monitoring of installations (the signed signal)	Performance of the contract (point b)	Duration of the contract
Service communications (invoices, notices, important updates)	Performance of the contract (point b)	Duration of the contract
Defending our rights in the event of disputes	Legitimate interest (point f)	For as long as necessary, within the limitation periods

At the end of the periods stated, data is deleted or anonymised. Backup copies rotate and delete themselves within 30 days.

Next to the form's button you'll find the link to this policy: we don't ask for your consent, because replying to a request of yours doesn't need it (art. 6(1)(b)). We don't sign you up to any newsletter. If one day we offer you promotional communications, we will do so only with your consent or, if you are already a customer, for services similar to those you use (art. 130(4) of the Italian Privacy Code), with the option to object at any time, free of charge.

What happens if you do not give us the data

Fields marked as required are needed to reply to you or to conclude the contract: without them, we cannot do so. The others are optional.

Automated decisions and artificial intelligence

We do not take decisions based solely on automated processing that produce legal effects or significantly affect you (art. 22 GDPR). Requests may be sorted with the help of automated tools, but it is always a person who replies to you and decides. Data from requests, customers and installations is not used to train artificial intelligence models for others. Each customer's model is trained only on that customer's data and only for that customer.

Who we share data with

To authorised and instructed AM Solutions staff (art. 29 GDPR and art. 2-quaterdecies of the Italian Privacy Code), only as far as their task requires.
To suppliers that process data on our behalf as processors, under a binding contract: the up-to-date list is in the data processing agreement.
To Stripe for payments, and to the e-invoicing intermediary and the Italian Revenue Agency's Exchange System (SdI).
To Meta, LinkedIn and X, only the content the customer chooses to publish or send with their connected accounts.
To accountants, consultants and lawyers, bound by professional secrecy.
To the authorities, when required by law.

We do not sell or transfer data to anyone for commercial purposes.

Transfers outside the European Union

The cloud plan's servers are in the European Union. Some suppliers (for example Cloudflare, Stripe and, only if activated, Meta and external AI model providers) belong to groups headquartered in the United States. In these cases the transfer is based on the EU-U.S. Data Privacy Framework (the European Commission's adequacy decision of 10 July 2023, upheld by the General Court of the European Union on 3 September 2025) for certified suppliers and, in any case, on the standard contractual clauses approved by Decision (EU) 2021/914, with the necessary supplementary measures. You can ask us for a copy of the safeguards by writing to [email protected].

How we protect data

We adopt technical and organisational measures appropriate to the risk (art. 32 GDPR): encrypted connections, encrypted backups, encrypted credentials, two-step verification, per-person permissions, an operations log, a separate instance for each cloud customer and time-limited, signed and logged support access. The measures are described in the annex to the data processing agreement.

With «Connect in one click» a customer connects their pages and profiles on Facebook, Instagram, LinkedIn and X and their WhatsApp Business Platform number to Graphorum. The login happens on the social network's own site, which asks them for consent. For this connection AM Solutions:

receives from the social network an access token and the minimum data needed to recognise the account: ID and name of the page, profile or number;
delivers the token, encrypted, only to that customer's Graphorum platform and does not keep it after delivery;
for WhatsApp, forwards to the customer's platform the messages Meta sends to their number, without storing them.

This data is used only to publish, read and reply to comments and messages as the customer asks from their platform: we do not sell it, we do not use it for advertising and it does not train other parties' AI models. For the content of connected accounts the controller remains the customer.

How to disconnect and delete. In the platform: Settings › Connect account › «Disconnect», and the token is deleted. You can also remove access from the social network: on Facebook in Settings › Business integrations, on LinkedIn in Settings › Data privacy › Permitted services, on X in Settings › Security and account access › Apps and sessions. To request the deletion of all data received from social networks, write to [email protected]: we do it within 30 days and confirm it to you by email.

Your rights

At any time you can request, free of charge:

access to your data and a copy (art. 15);
rectification of inaccurate data (art. 16);
erasure (art. 17), except for data we must keep by law;
restriction of processing (art. 18);
portability of the data you gave us, in a structured, machine-readable format (art. 20);
objection to processing based on legitimate interest (art. 21);
withdrawal of consent, where processing is based on consent, without affecting the past (art. 7).

Write to [email protected]. We reply within one month; in complex cases the deadline may be extended by a further two months, in which case we will let you know (art. 12).

If you believe the processing infringes the law, you can lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it, Piazza Venezia 11, 00187 Rome) or with the authority of the EU country where you live or work (art. 77), or go to court (art. 79).

Minors

Graphorum is a service for companies and professionals and is not aimed at under-18s. We do not knowingly collect data from minors.

The site uses only technical storage, with no profiling: details are in the cookie policy.

Reference legislation

Regulation (EU) 2016/679 (GDPR); Legislative Decree No. 196 of 30 June 2003 (Personal Data Protection Code), as amended by Legislative Decree No. 101 of 10 August 2018; decisions and guidelines of the Garante and the European Data Protection Board.

Changes to this notice

If we change this notice, we update the date at the top of the page. If the change is significant and you are a customer, we will also tell you by email before it takes effect.

Version 1.2 of 24 October 2026 · AM Solutions di Vera Alexandru Nicolae. Earlier versions can be requested by email.