OlivIA privacy notice

OlivIA assistant

On the site you can ask OlivIA, the assistant of the Fratelli Ottaviani S.R.L. mill (the data controller), questions about the catalogue, shipping and the season; OlivIA uses an artificial intelligence service to answer them. The processing serves to give you the assistance you ask for (Article 6(1)(b) GDPR): messages are not used for profiling or advertising and are linked to other activity on the site only in the cases described below. Conversations are also kept to improve the assistance (legitimate interest, Article 6(1)(f) GDPR): the mill may read them to correct the answers, never to profile you. If you have accepted analytics cookies, the site statistics record only yes/no data about your use of OlivIA, for example whether the answer included a product, never the text of the messages.

We process the text of the messages in the conversation, the language, the country, the currency and the page you are writing from, plus a random conversation code. The random conversation code stays in your browser for 15 days from your last message, so you can pick the conversation up again; “New conversation” deletes it. If you are signed in to your customer account, the conversation is associated with that account. When, from an answer, you open a product, add to the cart, or go to the checkout or the contact page, we record only that action. Your IP address and browser type are used only to limit abuse: they are not stored, but used to compute a temporary key that changes every day and is not linked to any other data. Do not enter sensitive data.

The artificial intelligence service is provided by Anthropic PBC (United States), which processes the messages as a data processor to generate the answer; the transfer to the United States relies on the safeguards of Chapter V GDPR provided for in the data processing agreement with the provider. To search the shop's policies and frequently asked questions, the text of your question is also sent to Shopify, the platform the shop runs on, through its search service (Storefront MCP, Shopify Knowledge Base), which processes it as a data processor under the terms already set out in the shop's privacy policy. After each answer, the text of that exchange and of the previous one, without IP address or account data and with e-mail addresses, phone and card numbers masked, is also sent to OpenRouter, Inc. (United States), which processes it as a data processor so that a classification model can assess the answer, for example whether it was useful to you; this transfer also relies on the safeguards of Chapter V GDPR provided for in OpenRouter's data processing agreement.

Texts, cards shown and details of the searches made to answer are deleted 15 days after each message by an hourly clean-up; the technical copy of each answer after 24 hours. For 90 days only technical data without text remain. These are, for example, the language, duration, token count and outcome of each answer, the recorded actions and the classification model's assessments; the association with the customer account is removed as early as 15 days after the last message. After that, these data are deleted too. You can exercise your rights under Articles 15 to 22 GDPR using the contact details given in the shop's privacy policy.