AI Lead Intake DiagnosticHomePricesDemoConsolePrivacyTermsDPA
  1. Home
  2. AI Lead Intake Diagnostic
  3. Privacy

Your visitors' leads stay yours.

For your account, Dario is the controller. For your visitors' data, you are the controller and Dario is the processor.

Osi, the mascot

Version 1.0 · Last updated: 13 November 2026

This policy explains how AI Lead Intake Diagnostic ("ALID", the "Service") handles personal data. It covers two groups of people: you, the business that uses ALID, and the visitors who use the ALID widget on your website.

Short version

  • For your account and billing data, Dario Cositore is the controller.
  • For your visitors' data, you are the controller and Dario is your processor under the DPA. Leads are stored and processed only on your behalf and never used for Dario's own purposes.
  • The readout is generated by AI. The only AI provider is Xiaomi MiMo, which stores data in Europe and Singapore under EU Standard Contractual Clauses.
  • Payments go through Waffo Pancake, the merchant of record. Card data never reaches Dario's servers.
  • Nobody's data is sold, and nobody's data is used by Dario to train AI models.

1. Who is responsible

The data controller for your account and billing data is:

  • Name: Dario Cositore, individual (persona fisica) operating under the laws of Italy
  • Address: Via Chiosi, 26012 Castelleone (CR), Italy
  • Codice Fiscale: CSTDRA91R11F839X
  • Privacy contact: [email protected]
  • Data Protection Officer: not appointed

For the data of your website visitors, you are the controller and Dario is the processor. He acts only on your instructions, as set out in the DPA.

If you are a visitor who used an ALID widget on someone else's website, that business is responsible for your data. Read its privacy policy and contact it first. If you write to Dario instead, he will pass your request to that business and help it answer.

2. Data about you (ALID customers)

  • Account: your email address, a password hash or your Google identity if you sign in with Google, and login sessions. Sign-in runs on Dario's account system at api.dariocositore.com, which his other products also use.
  • Workspace: your business name and description, widget settings and copy, allowed website addresses, delivery destinations, verified notification emails and webhook URLs.
  • Subscription: plan, billing period, status and trial dates, plus the payment amount and status that Waffo reports. Full card numbers are never stored by Dario.
  • Usage: run and lead counts, monthly AI costs, and a log of changes made in the console.
  • Messages: emails you send to support.

3. Data about your visitors

  • What the visitor types: the brief describing their problem and their answers to any qualifying questions.
  • The readout the AI generates from the brief.
  • If they leave their details: name, contact (email or phone, depending on the channel), the consent text they accepted and when, and whether they asked for a copy of the readout by email.
  • Technical data: the page address and website where the widget ran, and a hash of the IP address. Raw IP addresses are never stored. The hash uses a salt that changes every day and is thrown away after 3 days, so hashes can't be linked across days or traced back to an address.
  • Delivery logs: which destination received the lead (the email address or webhook URL), when, and whether delivery worked. They are deleted after 90 days.
  • Share links: if a visitor shares a readout, a copy is stored behind the share link.

4. Why the data is used, and the legal basis

  • Running the Service, your account and your workspace: performance of the contract (GDPR Art. 6(1)(b)).
  • Billing through Waffo: performance of the contract.
  • Support: performance of the contract, or legitimate interest in answering you.
  • Service emails about billing, security, verification codes and failed deliveries: performance of the contract and legitimate interest.
  • Security and abuse prevention (bot check, rate limits, IP hashing): legitimate interest in keeping the Service safe (Art. 6(1)(f)).
  • Keeping records required by tax and accounting law: legal obligation (Art. 6(1)(c)).
  • Offers to former customers about ALID (see below): legitimate interest (Art. 6(1)(f)) under the soft opt-in rule for existing customers in art. 130(4) of the Italian Privacy Code (Legislative Decree 196/2003).
  • Visitor data: processed on your behalf and on your instructions. Your own legal basis applies, usually the visitor's consent to be contacted, which the widget records with its exact wording and time.

Anonymous totals, such as run counts and costs, may be used to run and improve the Service. They can't identify anyone.

Offers to former customers

If your subscription ends, we may email you an offer to come back to ALID, for example a discount in the notice we send before your data is deleted. These offers are only about ALID, the same service you used. You can refuse them at any time, for free: use the unsubscribe link in each email that carries an offer, or write to [email protected]. After that you still get service messages, such as the deletion notice, but no offers. To make the opt-out stick, we keep a hashed copy of your address on a suppression list. ALID sends no newsletter.

5. How the AI works with the data

The readout is generated by AI, and visitors should always be told so. To produce it, the visitor's brief and the context they give are sent to Xiaomi MiMo together with your business description and offers. The visitor's name and contact details are not sent to the AI provider.

Dario does not use briefs, readouts or leads to train AI models. A readout can be wrong or incomplete. It is not professional advice.

Every readout says it was generated by AI, with the line "Readout generated with AI" ("Analisi generata con l'AI" in Italian) under the readout in the widget, in the readout email and on share pages. The line can't be switched off, and it stays when the "Powered by" link is hidden.

6. Cookies and browser storage

  • The ALID widget itself sets no cookies and loads no analytics or advertising scripts.
  • The widget saves one timestamp in the browser's localStorage, to stop the same browser from starting runs too quickly one after another.
  • The bot check, Cloudflare Turnstile, runs in a frame served from dariocositore.com and may set its own strictly necessary cookies to tell people from bots. These can't be switched off, because the widget can't work safely without them.
  • Signing in to the console uses a strictly necessary login session.
  • These product pages on dariocositore.com load Google Analytics only after you accept analytics in the site's consent banner. Details are in the site privacy policy.

