Privacy notice
This notice explains how personal data are processed when you use Palato, the AI tasting lab for food innovation, in line with Regulation (EU) 2016/679 (GDPR) and the Italian data protection rules.
1. Who is responsible
The data controller is Palato (start-up in formation), represented by Francesco Caracciolo. For any question or request about your data, write to info@palato.cloud.
2. Which data we process
- Account data: name, email address, password (stored only as a one-way hash, never readable), optional job title and phone number, the dates of sign-up, email confirmation and last sign-in.
- Billing data (optional, needed only to invoice a full test): company name, VAT number, tax code, billing address, SDI recipient code and PEC address.
- Consents: the date you accepted this notice and whether you agreed to receive news about Palato.
- Test content: the description of your product, the novelties and prices to test and the profile of your market, plus the synthetic answers generated for your test and the resulting reports. Please do not enter personal data in the test description.
- Technical data: the cookies described in section 7; a one-way hash of your IP address kept for up to 24 hours to limit repeated sign-in, sign-up and password-reset attempts; the access logs kept by the hosting provider.
3. Why, and on which legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Creating and managing your account, running your tests, sending service emails (email confirmation, password reset, test status) | Performance of a contract — 6(1)(b) |
| Invoicing and accounting for full tests | Legal obligation — 6(1)(c) |
| Security of the service and prevention of abuse | Legitimate interest — 6(1)(f) |
| Occasional news about Palato | Your consent — 6(1)(a), which you can withdraw at any time from your account page |
4. Who receives the data
- Hosting provider, which stores the service and its database and delivers its emails, as data processor.
- A provider of AI language-model services, acting as data processor, which generates the synthetic answers. It receives only the text of the test and the fictitious profiles of the synthetic consumers — never your account or billing data. The provider is based in the United States: transfers take place with the safeguards required by Chapter V of the GDPR. The identity of our processors is given to anyone who exercises the right of access (section 6).
- Accountants and public authorities, only as required by law for invoicing.
Your data are not sold and are not used for advertising profiling.
5. How long we keep the data
- Account data and tests: until you delete your account (you can do it at any time from your account page).
- Billing data used in an invoice: for the period required by tax law (ten years in Italy), even after the account is deleted.
- IP hashes used to limit attempts: up to 24 hours. Sign-in sessions: up to 30 days.
6. Your rights
You can ask to access, correct or delete your data, to restrict or object to their processing and to receive them in a portable format (GDPR articles 15–22), and withdraw your consent at any time. Most of this you can do yourself from your account page; otherwise write to info@palato.cloud. You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali.
7. Cookies
Palato uses only technical cookies, which do not require consent:
| Cookie | Purpose | Duration |
|---|---|---|
palato_sess | Keeps you signed in | 30 days, or until you sign out |
palato_csrf | Protects forms from requests sent by other websites | Until the browser is closed |
No analytics, advertising or third-party cookies are used.
8. Other information
Palato is a service for professionals and is not intended for people under 18. The synthetic answers do not lead to any automated decision about you. We may update this notice; the date at the top shows the latest version.