Privacy Policy

1. Introduction and Data Controller

This Privacy Policy (hereinafter "Policy") is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter "GDPR"), Legislative Decree no. 196 of 30 June 2003, as amended by Legislative Decree no. 101 of 10 August 2018 (hereinafter "Privacy Code"), as well as the Guidelines issued by the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) and the European Data Protection Board (EDPB).

The Data Controller of your personal data is Quario S.r.l.(hereinafter "Quario", "we", "us", or "Controller"), with registered office in Italy, website: www.quario.ai, contact email: privacy.eu@quario.ai.

This Policy applies to all services offered through the Quario platform, including the core service of creating and managing Voice Cards with an AI assistant, the Quario Automationsmodule (the platform's native automation engine), AR (Augmented Reality) services, the Lead Management system, the QR Code Designer, the Page Builder, the Knowledge Base (RAG), and any other accessory features.

2. Data Protection Officer (DPO)

The Controller has appointed a Data Protection Officer (DPO) pursuant to Article 37 of the GDPR, who can be contacted at: privacy.eu@quario.ai. The DPO monitors compliance with data protection regulations and serves as the point of contact for Data Subjects and the Supervisory Authority.

3. Categories of Personal Data Processed

3.1 Data Provided Voluntarily by the User

• Registration data: first name, last name, email address, password (stored in hashed format), profile picture (optional).
• Voice Card data: first name, last name, professional title, company name, telephone number, professional email address, physical address, website, social media profiles, company logo, opening hours, welcome message, description of services.
• AI Content: custom greeting phrases, instructions for the language model (AI persona), moderation rules, allowed and blocked topics, moderation keywords.
• Knowledge Base: uploaded documents (PDF, text, multimedia files) used for Retrieval-Augmented Generation (RAG).
• Billing data: payment information, tax code/VAT number, billing address. Credit card details are processed exclusively by Stripe, Inc. as a PCI DSS Level 1 sub-processor.
• Team data: email invitations, member roles, credit allocations.
• Automation data: workflows configured via Quario Automations, webhook URLs, authentication secrets (AES-256-GCM encrypted).
• AR Content: uploaded 3D models, AR experience configurations, scene settings.
• Forms and surveys: form configurations, conditional logic, automation triggers.

3.2 Automatically Collected Data

• Navigation data: IP address, browser type, operating system, pages visited, timestamps of visits, referrer URL.
• Cookies and similar technologies: as described in Section 11.
• Analytical data: number of QR scans, number of conversations initiated by visitors, engagement rate, lead collection metrics, session durations.
• Geolocation data: GPS coordinates (only subject to explicit consent) for the Discovery feature and the public Voice Card directory map.
• AI conversation data: transcripts of conversations between Voice Card visitors and the AI assistant, including text messages, timestamps, session duration, detected language, and session identifier.

3.3 Lead Data (Voice Card Visitors)

• Conversational data: name, email, phone, company, role, and any other information spontaneously provided during the conversation with the AI, extracted via Natural Language Processing (NLP).
• Form data: fields filled out in contact forms and surveys presented during the conversation.
• Enrichment metadata: browser, device, browser language, timezone, city/region/country (derived from IP), number of sessions, page views, referrer, UTM parameters, engagement score.
• AR data: type of AR device used, duration of the AR experience, interactions with 3D models.

4. Purposes and Legal Bases of Processing

5. Data Processing by Artificial Intelligence

Quario uses third-party language models (including OpenAI GPT-4 and its successors) to deliver the Voice Card AI assistant service. In relation to this processing, the following is specified:

• User inputs:messages sent by visitors to the AI assistant are transmitted to the language model provider solely for response generation. OpenAI, as a sub-processor, is contractually bound not to use this data for training its models (in compliance with OpenAI's API Data Usage Policy).
• Content moderation:the system applies configurable moderation filters (keywords, regex, toxic categories, thematic analysis) both locally and through OpenAI's moderation API to ensure safe and compliant responses based on the policies established by the Voice Card creator.
• Knowledge Base (RAG):uploaded documents are processed using chunking, embedding, and vector indexing to enable contextual retrieval of information during conversations. Embeddings are generated by OpenAI and stored locally in the platform's database.
• No automated profiling: AI conversations are not used for automated decisions that produce significant legal effects on the Data Subject pursuant to Article 22 of the GDPR. Lead contact extraction via NLP is always subject to manual review and management by the Voice Card creator.
• Retention:conversation transcripts are retained for the duration of the User's subscription and can be deleted at any time using the delete feature in the dashboard.

