Privacy policy
In short. Your account data (name, email, sign-ins) stays private: we keep it on our servers in Italy and we don't send it to the external services used by the apps. The content you choose to enter in the apps, on the other hand, depending on the feature and the artificial intelligence model used, may be processed by external providers, including outside our servers and outside the European Union (see point 5). Every app that does this tells you, naming the provider. As a rule we don't keep the messages you exchange with the artificial intelligence: they pass through our servers only to be processed. The exception is vizora's Designer: the requests you make to it and its results stay linked to the object for 30 days, so you find them again when you reopen it, from another device too. Likewise, the Power BI semantic models you load into vizora stay for 30 days, cleaned of connections, data and security rule values (point 6). If the AI provider keeps a copy, it does so under its own terms and data policy.
What you choose to publish for everyone, such as a work in the vizora Community, can instead be seen by anyone on the internet: you sign it with a public name you choose, never with your account data (points 2, 5 and 6).
1. Data controller
The data controller is Jeremy Maienza, a private individual who runs the veiora.it website and its applications personally and on a non-commercial basis. For any request about your data: cloud.ai@veiora.it. No data protection officer (DPO) has been appointed, as one is not required for this type of activity.
2. What data we process
| Category | Data | Where it comes from |
|---|---|---|
| Google account | name, email address, unique identifier of your Google account and the temporary access code that Google issues at each sign-in (it expires after about an hour and is not used for anything else); date, version and language of the privacy policy and terms of use you accepted | from Google, when you choose "Continue with Google" (we never receive or store your Google password) |
| Email and password account | first name, last name, email address and password, stored only in a non-reversible encrypted form (nobody, not even the data controller, can read it); verification codes and links sent to your email to confirm the address, sign in or set a new password; date, version and language of the privacy policy and terms of use you accepted | provided by you when you sign up |
| Passkeys (only if you add one to your email account) | the passkey's public key and identifier, the type of device or keychain that stores it (for example "iCloud Keychain"), the date it was created and last used. The face, fingerprint or PIN you use to unlock the passkey stay on your device: we never receive them, and the private key never leaves the device or keychain that holds it | generated by your device when you create the passkey and by the service when you use it |
| Permissions | the veiora.it apps you are enabled for, account status (active/suspended), date of last sign-in | generated by the service |
| App access requests | the app you ask for, the optional message you write, date and status of the request (pending, approved, declined, expired), date of the decision and who made it | provided by you when you press "Request access"; the outcome is recorded by the service |
| Messages you write to us ("Write to us") | the type of message (something's wrong, an idea, I like it), the app or site you're writing about, the text you write and the replies you add, the language, whether you want an email notice when we reply; only if you leave the box ticked, the technical details you see before sending (app page, page title, browser and system type, screen size, language, app version, latest errors on the page); date and status of the message and the replies you receive | provided by you when you write from the site or the apps; status and replies by the people who manage the service or the app |
| Technical and security data | IP address, date and time, pages requested, browser type, outcome of sign-ins; a reliability score linked to the IP address and to the email address typed on the sign-in page, calculated from successful and failed sign-ins and used to block repeated attempts; whether the request comes from someone signed in with an account (only yes or no, not which account); for the service emails we send: recipient, subject, date and time (not the text) | recorded automatically by the servers at each visit |
| Browsing data for statistics | from the same requests as the technical data: page visited, date and time, referring site, device type, browser and language, whether the visit is by someone signed in with an account (yes or no) and the country it comes from, derived from the IP address; in addition, from the pages that measure it, how long the page stays in view and how far down you scroll. The page itself sends the latter, without cookies and without storing anything in your browser. They are only used to calculate anonymous daily totals (point 3) | recorded automatically by the servers at each visit |
| Content in the apps | the data you enter yourself in the individual apps you are enabled for (for example texts, questions, files) and the results the apps produce from it | provided by you; the results are generated by the apps, including with artificial intelligence models |
| Use of artificial intelligence in the apps | in the apps that say so (today vizora), for each day: how many requests you make to the artificial intelligence, for which task, with which provider and model, how many tokens they use and what they cost; any daily request limit set for you. Never the text of the requests and the answers | generated by the service while you use the app; the limit is set by the people who manage the app |
