Notice
Privacy Policy
Last updated: 22 September 2026
This notice describes how Michele Tornello processes the personal data of those who visit the https://redazio.com site and of those who use the Redazio application at https://app.redazio.com.
1. Data controller
The data controller is Michele Tornello, libero professionista, VAT number 06217000873, Italy.
For any request concerning your data you can write to micheletornello5@gmail.com.
2. What data we process
We process only the data needed to run the service.
- Account data — email address, password (stored in encrypted form) and the optional profile information, such as name and image.
- Access request — the email and the message you send us to ask to join the beta.
- Project and brand data — visual identity, palette, tone of voice, typography, categories, materials and style references that you upload or compose.
- Content — briefs, texts and captions, generated or uploaded images, variants, progress states and scheduling dates.
- Credits — the record of the AI actions performed and of their consumption.
- Assistant conversations — the messages you exchange with the assistant during the session. We do not keep them permanently.
- Technical data — request logs generated by the hosting infrastructure and aggregate, anonymous navigation metrics (see the Cookie Policy).
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing the account and providing the service | Performance of a contract (Art. 6(1)(b) GDPR) |
| Assessing private-beta access requests and replying to you | Pre-contractual measures and performance of a contract (Art. 6(1)(b)) |
| Support, service communications and system security | Legitimate interest (Art. 6(1)(f)) |
| Aggregate, anonymous metrics on how the site works and performs | Legitimate interest (Art. 6(1)(f)) |
| Compliance with obligations laid down by law | Legal obligation (Art. 6(1)(c)) |
We do not use your data for marketing purposes, we do not profile users and we do not sell personal data to third parties.
4. Recipients and transfers outside the EU
To provide the service we rely on specialised suppliers that process data on our behalf as data processors. These are the real suppliers, named here for transparency even where they are integrated into the product invisibly.
| Supplier | Role | Where |
|---|---|---|
| Supabase | Database, authentication and file storage | European Union (Ireland) |
| Vercel | Hosting of the site and of the application, technical logs | USA |
| OpenAI | Image generation and, as a fallback, text generation | USA |
| DeepSeek | Assistant, captions, suggestions and analysis of materials | China |
| Resend | Sending transactional emails | USA |
Transfers to the United States
Transfers to United States suppliers take place on the basis of the EU–US Data Privacy Framework, where the supplier adheres to it, or alternatively of the Standard Contractual Clauses approved by the European Commission.
Transfers to China
Some features — the assistant, caption writing, suggestions and the analysis of uploaded materials — are provided through a supplier established in China. When you use these features, the text you write and, for the analysis of materials, the images you upload are transmitted to that supplier to produce the requested result. The transfer takes place on the basis of the Standard Contractual Clauses, accompanied by an assessment of the applicable safeguards.
If you do not wish to make use of these features, you can simply not use them: the rest of the service (projects, editorial organisation, calendar, approvals) remains available with no transfer to China.
5. How long we keep the data
We keep the data for as long as necessary for the purposes for which it was collected, and in any case no longer than the periods stated here.
| Data | Retention |
|---|---|
| Account and profile data | Until the account is deleted |
| Projects, materials and content | Until the project or the account is deleted |
| Credits record | For the duration of the relationship; then, where due, for the applicable legal obligations |
| Access requests not accepted | Up to 12 months from the decision |
| Assistant conversations | Not kept permanently |
| Infrastructure technical logs | For the limited time provided by the hosting suppliers |
| Backup copies | Up to 14 days, then removed from the rotation cycle |
When the account is deleted, the associated data — projects, content, images and history — is erased. Any copies still present in backups are overwritten within the stated rotation cycle.
6. Your rights
At any time you can exercise the rights provided by Articles 15–22 GDPR:
- access your personal data and obtain a copy of it;
- request their rectification if they are inaccurate or incomplete;
- request their erasure;
- request the restriction of processing;
- object to processing based on legitimate interest;
- receive the data you have provided to us in a structured, readable format (portability).
To exercise them, write to micheletornello5@gmail.com. We will reply within one month.
7. Complaint to the supervisory authority
If you believe that the processing of your data breaches the applicable rules, you can lodge a complaint with the Garante per la protezione dei dati personali or with the supervisory authority of your country of residence.
8. Changes to this notice
We may update this notice to reflect changes in the service or in the law. The version in force is always the one published on this page, with the last-updated date shown at the top.