Privacy Policy

1. Controller and scope

Ninera Studios is the controller for personal information processed through our public website and the digital services linked from it, including inquiry forms, structured briefings, consultation booking and payment, transactional email, and the optional website chat assistant.

This Policy applies to visitors, prospective clients, consultation participants, and business contacts who interact with ninerastudios.com. It does not govern client platforms we build and operate under separate agreements; those environments are covered by the privacy documentation prepared for each project.

2. Legal and regulatory framework

Our practices are designed to align with the EU General Data Protection Regulation (GDPR), Italian implementation measures including Legislative Decree 196/2003 as amended, and applicable ePrivacy rules for cookies and similar technologies.

When we process data about individuals in other jurisdictions, including the United States, we apply comparable transparency and security principles and honour rights requests where local law requires us to do so, subject to verification and statutory exceptions.

3. Categories of personal information we collect

• Identity and contact data: name, email address, telephone or WhatsApp number, company name, and message content you submit.
• Consultation and commercial data: service selection, scheduling preferences, booking status, payment confirmation metadata from Stripe, and notes needed to deliver the session.
• Briefing and project context: goals, budget range, timeline, and technical preferences you choose to share before or after a consultation.
• Technical and security data: IP address, browser and device type, approximate location derived from IP, session identifiers, server logs, and authentication events for our infrastructure.
• Cookie and preference data: language and theme choices, consent records where applicable, and identifiers set by Google Tag Manager when configured.
• Chat assistant content: messages you send through the website assistant and the replies generated for you during that session.

4. Sources of information

• Directly from you when you complete forms, book a consultation, pay through Stripe Checkout, or use the chat assistant.
• From your organisation when a colleague submits a briefing on your behalf, with copy sent to the email address you provide.
• Automatically from your device and browser when you load pages on our site, subject to the Cookie Policy.
• From payment, email, analytics, and AI service providers acting as processors on our instructions, as described below.

5. Purposes of processing

• Operate and improve the public website and related digital services.
• Respond to inquiries, briefings, and support messages.
• Schedule, confirm, and deliver paid or complimentary consultation sessions.
• Process payments, refunds, and accounting records through Stripe.
• Send transactional notices such as booking confirmations and service updates.
• Send marketing or newsletter messages only where permitted by law and your preferences.
• Secure our systems, detect abuse, and maintain Paladin-style monitoring on infrastructure we control for studio operations.
• Generate chat assistant replies using configured AI providers.
• Comply with legal obligations and establish, exercise, or defend legal claims.

6. Legal bases (GDPR)

• Contract or pre-contract steps: consultation bookings, delivering sessions, and responding to project inquiries you initiate.
• Legitimate interests: site security, fraud prevention, service improvement, and proportionate business administration, balanced against your rights.
• Consent: non-essential cookies or marketing communications where consent is required.
• Legal obligation: tax, accounting, and regulatory duties connected to paid services.

7. Website chat assistant

The optional chat assistant on this website sends your messages to an AI provider configured in our studio environment (such as Google Gemini or OpenAI, depending on settings) to generate a reply grounded in public Ninera information.

Do not submit passwords, payment card numbers, government ID images, or special-category data through the chat widget. For project details that belong in a confidential briefing, use the contact form or book a consultation.

Chat history during your browser session may be held in the page to maintain context. We do not use the chat to make contractual or pricing commitments; confirmed scope and fees appear only in written proposals and signed agreements.

8. Processors, disclosures, and international transfers

Some processors are located outside the European Economic Area. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses and provider compliance programmes.

• Stripe, Inc.: payment processing for consultation fees.
• Google LLC: Google Tag Manager, Google Workspace, Meet, or Calendar when enabled for scheduling.
• Resend or comparable providers: transactional email delivery.
• Configured AI providers: generation of chat assistant responses under data processing terms offered by the provider.
• Hosting, database, and infrastructure partners that store and serve our website and portal systems.
• Professional advisers or authorities when required by law or to protect rights, safety, and property.

9. Retention

We retain personal information for as long as needed to fulfil the purposes in this Policy, maintain client relationships, meet accounting and tax obligations, resolve disputes, and enforce agreements.

Consultation and contact records are typically kept for the duration of the business relationship and for a reasonable period afterward unless you request deletion where the law allows. Server and security logs are kept for shorter rolling periods suited to diagnostics and incident response.

10. Security

We apply access controls, encryption in transit for public web services, segmented storage for operational systems, monitoring, and patching consistent with the nature of the data we hold.

No online service can guarantee absolute security. You are responsible for safeguarding credentials for any account we issue to you and for notifying us promptly if you suspect unauthorised access.

11. Your rights and choices

Submit requests via the contact page with subject line Privacy Request. We may ask for reasonable identity verification before fulfilling requests that disclose or erase data.

• Access, correction, deletion, restriction, portability, and objection rights under GDPR, subject to exceptions.
• Withdrawal of consent where processing is consent-based, without affecting prior lawful processing.
• Complaint to the Italian Data Protection Authority (Garante per la protezione dei dati personali) or your local supervisory authority.
• Marketing opt-out through unsubscribe links or by contacting us.

12. Children

Our public website and consultation services are directed at business and organisational contacts. We do not knowingly collect personal information from children under 16 through the marketing site. If you believe a child provided data to us, contact us and we will take appropriate steps to delete it where required.

13. Automated processing

We may use automated tools for spam filtering, security alerts, and routing of messages. We do not make legally significant decisions about project acceptance solely by automated means without human review.

14. Changes to this Policy

We may update this Policy to reflect operational, legal, or technical changes. The effective date at the top will change when we publish a material revision. Continued use of the website after an update constitutes notice of the revised Policy where permitted by law.

15. Contact

Privacy and data protection inquiries: use the contact page on ninerastudios.com and indicate Privacy Request in your message. For general studio inquiries, use the same contact channels published on the site.