| vizora Designer jobs | the requests you make to the Designer (the AI that designs and touches up objects in the Studio) and its results: the steps it takes, the drafts and the proposals, linked to the object it works on | you write the request; the rest is generated by the app with artificial intelligence |
| Semantic models loaded into vizora | the TMDL text of a Power BI semantic model that you paste or load (.tmdl files): names and descriptions of tables, columns, measures, relationships and hierarchies, the DAX formulas, the role names and the translations, with the report vizora derives from it. Before saving it vizora removes connection strings and server names, data written inside tables, the values in row-level security rules and the annotations: the data rows are not there | provided by you; the report is generated by the app, also with artificial intelligence if you use it on the model |
| Content you publish for everyone (vizora Community) | the public name you sign with (you choose it and it doesn't need to be your real name) and your introduction, if you write one; for each work: title, description, the visual object, the data it is shown with (usually made up by vizora with the same shape as yours; your real data only if you choose them), the preview image, the version, the publication and update dates, the work it comes from and how many stars, downloads and remakes it has. They stay linked to your account through its pseudonymous identifier, which is never made public | provided by you when you publish; dates and counts generated by the service |
| Use of the Community | the works you star, those you download for Power BI, those you make yours and those you report, with the reason you choose and the date | recorded by the service when you use these features |
| Visuals downloaded from vizora | for each Power BI file (.pbiviz) you download, a random code written inside the file, with the date, the object or work it comes from and your account. The code doesn't contain your name or your email; Power BI sends us nothing, so we don't know where or how you use the visual | generated by the service when you download the file |
| Technical cookies | see the cookies page | set by the service |
We don't process special categories of data (health, opinions, etc.) and we ask you not to enter them in the apps, nor personal data of other people.
When you try a Community work with your own data ("Try it with your data"), the table you paste or the CSV file you choose stays in your browser and never reaches us; if you have vizora and choose an Excel file, vizora's server reads it to extract the table and doesn't keep it.
3. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, giving you access to the apps you are enabled for, handling your requests to access the apps, providing the features of the apps you use, including through the external services described in point 5 | performance of the service you request, under the terms of use (Art. 6(1)(b) GDPR) |
| Publishing for everyone, under the public name you choose, the works you decide to share in the vizora Community: showing them to anyone, letting people try and download them, counting their stars and downloads | performance of the service you request (Art. 6(1)(b) GDPR): you are the one who publishes, with an explicit confirmation, and you can withdraw your works whenever you like |
| Keeping the Community lawful and fair: receiving reports, hiding a work reported by three different people until a person has looked at it, featuring, hiding or removing works, applying limits against abuse (for example how many works can be published per day) | the data controller's legitimate interest in protecting the people who use the Community and the rights of others (Art. 6(1)(f) GDPR); legal obligations on published content (Art. 6(1)(c) GDPR) |
| Keeping artificial intelligence spending under control and sharing its use fairly: counting each person's requests (task, provider, model, tokens, cost) and applying the daily request limits, the same for everyone or set for one person by the people who manage the app | the data controller's legitimate interest in containing the costs of the service and providing it to everyone (Art. 6(1)(f) GDPR) |
| Protecting the service from abuse, unauthorised access and cyber attacks; handling failures and backups | the data controller's legitimate interest in the security of the service (Art. 6(1)(f) GDPR) |
| Protecting vizora and its visuals from copies and uses the terms of use don't allow: if a visual turns up where it shouldn't, the code written in the file tells which download it comes from | the data controller's legitimate interest in protecting its own software (Art. 6(1)(f) GDPR) |
| Improving the apps: whoever develops them may read again, without your name or email, the requests an app could not answer (for example a question it could not solve), to fix it and help it grow. Every app that does so tells you inside it; these requests stay together with the content they refer to and disappear with it | the data controller's legitimate interest in improving the service (Art. 6(1)(f) GDPR); you can object at any time (point 8) |
| Receiving the messages you write to us (reports, ideas, comments), replying to you and using them to fix and grow veiora.it and its apps | performance of the service you request, to reply to you (Art. 6(1)(b) GDPR); the data controller's legitimate interest in improving the service, to use them in fixes and new developments (Art. 6(1)(f) GDPR). Writing is always your choice and you can delete your messages whenever you like |
