Privacy Policy
How AwrAiter processes personal data, under Regulation (EU) 2016/679 (GDPR).
Last updated: 2026-08-19
1. Controller
The data controller is Mediazione Italia S.r.l., registered office Largo Guido Donegani 2, 20121 Milano (MI), Italia, VAT and tax code 14278510962, PEC mediazioneitaliasrl@legalmail.it, email privacy.mediazioneitalia@gmail.com.
This policy covers the awraiter.ai website and the AwrAiter panel. Where you use AwrAiter to process personal data contained in your own audience's content, you are the controller of that data and we act as your processor under section 9.
2. What data we process
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Telegram user ID, username, first and last name, profile photo, interface language | Telegram login widget, when you sign in |
| Team | team name, members you invite, their role and channel permissions | you |
| Channels and content | channels you connect, their identifiers and titles, content plans, drafts, published posts, images and video you upload | you and the Telegram API |
| Statistics | subscriber counts, views, reactions and per-post metrics of your channels | Telegram |
| Billing | plan, subscription status, renewal date, invoices, credit balance and usage | Stripe and our systems |
| Technical | IP address, browser and device data, session cookies, server and error logs, API and MCP request logs | automatically, when you use the Service |
| Usage analytics | which pages and features you open and actions such as publishing a post or running an analysis, tied to your account id and a browser identifier — never the content of your posts | only if you accept analytics in the panel |
| Correspondence | messages you send us by Telegram or email | you |
We do not ask for and do not want special categories of data (health, beliefs, political opinions). Do not upload them into the Service. We do not collect card numbers: they are entered on Stripe's own pages.
3. Why we process it, and on what legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Creating your account, running the panel, publishing your posts, showing your statistics | performance of a contract — Art. 6(1)(b) |
| Taking payment, renewing or cancelling a subscription, issuing invoices | contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Keeping the Service secure: rate limits, abuse and fraud detection, logs | legitimate interest in protecting the Service and its users — Art. 6(1)(f) |
| Support, and service messages such as the renewal reminder | contract — Art. 6(1)(b) |
| Product analytics: seeing which features are used, so we know what to improve | consent — Art. 6(1)(a), given in the banner and withdrawable at any time in Settings → General → Analytics |
| Tax, accounting and record-keeping obligations | legal obligation — Art. 6(1)(c) |
| Marketing messages, if we ever send any | consent — Art. 6(1)(a), withdrawable at any time |
4. AI processing
When you use a feature that writes, rewrites, translates or analyses text, the material you selected — a draft, a source article, a channel's post history or its statistics — is sent to a third-party AI provider so that it can produce the result. Nothing is sent to an AI provider unless you trigger such a feature or an automation you configured triggers it.
The providers we may use are listed in section 5. They act as our processors and are contractually barred from using your material to train their models. We do not use your content to train models of our own.
Separately, your account settings contain an optional consent: "Allow anonymized use of my published posts to improve the service". It is off by default. If you enable it, we may use your published posts, stripped of personal identifiers, to improve the quality of the service's generation features. You can withdraw this consent at any time in the same setting, with effect for the future; withdrawal does not affect processing that happened while the consent was active (Art. 6(1)(a), Art. 7(3) GDPR).
AI features do not make decisions producing legal or similarly significant effects about you: they produce drafts and analyses that a human — you — decides whether to publish. There is no automated decision-making in the sense of Art. 22 GDPR.
5. Who receives the data
We do not sell personal data and we do not disclose it to undetermined recipients. We use the following processors and recipients:
| Recipient | Role | Location |
|---|---|---|
| Hetzner Online GmbH | hosting of servers and databases | Germany (EU) |
| Telegram FZ-LLC | the platform your channels live on: login, publishing, statistics | United Arab Emirates / EU |
| Stripe Payments Europe, Ltd. | payments, subscriptions, invoices | Ireland (EU), with transfers to the United States |
| Anthropic PBC | AI text generation and analysis | United States |
| OpenAI Ireland Ltd. / OpenAI, L.L.C. | AI text generation | Ireland (EU) / United States |
| Alibaba Cloud (Qwen) | AI translation and text generation | Singapore / EU |
| OpenRouter, Inc. | routing of AI requests to the model chosen | United States |
| Perplexity AI, Inc. | AI search and research features | United States |
| Google LLC | export to Google Sheets, only if you connect your Google account | United States |
The exact set of AI providers in use can change as we add or drop models; this table is kept current and we announce material changes on this page. Data may also be disclosed to our accountants and lawyers, and to public authorities where the law requires it.
6. Transfers outside the EEA
Our servers and databases are in Germany. Some processors listed above are outside the EEA. For those transfers we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one applies, together with the supplementary measures required by Art. 44 ff. GDPR. For personal data covered by UK law the Clauses apply as amended by the ICO's International Data Transfer Addendum; for data covered by the Swiss FADP they apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner. You may request a copy of the safeguards at the addresses in section 1.
7. How long we keep it
| Data | Retention |
|---|---|
| Account, team, channels, plans, posts, uploaded files | while the account exists; deleted when you delete the account |
| Statistics collected about your channels | while the account exists |
| Invoices and accounting records | 10 years, as required by Italian tax law |
| Server, API and security logs | up to 12 months |
| Backups | rolling, overwritten within 30 days |
| Support correspondence | up to 24 months after the last message |
After deletion, residual copies can persist in backups until the backup rotates out, and we keep only what a legal obligation or the defence of a legal claim requires.
8. Your rights
Under Articles 15 to 22 GDPR you may ask for access to your data, rectification, erasure, restriction, portability, and you may object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time without affecting what was done before.
Two of these you can exercise yourself, immediately, in the panel:
- Settings → Account → Download my data — a machine-readable export of your account, team, channels, plans and posts.
- Settings → Account → Delete account — permanent erasure of the account and, where you are the last owner, of the team's channels, content plans, posts, reports and uploaded files.
For anything else write to privacy.mediazioneitalia@gmail.com. We answer within one month. If you believe we process your data unlawfully you may lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of your country of residence, and you may go to court.
Residents of the United States. The rights above apply to you as well: we honour requests to know what we hold, to correct it, to delete it and to receive a copy, through the same in-panel controls and the same address, and we do not discriminate against anyone who exercises them. The categories we collect are the ones listed in section 2; we collect them for the purposes in section 3 and share them only with the processors in section 5.
We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act, and we have not done so in the preceding twelve months. We run no advertising and no profiling, so there is nothing to opt out of. An authorised agent may submit a request on your behalf with written proof of authority.
9. When we act as your processor
The content you publish, and the audience data you may bring into the Service, are yours. For that material you are the controller and we process it only on your instructions — the instructions you give by using the Service — under Art. 28 GDPR, with the sub-processors listed in section 5. On termination we delete it as described in section 7. A separate data processing agreement is available on request.
10. Security
We apply technical and organisational measures appropriate to the risk under Arts. 25 and 32 GDPR: encryption in transit (HTTPS), session tokens held in httpOnly cookies that JavaScript cannot read, role- and channel-level access control inside a team, secrets held outside the codebase, rate limiting, backups, and access restricted to the people who need it. No system is perfectly secure; if a breach is likely to put your rights at risk we notify you and the supervisory authority as required by Arts. 33 and 34 GDPR.
11. Minors
The Service is not directed at people under 18 and we do not knowingly process their data. If you believe a minor has an account, write to us and we will remove it.
12. Changes
We may update this policy. The current version, with its date, is always on this page; we announce material changes in the panel or by Telegram before they take effect.