6. Quario Automations

Quario Automations is the workflow automation module integrated into the platform, developed by Quario and run on its own infrastructure. Regarding data processing:

• Webhooks: data transmitted through webhooks configured by the User is digitally signed (HMAC-SHA256) to ensure integrity and authenticity. Authentication secrets are encrypted with AES-256-GCM.
• Workflows:automations may process personal data (e.g., lead data, notifications, CRM updates) according to the User's configuration. The User is responsible for ensuring that configured automations comply with applicable regulations.
• Third-party integrations: automations can connect Quario to external services (Google Calendar, Slack, CRM, etc.). The transfer of data to these services is the sole responsibility of the User, who must verify the respective privacy policies.
• Execution logs: Quario retains automation execution logs for 30 days for debugging and troubleshooting purposes, after which they are automatically deleted.
• Data isolation: each instance of Quario Automations is isolated per tenant (user/team), ensuring strict data segregation between platform users.

7. Recipients and Sub-processors of Processing

Personal data may be communicated to the following entities, duly appointed as Data Processors pursuant to Article 28 of the GDPR via a Data Processing Agreement (DPA):

Personal data will not be transferred, sold, or rented to third parties for direct marketing purposes without the explicit prior consent of the Data Subject.

8. Data Transfers to Third Countries

Some of the sub-processors listed in the previous section are based in the United States of America. Personal data transfers to the US are carried out in accordance with Article 46 of the GDPR based on:

• Standard Contractual Clauses (SCC) approved by the European Commission with Implementing Decision (EU) 2021/914 of 4 June 2021;
• Adherence to the EU-US Data Privacy Framework (DPF), where applicable, pursuant to the adequacy decision of the European Commission of 10 July 2023;
• Supplementary technical security measures (end-to-end transport encryption, anonymization where possible, minimization of transmitted data).

The Controller periodically performs a Transfer Impact Assessment (TIA) to evaluate the adequacy of the safeguards applied to international transfers.

9. Rights of the Data Subject

Pursuant to Articles 15 to 22 of the GDPR and Articles 2-ter et seq. of the Italian Privacy Code, the Data Subject has the right to:

• Access (Art. 15): obtain confirmation as to whether or not personal data is being processed, and access their personal data, as well as information on purposes, categories of data, recipients, and retention periods.
• Rectification (Art. 16):obtain the correction of inaccurate personal data or the integration of incomplete data. In the Quario platform, this can be done directly from the "Account" section and the Voice Card settings.
• Erasure — "Right to be Forgotten" (Art. 17): obtain the erasure of their personal data, within statutory limits. Account deletion entails the irreversible deletion of all associated Voice Cards, conversations, leads, Knowledge Base documents, automations, and AR configurations within 30 days.
• Restriction of Processing (Art. 18): obtain the restriction of processing in the cases provided for by law.
• Data Portability (Art. 20): receive their personal data in a structured, commonly used, and machine-readable format (JSON/CSV) and transmit it to another controller.
• Objection (Art. 21): object to the processing of their data based on legitimate interest, including profiling.
• Withdrawal of Consent (Art. 7): withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Not to be subject to automated decision-making (Art. 22): not to be subject to a decision based solely on automated processing which produces significant legal effects.

To exercise these rights, the Data Subject can send a request to: privacy.eu@quario.ai or use the integrated feature in the Account section of the platform. The Controller will respond within 30 days of receiving the request, which may be extended by an additional 60 days in case of complexity (Art. 12(3) GDPR).

10. Right to Lodge a Complaint with a Supervisory Authority

The Data Subject has the right to lodge a complaint with the Garante per la Protezione dei Dati Personali (Piazza Venezia, 11 — 00187 Rome — www.garanteprivacy.it) pursuant to Article 77 of the GDPR, if they believe that the processing of their personal data violates applicable regulations.

11. Cookies and Tracking Technologies

11.1 Technical Cookies (Necessary)

Cookies essential for the functioning of the platform, including session cookies (authentication), preference cookies (light/dark theme, interface language), and anti-CSRF cookies. These cookies do not require consent pursuant to Art. 122, paragraph 1 of the Italian Privacy Code and Directive 2002/58/EC (ePrivacy).

11.2 Analytical Cookies (First Party)

Cookies used internally to collect aggregate statistics (number of QR scans, conversations started, engagement rate) required for the platform's Analytics feature. This data is processed in an aggregate and anonymized form where possible.

On public VoiceCards, a first-party HttpOnly cookie (quario-returning-visitor-<organization>) holds a signed random identifier, valid for one organization only, so the same browser is recognised and its open lead is updated instead of duplicated. It holds no personal data and expires 90 days after the last conversation.

11.3 Third-Party Cookies

The platform may use third-party cookies for integration with external services (Stripe for payments, Google Maps for geolocation, video embed services). These cookies are subject to the privacy policies of their respective providers and are only installed with the User's consent via the cookie management banner.