| Understanding how the site and the apps are used, to improve them: anonymous daily totals of visits, duration, pages viewed, referring sites, countries, device types and paths between the site, the sign-in pages and the apps, and how many accounts use each app, keeping visits by people signed in with an account, visits by guests and tests run by our own server separate. To calculate them, the server groups the requests of the same visit using a fingerprint of the IP address and browser that changes on every run and is never stored; it derives the country from the IP address with a public table kept on our server (IP Geolocation by DB-IP), without sending the address to anyone: only the name of the country remains in the totals. The totals contain no IP addresses, accounts or identifiers and cannot be used to recognise you, not even from one day to the next. The tool is our own (no third-party service), only veiora.it's administrators see the totals, and they are not used to profile you | the data controller's legitimate interest in improving the service (Art. 6(1)(f) GDPR); you can object at any time (point 8). If your browser sends the "Global Privacy Control" or "Do Not Track" signal, pages don't send time in view and scrolling |
| Sending you service communications related to your account (sign-in codes, address confirmation, new password, notices when you add or remove a passkey, confirmation of a deletion request, outcome of your app access requests, a welcome email when you create your account and when you're given access to an app, in your language, a notice when we reply to one of your messages, if you ask for it). Our emails don't load images from the internet and don't record whether you open them | performance of the service you request (Art. 6(1)(b) GDPR) |
| Answering your requests and complying with legal obligations or requests from the authorities | legal obligation and legitimate interest (Art. 6(1)(c) and 6(1)(f) GDPR) |
The data is not used for advertising, marketing or profiling, it is not sold or passed on to third parties for their own purposes (the providers listed in point 5 process it only on behalf of the data controller) and it is not subject to automated decisions that produce legal effects concerning you.
4. Obligation to provide the data
Name and email are needed to create the account: without them, you can only browse the public pages of the site and the apps (for example the vizora Community). A public name is only needed if you want to publish in the Community.
5. Who can access the data
- The data controller and the people authorised by them and bound to confidentiality (for example those who develop and maintain the apps), only as far as their activities require.
- The people who manage an app (the app's managers, authorised by the data controller and bound to confidentiality): if you ask for access to that app, they see your name, your email and the message you write, on a restricted page of the site, to decide whether to grant it. The managers of the same app also see which of them decided the requests of the last 30 days. If you write a message about that app ("Write to us"), they read it together with the technical details you attach, but without your name or email, and they reply to you from the same restricted page. The notification emails they receive don't contain this data. To moderate the Community, the people who manage vizora also see hidden works, with how many reports they received and for what reason, but not who made them; to keep an eye on spending they also see, with your name and email, how many requests you make to the artificial intelligence, of what kind, how many tokens they use and what they cost, and they can give you your own daily request limit (even zero). They don't see the text of the requests and the answers, nor the Designer's jobs, nor the semantic models loaded.
- The veiora.it apps you are enabled for receive a pseudonymous identifier of your account and, only if they need them to work, your name and/or your email: each app only sees the users authorised to use it.
- Anyone on the internet: what you publish in the vizora Community (your public name, your introduction, the works with their data and images) can be seen by anyone, even without an account, and may appear in search engines; people with vizora can download the works and make their own copy. Your account with its name and email, your other content and who stars, downloads or reports are never made public: for each work only the totals are shown.
- Providers processing data on behalf of the data controller (processors): Oracle (Oracle Cloud Infrastructure), which provides the server where the data is stored, located in Italy (Milan); Aruba S.p.A. (Italy), for the domain and the service email.
- External services used by the apps (processors): some app features, for example those based on artificial intelligence models, send the content you enter or the files you upload to an external provider, so that it can process them and return the result. The provider only receives the content needed for the feature you are using, never your account data (name, email, identifier), and processes it only to provide that feature, without using it to train its own models. Whether and for how long it keeps it is set by its own terms and data policy: veiora.it doesn't keep a copy of what it sends (only the content listed in point 6 remains, such as vizora's Designer jobs and semantic models). When you use artificial intelligence on a semantic model, the provider only receives its cleaned structure: never data rows, server names or security rule values. Every app that uses external services says so inside the app, before you use them, with the provider's name and a link to its privacy policy.
- Google: when you sign in with Google, authentication takes place on Google's systems, and Google acts as an independent controller under its own privacy policy (policies.google.com/privacy).
