Privacy Policy

Pursuant to Regulation (EU) 2016/679 (GDPR - General Data Protection Regulation) and Legislative Decree 101/2018 implementing it within the Italian Privacy Code (D.lgs. 196/2003)

Introduction

This privacy policy applies to www.picarta.ai, the Picarta platform, Picarta services, and all related or connected services (collectively, the "Services"). It describes the data collected by Picarta and the ways in which such data are used and protected. It applies to all users of our Services, wherever they are located.

For the purposes of this policy, the term "Picarta" refers to Picarta S.r.l.

1.1 Data Collected

Information You Provide

Picarta collects the content and information you provide when using our Services - for example, when you create an account or communicate with us. This may include:

• your email address, username, and encrypted password;
• if you sign in with Google, your name, email address, and profile picture;
• billing information such as your plan, invoices, and billing address (payment card details are handled by our payment provider and never stored by Picarta);
• account preferences and settings;
• messages or inquiries you send to our team.

We also collect information in aggregated form about how you interact with the Services (e.g., duration of visits, pages viewed, features used), to improve service quality and security. See section 2 for the analytics tools we use.

Information Related to Uploaded Images

When you upload an image to our site or platform:

• the image is processed automatically to estimate the approximate geographical location where it was taken, and is not stored after the analysis;
• we read the image's EXIF metadata (such as GPS coordinates, camera make and model, and capture date) to show it to you;
• we keep a record of each search, linked to your account if you are logged in, for login, analytics, and billing purposes. When you delete your account, this link is removed;
• we do not sell images or use them to identify people.

Device Information

We collect technical information about the devices you use to access our Services, such as:

• browser type and version;
• operating system and screen resolution;
• IP address;
• session time and duration.

Analytics data are collected in aggregated form for statistical purposes. IP addresses are also used for security, abuse prevention, and to apply free-tier limits for visitors without an account.

Information from Third-Party Partners

We may receive technical or aggregated information from third-party partners (for instance, hosting providers or analytics tools), solely to ensure service continuity and security.

1.2 Purpose of Data Processing

The processing of personal data is carried out for purposes connected to, instrumental to, and necessary for accessing and using the Picarta platform and Services.

Purposes Not Requiring Consent

These include processing necessary to:

• provide access to and use of the platform and Services;
• activate, manage, and maintain your account;
• process payments and billing;
• apply usage limits and prevent abuse of the free tier;
• ensure the security and integrity of the platform (e.g., preventing misuse or unauthorized access);
• comply with legal or regulatory obligations;
• personalize your service experience (e.g., language or interface preferences);
• provide technical assistance and support.

These purposes are based on contractual necessity or legitimate interest of the controller.

Purposes Requiring Consent

Your explicit consent will be requested only for:

• sending informational or promotional communications about our Services;
• analytics cookies (see section 2).

1.3 Third-Party Websites

Third-party websites that can be accessed through our Services are not covered by this policy. Picarta disclaims any responsibility regarding their content or data processing practices. Their data use is governed by their respective privacy policies.

1.4 Where Data Are Processed and Who Is Responsible

Processing and Service Providers

Data are processed using electronic tools and in compliance with the security measures required by Articles 32 and following of the GDPR. We rely on trusted service providers that process data on our behalf: Amazon Web Services (hosting), Stripe (payments), Google (analytics and sign-in), and Cloudflare (network security and analytics).

Some of these providers may process data outside the European Union, including in the United States. In such cases, Picarta ensures that all transfers comply with Articles 44 and following of the GDPR by implementing Standard Contractual Clauses (SCCs) approved by the European Commission or relying on the EU-US Data Privacy Framework for certified providers.

Data Controller

Picarta S.r.l., Via Roma 77, 53100 Siena (SI), Italy. VAT: IT01631970520. Email: [email protected]

1.5 Disclosure of Data

We do not sell your personal data. We disclose it only:

• to the service providers listed in section 1.4;
• to public authorities, courts, or law enforcement when required by law or a valid legal order, or to protect the rights, property, or safety of Picarta, our users, or others;
• to a buyer or successor in the event of a merger, acquisition, or sale of assets, who will be bound by this policy.

We may use aggregated or anonymized data that does not identify you to analyze and improve our Services.