7. Who receives the data

Personal data is never sold, including in the sense of the CCPA. It is shared only with the service providers below, each bound by a data processing agreement, and only as far as each one needs.

  • Cloudflare, Inc. (USA): hosting (Workers), database (D1), file storage (R2), key-value storage, queues and the Turnstile bot check. Stored data sits in Cloudflare's EU jurisdiction. Requests are handled at the nearest Cloudflare location.
  • Xiaomi MiMo, provided by Xiaomi Technologies Singapore Pte. Ltd. together with Xiaomi Technology Netherlands B.V. and their affiliates: generates the readout. Data is stored on servers in Europe and Singapore.
  • Resend (Plus Five Five, Inc., USA): sends the Service's emails from its EU region (eu-west-1).
  • Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), for users in the European Economic Area and Switzerland: only if you choose to sign in with Google. Google shares your basic profile and email address.
  • Waffo Pancake, operated by Waffo.com Limited (Room 1903, 19/F Lee Garden One, 33 Hysan Avenue, Causeway Bay, Hong Kong): merchant of record and PCI-DSS certified payment processor. Waffo handles checkout, payment, invoice and tax data as an independent controller under its own privacy policy. Card data is processed only by Waffo and is never stored on Dario's servers. Waffo does not receive visitor briefs or leads.

Data may also be disclosed when the law, a court or a regulator requires it, or in a business transfer, with advance notice and the same protections. Anything else needs your explicit consent.

8. International transfers

Xiaomi MiMo stores data in Europe and Singapore. Cloudflare and Resend are US companies. These transfers are covered by data processing agreements that include the EU Standard Contractual Clauses. Waffo.com Limited is based in Hong Kong and handles the checkout data it collects under its own privacy policy.

9. Emails the Service sends

  • Account and delivery emails to you (verification codes, delivery tests, failed-delivery notices) come from [email protected].
  • Billing reminders, also from [email protected]: an email 7 days and 3 days before each monthly or annual renewal, and before a trial turns into the first charge, with a link to cancel.
  • When a subscription has ended: a notice 3 days before the workspace data is deleted, with a link to export it. Unless you opted out, it can include a come-back offer (Section 4).
  • New-lead notifications go only to email addresses you have verified in the console. They come from [email protected], and replying goes straight to the visitor when they left an email address.
  • The readout email to a visitor is sent only if the visitor asks for a copy. It comes from [email protected] with your business name as the sender name, and replies go to the reply-to address you set, or your fallback email.
  • Replies to service emails go to [email protected].

10. Security

  • Encryption in transit with HTTPS (TLS) everywhere.
  • Passwords are stored only as hashes. IP addresses are stored only as daily salted hashes.
  • Stored data is kept in Cloudflare's EU jurisdiction.
  • Access is limited to Dario, on a least-privilege basis.
  • Bot checks and rate limits protect the public widget.
  • Card data is handled only by Waffo.

If a security incident affects your data, Dario will notify you, and where the law requires it the Garante per la protezione dei dati personali, within 72 hours of becoming aware of it. For visitor data, he notifies you within the same 72 hours so you can meet your own duties. Keep your login details safe and don't share them.

11. How long data is kept

  • Account and workspace data: while your subscription runs, and for 90 days after it ends (cancelled at the end of the period, refunded, or a free Starter that expired). Three days before the deletion date we email you a notice with a link to export your workspace. Then the workspace data (leads, runs, widget settings, domains, delivery logs and share links) is deleted automatically. If you start a new subscription before that date, nothing is deleted.
  • Subscription and billing records: 10 years, as Italian law requires for accounting records (art. 2220 of the Civil Code). Only what that needs is kept: plan, period, dates, amounts and order or transaction IDs, with no lead data. Waffo keeps its own transaction records as merchant of record.
  • Opt-outs from offers: a hashed copy of the address, kept for as long as the opt-out applies.
  • Leads: 12 months by default. You can choose from 1 to 24 months in your workspace settings.
  • Runs that did not lead to a contact: 30 days. Anonymous totals remain.
  • Share links: 90 days by default (you can set 1 to 365 days), and you can delete them at any time.
  • Delivery logs: 90 days.
  • When you delete a lead or a workspace, the personal data in those leads is erased immediately, and the rest of the record is removed within the hour.

These deletions run automatically every hour. Deleted data can remain in Cloudflare's database backups (point-in-time recovery) for up to 30 days before it is overwritten.

12. Your rights

Under the GDPR you have the right to be informed, and the rights of access, rectification, erasure, restriction of processing, data portability and objection, plus the right to withdraw consent at any time. Write to [email protected] and you will get an answer within 30 days.

From the console you can export or delete a single lead, and export or delete a whole workspace. Visitors should contact the business whose website they used. If a visitor writes to Dario, he passes the request on and helps that business answer.

You can also complain to the Garante per la protezione dei dati personali (garanteprivacy.it) or to the data protection authority where you live.

13. Age

ALID is a business service for people aged 18 and over. It is not aimed at children, and Dario does not knowingly collect their data. If you think a child has provided data, write to [email protected] and it will be deleted promptly.

14. Third-party links and services

If a visitor uses "Share with your AI agent", the readout opens in or is pasted into an assistant such as ChatGPT or Claude. That is the visitor's own choice, and that service's privacy policy applies. Waffo's checkout pages follow Waffo's privacy policy. This policy covers only the data ALID handles directly.

15. Changes to this policy

For material changes, you get an email at least 30 days before they take effect, and the date at the top of this page is updated.

16. Contact

  • Privacy and support: [email protected]
  • Dario Cositore, Via Chiosi, 26012 Castelleone (CR), Italy

Related: Terms · DPA · Site privacy policy

Dario Cositore · dariocositore.com