Your account data stays in the European Economic Area (EEA). The content you send to the apps' external services, however, may also be processed outside the EEA (for example in the United States): in these cases the transfer is made to countries for which the European Commission has adopted an adequacy decision (for the United States, to providers certified under the EU-U.S. Data Privacy Framework) or on the basis of the standard contractual clauses approved by the Commission (Articles 45 and 46 GDPR), a copy of which you can request from the data controller. Any transfers made by Google for its own authentication service are governed by its privacy policy. What you publish for everyone in the Community, on the other hand, can be seen and downloaded from any country.
6. How long we keep it
| Account, permissions and record of acceptances | as long as the account exists. If you request deletion from the site, the account is deactivated (usually within a few minutes) and deleted 7 days after deactivation (a safety period against requests that didn't come from you); if you request it by email, we delete it within one month |
| Passkeys | until you remove them from the "My account" page or as long as the account exists |
| App access requests | 90 days after the decision (requests with no answer expire after 30 days and are erased 90 days later); in any case they are erased with the account |
| Messages you write to us and their replies | 12 months after the last update; you can delete them earlier yourself from the "Write to us" page; in any case they are erased with the account and when the app they're about is closed |
| Data in the apps | as long as the account exists; when it is deleted the apps are notified and erase the linked data within 30 days |
| Public name, works you publish and their data | each work until you withdraw it (you can do so whenever you like, from its page) or we remove it because it breaches the terms of use; your public name and introduction as long as the account exists. If you lose access to vizora or your account is deactivated, your works and your author page disappear from the public pages, usually within a few minutes, and come back if access returns; if you delete the account they are erased with the rest of the app's data. Copies that others have already downloaded or made theirs remain theirs, and search engines may still show a copy of the page for some time |
| Stars, downloads and reports | as long as both the work they refer to and your account exist; a work's reports are also erased when the people who manage vizora have looked at it and make it visible again |
| Codes of the visuals downloaded from vizora | 24 months from the download; erased sooner if you delete your account |
| Content sent to the apps' external services, including the messages you exchange with the artificial intelligence (your requests and its answers) | veiora.it doesn't keep it: it passes through our servers only for the time needed to process it. Only the content you choose to save in the apps remains, vizora's Designer jobs and semantic models (next rows) and, where an app says so, the requests it couldn't answer (point 3). Any retention by the AI provider is up to the provider, under its own terms and data policy (shown in the app together with its name); it is not deleted automatically when you delete the content or the account |
| vizora Designer jobs (the requests you make to it and its results: steps, drafts, proposals) | they stay linked to the object for 30 days, so you find them again when you reopen it, from another device too; they are erased sooner if you delete the object or the account |
| Semantic models loaded into vizora (the cleaned structure and the report vizora derives from it) | 30 days from loading; they are erased sooner if you delete the model or the account |
| Count of artificial intelligence requests (per day: task, provider, model, tokens, cost) | 90 days; a request limit set for one person until the people who manage the app remove it. Both are erased with the account |
| Technical data and access logs, internal technical alerts | 90 days |
| Visit statistics (anonymous daily totals) | 25 months; the data they are calculated from are the technical and browsing data, kept for 90 days |
| Backups | deleted automatically within 14 days |
| Unconfirmed email sign-ups | deleted automatically after 24 hours |
| Codes and links sent by email | single use: 10 minutes (sign-in codes), 30 minutes (new password), 60 minutes (address confirmation) |
| Reliability score (IP address and typed email address) | 24 hours |
| Log of service emails sent (recipient, subject, date) | 90 days |
| Identifier of a deleted account | 90 days, in pseudonymous form (without name or email), only to complete the deletion in the apps |
7. How we protect the data
Encrypted connections (HTTPS), server access restricted and protected by cryptographic keys, apps isolated from each other, automatic security updates, regular backups and continuous monitoring of the services.
8. Your rights
At any time you can request: access to your data and a copy of it (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and you can object to processing based on legitimate interest (Art. 21).
- Deleting the account yourself: sign in to veiora.it → My account → Delete my account. See Managing your account.
- What you publish in the Community: you update or withdraw your works and change your public name and introduction yourself, in vizora (from the work's page and from your author page).
- All other requests: write to cloud.ai@veiora.it from your account's email address. We reply within one month (Art. 12 GDPR).
You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the EU country where you live.
9. Minors
The service is reserved for people aged at least 18. If we find out that an account belongs to a younger person, we delete it.
10. Changes
Any changes to this notice will be published on this page with the new update date. In the case of significant changes, we will let you know the next time you sign in or by email.