11.4 LocalStorage and SessionStorage

The platform uses Web Storage APIs (localStorage and sessionStorage) for technical features such as: storing the authenticated user state, temporary configurations for desktop AR preview, and interface preferences. This data is processed locally in the User's browser and is not transmitted to third-party servers.

12. Security Measures

The Controller has adopted appropriate technical and organizational measures pursuant to Article 32 of the GDPR, including:

• Encryption in transit: all communications are protected by TLS 1.2+ (HTTPS mandatory).
• Encryption at rest: databases are encrypted. Webhook secrets are encrypted with AES-256-GCM using derived keys.
• Password hashing: passwords are stored using secure hashing algorithms (bcrypt/scrypt) with a unique salt per user.
• Digital watermark: the public verification page checks signed export metadata (HMAC-SHA256) embedded in a QR Code SVG file. A valid check proves only that this metadata is unchanged and names a public VoiceCard; it does not prove the image was not edited. Signed QR Code export is currently unavailable, so downloaded QR Codes do not contain a watermark.
• Multi-tenant isolation: data for each user/team is logically isolated at the database level through server-side ownership filters.
• Rate limiting: protection against brute-force attacks and API abuse.
• Access control: granular role-based access control (system_admin, enterprise_owner, business_owner, manager, collaborator) with the principle of least privilege.
• Backups: daily backups with 30-day retention, stored in European data centers.
• Audit logging: logging of sensitive operations (login, data modification, deletion, impersonation) for security and compliance purposes.
• Content Security Policy (CSP): security headers to protect against XSS and code injection attacks.

13. Processing of Children's Data

Quario services are intended exclusively for natural persons who have reached the age of sixteen, in compliance with Article 8 of the GDPR and Article 2-quinquies of the Italian Privacy Code (which sets the age for digital consent in Italy for information society services at 14 years). If the Controller becomes aware of the processing of data of individuals below the limits set by law without the consent of the parent or legal guardian, it will promptly delete such data.

14. User's Role as Autonomous Data Controller

When a User creates a Voice Card and collects personal data of their visitors (leads), the User assumes the role of autonomous Data Controller with respect to the data of their leads. In this capacity, the User is required to:

• Inform their visitors about the processing of their personal data;
• Obtain the necessary legal bases for the collection and use of the data;
• Respond to requests to exercise the rights of their leads;
• Configure automations (Quario Automations) in compliance with applicable regulations;
• Ensure that integrations with third-party services configured in automations comply with data protection requirements.

Quario acts as a Data Processor (Art. 28 GDPR) on behalf of the User/Controller with respect to the storage, processing, and transmission of lead data collected through the platform.

15. Augmented Reality (AR) Data

Augmented Reality features (AR Manager and AR Studio) may involve processing additional data:

• Camera access:AR experiences require access to the end-user's device camera. This access occurs subject to explicit consent, and camera video streams are processed locally on the device for AR rendering (SLAM tracking). No video frames are transmitted or stored on Quario's servers.
• Device sensors: accelerometer, gyroscope, and other sensors may be used for placing 3D objects. This data is processed locally and is not collected.
• 3D models:3D models uploaded by Users are stored on Quario's servers and served to visitors via CDN. Model metadata (name, size, format, categories) is processed for library management purposes.

16. Data Breach

In the event of a personal data breach (data breach) pursuant to Articles 33 and 34 of the GDPR, the Controller:

• Will notify the breach to the competent Supervisory Authority (Garante per la Protezione dei Dati Personali) within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons;
• Will communicate the breach to the affected Data Subjects without undue delay if the breach is likely to result in a high risk to their rights and freedoms;
• Will document all breaches in the internal Data Breach Register.

17. Record of Processing Activities

The Controller maintains a Record of processing activities pursuant to Article 30 of the GDPR, containing all information required by law, available upon request of the Supervisory Authority.

18. Changes to this Privacy Policy

The Controller reserves the right to modify this Policy at any time. Material changes will be communicated to registered Users via email notification and/or platform announcement with at least 30 days' notice. Continued use of the services after the changes have been communicated constitutes acceptance of the updated version of the Policy.

The current version of the Policy is always available at the /privacy URL within the Quario platform.

19. Applicable Law and Jurisdiction

This Policy is governed by Italian law and European Union law regarding the protection of personal data. For any dispute relating to the interpretation or application of this Policy, exclusive jurisdiction shall lie with the Court of the place of residence or domicile of the Data Subject, if located within the Italian territory, pursuant to Art. 33 of the Consumer Code (Legislative Decree 206/2005), or with the Court of Milan in case of disputes between business professionals.

20. Contacts

For any questions or requests relating to this Policy or the processing of personal data:

• Privacy and Data Protection (EU): privacy.eu@quario.ai
• Support Italy: support-it@quario.ai
• General Information: info@quario.ai
• Website: www.quario.ai