Privacy Policy

Controller

Gruber Evi, Via Gaudententurm 12, 39020 Parcines (BZ), Italy
VAT ID IT03066110218 · info@smartcms.ai

No data protection officer has been appointed; appointment is not mandatory for this processing.

What we process, and why

• Contact and access enquiries — name, email address, message, business name and address, EU/EEA country, optional VAT ID, and confirmations of business use and authority to act. We store access requests, business review notes and their review, invitation and activation history in SmartCMS. Authorized platform administrators use these details to review business eligibility and access. Business details are used for pre-contractual steps and legitimate interests in verifying business eligibility and preventing misuse (Art. 6(1)(b) and (f), as applicable). We send notifications and invitations through Resend. The form itself does not create an account or subscribe you to marketing emails. Your organization and first space are created when you accept an approved invitation and complete setup. Declined or revoked requests are deleted after 90 days, unanswered requests after 12 months; activated requests are retained, but their message is erased after 30 days.
• Account data — email address, name, password hash, verification status. To create and operate your account. Art. 6(1)(b) GDPR (performance of a contract).
• Content you create — entries, media, schemas and everything else you store in a space. To provide the service. Art. 6(1)(b).
• Billing data — plan, subscription status, Stripe customer and subscription identifiers. Card details are handled by Stripe and never reach our servers. Art. 6(1)(b) and 6(1)(c) (statutory retention).
• Server and audit logs — IP address, timestamp, request path, and an audit trail of changes made in the CMS. To operate the service securely and to reconstruct who changed what. Art. 6(1)(f) (legitimate interest in security and traceability).
• Usage statistics — aggregate page views and aggregate interaction events (for example, clicking the product demo or the access request form) via our self-hosted Umami instance, without cookies and without personal data or cross-site tracking. Art. 6(1)(f).

Cookies and local storage

We set only the cookies needed to keep you signed in and to protect sign-in against request forgery (session and CSRF cookies of our authentication system). They are strictly necessary and are not used for tracking.

In the CMS and App Builder, your browser’s local storage keeps interface state on your device: the selected organisation, space and environment, your user ID (to reset that selection when a different account signs in on the same browser), whether the sidebar is collapsed, the chosen App Builder model, pinned content types and the last publish status of an app. Session storage, which is cleared when you close the tab, holds an invitation token until you accept the invitation, a marker that prevents the App Builder from repeating an automatic fix, and — only if saving an entry fails — a copy of the unsaved changes so the editor can tell you about them. This data stays in your browser, is not sent to third parties and is not used for tracking.

Usage statistics (Umami, see above) work without cookies and without storing anything on your device.

Because these technologies are strictly necessary for the service or store nothing on your device, no consent banner is required (art. 122 of the Italian Privacy Code, art. 5(3) of Directive 2002/58/EC).

Recipients

The following service providers receive data when the corresponding features are used. Provider location and processing location are listed separately. For information about applicable contractual safeguards for international transfers, contact info@smartcms.ai.

Error monitoring (Sentry) and usage statistics (Umami) run on our own infrastructure and are not third-party recipients.

The same list is also published as a separate subprocessor list.

AI features and your content

When you use an AI feature, the content you submit for that operation is sent to the AI provider selected for your space (see the table above). Except for Mistral AI (France), those providers are based in the United States. Mistral text requests use its EU regional inference endpoint; this does not guarantee regional processing of account, billing or other operational metadata. AI features are optional: if you do not use them, no content is sent to them.

If your space has no own key for the selected provider, smartcms sends the content of that operation to Together AI (CMS AI features), Anthropic (App Builder) or Google (Nano Banana Pro image generation) under smartcms’s own provider account, as our processor. We record usage metadata (feature, model, token counts, cost) per space to enforce the allowance; the content itself is not stored for this purpose.

Retention

Account and content data are kept for as long as your account exists and are deleted when you delete your organisation. Billing records are kept for the statutory retention period under Italian law. Server logs are kept for a short operational period; audit records are kept for the lifetime of the space they belong to.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection under art. 15–21 GDPR, and the right to withdraw consent at any time. Write to info@smartcms.ai. You may also lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali.