Privacy notice
Privacy policy
Last updated: 3 November 2026. Notice under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). The Italian version is the legally binding one.
Data controller
Cerroni Alessio, sole proprietorship trading as Nexora, Via Alcide De Gasperi 9, 00020 Pisoniano (RM), Italy, VAT IT18643931001. Email: [email protected], phone +39 351 988 4757.
What data we process and why
1. Browsing the site
The servers hosting the site record technical data (IP address, browser type, requested pages, date and time) needed to run the site and protect it from abuse. Legal basis: legitimate interest in security and service operation (Art. 6(1)(f)). Logs are kept only as long as necessary and are not used for profiling.
2. Contact form
If you write to us through the form we process your name, email and, if provided, phone, business, current website, budget and message, to reply to your request and prepare a possible proposal. Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b)). Data is kept for 24 months after the last contact if no working relationship follows; under a contract, for as long as tax law requires.
Only if you tick the optional box will we also use your email to send you Nexora updates and offers. Legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time by replying to one of our emails or writing to us.
3. Free site audit
When you use the “Audit my site” tool we only process the website address you enter, to analyse its public page and show you the result. The result is cached for 24 hours so the analysed site is not overloaded, and it is not linked to you. Your IP address is used only to limit abuse.
4. Business outreach to companies and professionals
This section is also the Art. 14 GDPR notice for businesses that receive a first proposal from us (email, call, message or visit) without having contacted us first. Data and sources: the business’ published contact details (business email, phone, address, website, business social profiles), its category and a technical analysis of its public website, taken from OpenStreetMap, Google Places and the business’ own website; every email states where we found the contact. Legal basis: legitimate interest in developing business-to-business clients (Art. 6(1)(f)), balanced by few, personalised contacts that are easy to refuse. How we contact you: one personalised first email to the published business address and, if there is no reply, a single reminder a few days later, prepared with the help of an automated system and sent during working hours in limited numbers; no newsletters or recurring promotional messages without consent, no SMS; first WhatsApp messages are written and sent by us personally. An automated score of the business’ public information helps us choose whom to approach; it has no legal effect and concerns the business, not the person. If we send you a link to your website analysis or to a homepage draft prepared for your business, we record whether and when it is opened; the draft uses only the business’ public information and is reachable only through that link. Retention: up to 6 months without contact, up to 12 months after the last unanswered contact; Google Places data is refreshed or deleted within 30 days. Objection: reply “no thanks”, use the “I don’t want to be contacted again” link on the analysis page, or write to [email protected]: we stop at once, delete the data within 7 days and keep only a one-way hash so that we never contact you again.
Who processes data on our behalf
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | website hosting, attack protection, cookieless anonymous analytics | EU/USA (Data Privacy Framework and standard contractual clauses) |
| Google Ireland Ltd / Google LLC | finding businesses on Google Maps, website speed analysis (PageSpeed) and the email inbox (Gmail) we write from and receive replies in | EU/USA (Data Privacy Framework and standard contractual clauses) |
| Anthropic PBC | artificial intelligence (Claude) that analyses the business’ public information and helps draft messages, without using it to train models | USA (standard contractual clauses) |
| Telegram Messenger Inc. | notifying the controller of requests, replies and appointments | Non-EU (standard contractual clauses) |
| Calendly, LLC | booking intro calls (name, email and the answers you enter in the booking form) | USA (Data Privacy Framework and standard contractual clauses) |
| Stripe Payments Europe Ltd | online deposit payment by card or SEPA | EU/USA (Data Privacy Framework and standard contractual clauses) |
| TeamSystem S.p.A. (Fatture in Cloud) | issuing and storing e-invoices with the billing details you give us when accepting a proposal | EU (Italy) |
To prepare analyses and outreach copy we may use AI services (Anthropic, PBC), to which we only send public business information, never contact form data.
Your rights
You can request access, rectification, erasure, restriction, portability and object to processing (Arts. 15–22) by writing to [email protected]. We reply within 30 days. You can also lodge a complaint with the Italian data protection authority (garanteprivacy.it) or the authority in your country.
Cookies
The site only uses technical tools needed to work and no profiling cookies. See the cookie policy.