1.6 Mandatory or Optional Nature of Data Provision

Providing the requested data (e.g., email and credentials) is mandatory in order to use the platform. If you choose not to provide these, Picarta will be unable to provide the Services.

Uploading images does not require providing personal data. Picarta does not pre-screen user content but reserves the right to remove images or materials deemed inappropriate, illegal, or contrary to our terms of service.

1.7 Data Retention Periods

• Uploaded images: not stored after processing.
• Account data: retained for as long as your account is active or until deletion is requested.
• Search records: retained while your account is active; when you delete your account, they are no longer linked to you.
• IP addresses used for free-tier limits: deleted after 7 days.
• Security and log data: retained for up to 12 months unless required longer by law.
• Marketing data (with consent): retained for up to 24 months.

After these periods, data are permanently deleted or irreversibly anonymized.

1.8 Data Subject Rights

In accordance with Articles 15 - 22 of the GDPR, you have the right to:

• obtain confirmation of whether we process data concerning you;
• access your personal data and obtain a copy;
• request correction or updates;
• request deletion ("right to be forgotten") or restriction of processing;
• object to processing for legitimate reasons;
• obtain data portability in a structured, machine-readable format;
• withdraw consent at any time, without affecting prior lawful processing.

To exercise these rights, email [email protected]. Picarta will respond within 30 days, extendable for complex cases with due notice. We grant these rights to all users, wherever they are located.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) at www.garanteprivacy.it or with the data protection authority of your country.

1.9 Data Security

Picarta implements appropriate technical and organizational measures to protect data from unauthorized access, loss, or alteration, including:

• encryption of data in transit and at rest;
• secure authentication and controlled access;
• periodic backups and continuous monitoring;
• staff training on privacy and security;
• regular security testing.

However, no system is entirely invulnerable. We encourage users to choose strong passwords and avoid sharing them.

1.10 Children

Our Services are not directed to children under 16. If we learn that we have collected personal data from a child under 16, we will delete it.

2.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us provide better functionality and understand how you use our services.

2.2 Cookies We Use

Essential Cookies:

• Required for the website to function properly
• Enable access to secure areas and basic features
• Remember your cookie choice
• Cannot be disabled

Analytics Cookies:

• Collect aggregated data about how visitors use our website
• Help us analyze and improve website performance
• Track pages visited, time spent, and user interactions
• Set only with your consent

2.3 Google Analytics

We use Google Analytics to understand website usage patterns. It is loaded through Cloudflare only after you accept analytics cookies, and uses cookies to collect information such as:

• Pages you visit
• How long you spend on our site
• How you arrived at our site
• Your approximate geographic location (country/city level)

This information is collected in aggregated form and used only for statistical purposes.

Cloudflare Web Analytics:
We also use Cloudflare Web Analytics to measure overall traffic and site performance. It does not use cookies or store any data on your device, does not track you across websites, and applies to all visitors without requiring consent.

2.4 Managing Cookies

Browser Settings:
You can control cookies through your browser settings. Most browsers allow you to:

• View and delete existing cookies
• Block cookies from being set
• Block third-party cookies

Note that blocking essential cookies may prevent the website from functioning properly.

Cookie Notice:
When you first visit Picarta, we ask whether you accept analytics cookies. You can accept or reject them and change your choice at any time: Cookie settings. You can also opt out of Google Analytics through the opt-out browser add-on at tools.google.com/dlpage/gaoptout.

2.5 Your Consent

Analytics cookies are set only after you accept them in our cookie banner. Essential cookies do not require consent. Your choice is stored on your device for 12 months and, if you are logged in, recorded in your account.

You can withdraw your consent at any time through the Cookie settings link or by contacting us at [email protected].

Picarta may update this Privacy Policy from time to time to reflect regulatory changes or improvements to our Services. Material changes will be published on this page and, where appropriate, notified via email to registered users. Continued use of the Services after such updates means the revised policy applies.

If you have questions, concerns, or requests regarding privacy or cookies, please contact us:

Email: [email protected]
Company: Picarta S.r.l., Via Roma 77, 53100 Siena (SI), Italy
VAT: IT01631970520

We will respond to your inquiries within 30 days.