Privacy policy
This text describes, in plain language, what personal data Vetro Source Lab collects when you write through this site, what it is used for, how it is handled and what rights the law gives you. Vetro Source Lab is a small four-person research lab with no marketing department.
Who is responsible
Vetro Source Lab is a small lab studying how generative AI systems retrieve, cite and misattribute Italian companies, brands and places. For the purposes of the General Data Protection Regulation (GDPR) and Legislative Decree 196/2003 (the Italian Personal Data Protection Code, as amended), the controller of the personal data described below is the operator of the site geo-italy.org. For any privacy question or to exercise a right, write to hello@geo-italy.org.
What is collected
When you send the contact form, Vetro Source Lab receives:
- Your name and email address — so we can reply to you by name.
- The message you write: your case description, a prompt example, the business or place involved and any public sources you choose to share — only what you decide to include.
This data is used only to answer your request. You are not added to any mailing list, and your data is not shared with third parties (except the payment processor described below, where applicable). Vetro Source Lab also stores the date and time the form was sent, together with a SHA-256 digest of your IP address plus a salt — this protects the form against automated submissions. The IP address itself is never logged, nor are browser fingerprints or device metadata.
What is not collected
- No tracking cookies are used. The analytics tool works without cookies and stores no per-user identifier.
- No remarketing pixels, marketing-automation tags or ad-network trackers are active.
- There is no automated profiling, and no automated decision producing legal effects on you.
- Personal data is neither sold nor transferred to commercial partners. That is not the revenue model.
Legal basis for processing
Messages sent through the form are processed on the basis of Article 6(1)(b) GDPR (pre-contractual steps taken at the data subject's request). The IP digest, which protects the form against abuse, relies on Article 6(1)(f) GDPR (legitimate interest). Payment-status data, where it exists, is processed on the contractual basis.
How long data is kept
- Form messages: kept during the related work plus 24 months, to preserve the context of the exchange; they are then deleted. Messages that lead to no work are kept for 12 months and then deleted.
- Payment records: kept for the period required by applicable tax and accounting law, then deleted.
- IP digests: kept for 90 days — long enough for abuse protection — then deleted.
- Email exchanges: kept while the relationship is active, or for 24 months after the last contact — whichever is longer.
Your rights
Under the GDPR and the Italian Personal Data Protection Code, you can request access to your data, its rectification, erasure, portability, restriction of processing, or object to it. For any of these requests, write to hello@geo-italy.org. A reply follows within one month. If you consider that the processing does not comply with the law, you have the right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection authority), or with the supervisory authority of your country of residence.
International transfers
The infrastructure serving this site is located in European Union (Germany). When additional processors (email provider) operate outside the European Union, those transfers rely on standard contractual clauses and on the safeguards published by the recipient.
Changes to this notice
This notice is updated when data-processing practices change significantly. The "Updated" date at the top of the page marks the version in force. Substantive changes are flagged on the site home page for 30 days, so returning visitors can see them.