Privacy notice

Privacy Policy

This is an English translation provided for convenience. The Italian version is the legally binding text and prevails in case of any discrepancy.

This page explains how xapiens processes your personal data, in compliance with Regulation (EU) 2016/679 (GDPR) and applicable Italian law. xapiens is a project by Cartesiani.

Data controller

The data controller is Nicola Mastrorilli (Cartesiani).

• Registered office: via delle Azalee 37, 31021 Mogliano Veneto (TV), Italy
• VAT number: IT05142120269
• Email: info@cartesiani.it
• Certified email (PEC): mastrorillinicola@pec.it

Two different situations

We process data in two distinct contexts, with different rules.

A. Website visitors. People who visit xapiens.it, request a demo or ask to stay updated. For this data the controller is xapiens (Cartesiani), as stated above.

B. Users and organizations of the platform. Organizations using xapiens upload their own content and knowledge to the platform, which may include personal data. In this case the controller of that data is the client organization; xapiens acts as data processor, under a dedicated agreement (Data Processing Agreement) signed with each client. The organization keeps control of its data and can export it at any time.

Purposes and legal bases

1. Responding to requests you send us (demos, contacts, applications). Legal basis: pre-contractual measures taken at your request. We keep the data for as long as needed to handle the request and to meet any subsequent legal obligations.

2. Sending you updates about xapiens, if you gave your consent through the «Stay updated» form. Legal basis: your consent, which you can withdraw at any time. We keep the data until you withdraw your consent.

3. Providing the platform's services to users and client organizations. Legal basis: performance of the contract. We keep the data for the duration of the relationship and within the terms set by law.

Who can access the data

Besides us, the technical providers that allow us to deliver the service can access the data, appointed as data processors where required. The main ones are:

• Railway (infrastructure hosting). Processing: EU.
• Bunny (content delivery network for media).
• Qdrant (vector search engine, hosted on dedicated infrastructure).
• Yet Analytics (Learning Record Store, LRS), also in a dedicated configuration.
• Backblaze B2 (backups). Processing: EU.
• Resend (transactional email and communications).
• Google (appointment booking and web meetings).
• Anthropic and other AI model providers, for generation and assistance features. Processing: also outside the EU.

You can request the up-to-date list of processors at any time. We may also disclose data to public authorities at their request.

Transfers of data outside the European Union

Some of the services we use involve transferring data outside the European Union, for example to the United States. When this happens, the transfer is based on the Standard Contractual Clauses approved by the European Commission, on applicable adequacy decisions (including the EU-US Data Privacy Framework) or on other safeguards provided by the GDPR. xapiens is designed to be able to operate, where required, entirely within the European Union.

Your rights

Regarding your data, you have the right to:

• withdraw your consent at any time;
• object to the processing;
• access your data and receive a copy of it;
• request its rectification, updating or correction;
• obtain restriction of the processing;
• obtain erasure of the data;
• receive your data or have it transferred to another controller (portability);
• lodge a complaint with the supervisory authority (the Italian Garante per la protezione dei dati personali) or take legal action.

To exercise your rights, write to us at info@cartesiani.it. We will reply as soon as possible, and in any case within one month.

Cookies

The website uses only the technical cookies that are strictly necessary for it to work. Any statistics or third-party cookies will be introduced only after a dedicated notice and, where required, after obtaining consent. You can manage cookies from your browser settings.

Specific notices

Some xapiens tools have their own dedicated privacy notice, which complements this page:

• The «xapiens Letture» browser extension: what it collects and what it doesn't when you read an article recommended by your organization.

Changes

We reserve the right to change this notice. Relevant changes will be communicated in the most appropriate way.

Last updated: October 2026.