Privacy Policy

This notice explains how Consonant S.r.l. processes personal data in connection with the Ambirama service, under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR").

This is a courtesy translation. The Italian version is the authoritative one.

1. Data controller

The data controller is Consonant S.r.l., registered office at Corso SS. Felice e Fortunato, 62 - 36100 Vicenza (VI), VAT no. IT04146270246, tax code 04146270246.

For anything concerning personal data, write to privacy@ambirama.com or, by certified e-mail, to consonant@pec.it.

2. Who this notice applies to

Ambirama has two distinct categories of data subject, handled differently:

• Service users — people who create an account, manage an organization and publish virtual tours. We are the controller of their data.
• Visitors to published tours — anyone opening a published tour, directly or embedded in a customer's website. For data collected inside a tour we act as processor on behalf of the customer who published it: that customer determines the purposes and means. Those arrangements are set out in the data processing agreement contained in the Terms and Conditions.

3. Data we process

3.1 Account data

E-mail address, first and last name, optional profile picture, preferred language and password (stored only as a cryptographic hash — we cannot read or recover it).

3.2 Organization and billing data

Company name, VAT number, tax code, SdI recipient code, certified e-mail address, postal address, phone number, sector and contact role.

Payment card details never pass through our systems: payments are handled by Stripe, and we retain only the customer identifier needed to link the subscription.

3.3 Uploaded content

Panoramic images, floor plans, text, media files and any other content uploaded within projects. This content remains the customer's property; we process it solely to deliver the service.

Where uploaded content includes third parties' personal data (for example people captured in a panorama), the customer is the controller of that processing and must have an appropriate legal basis for it.

3.4 Technical and security data

System logs generated by the infrastructure, containing IP address, timestamp and request type. The IP address is also used transiently to rate-limit requests and curb abuse: it is never associated with or stored alongside analytics events.

3.5 Tour analytics

For published tours we collect usage statistics designed to be anonymous. Each event contains only:

• a random session identifier generated in the browser and valid for a single open tab, never stored on the device and never linked to an account;
• the device category (desktop, tablet or phone);
• the referring host name only, never the full address, because URL parameters can carry personal data;
• the language, the scene or hotspot involved, and dwell time.

No IP addresses, persistent identifiers or profiling cookies are collected. Raw events are aggregated into daily statistics and deleted immediately afterwards — they do not survive beyond one or two days. The aggregated data, which cannot be traced back to any individual, is retained indefinitely.

3.6 Google Analytics

Only with your explicit consent do we use Google Analytics 4 to understand how the site is used. Until you consent, Google's script is not loaded and no request reaches Google's servers. The cookies involved are listed in the Cookie Policy.

4. Purposes and legal bases

Purpose	Legal basis
Creating and managing your account, delivering the service	Performance of a contract (Art. 6(1)(b))
Managing subscriptions, payments and support	Performance of a contract (Art. 6(1)(b))
Invoicing, tax and accounting obligations	Legal obligation (Art. 6(1)(c))
System security, abuse and fraud prevention	Legitimate interests (Art. 6(1)(f))
Aggregate, anonymous statistics on published tours	Legitimate interests (Art. 6(1)(f))
Google Analytics	Consent (Art. 6(1)(a)), withdrawable at any time

The legitimate interest relied on for tour analytics was assessed taking into account that the processing uses no persistent identifiers, collects no IP addresses and cannot single out a natural person.

5. Recipients and processors

Data is accessible to authorised personnel and to the following suppliers, appointed as processors under Article 28 GDPR:

• Romiltec S.r.l. — operation and maintenance of the private infrastructure that hosts the service and stores uploaded content, with servers located in Italy;
• Resend, Inc. — delivery of service e-mails;
• Stripe — payment and subscription handling;
• Google Ireland Limited — Google Analytics, only where consent has been given.

We do not sell or otherwise transfer personal data to third parties.

6. Transfers outside the EU

Hosting and storage infrastructure is private and located in Italy, and service e-mails are likewise delivered from the provider's European (Ireland) region. Storing your content, account data and service communications therefore involves no transfer outside the European Union. Resend, Inc. is a US-established company: any access to the data from the parent company is covered by the standard contractual clauses.

Stripe and Google may, however, process data in the United States. Such transfers rely on the standard contractual clauses approved by the European Commission and, where applicable, on the EU-US Data Privacy Framework.

7. Retention periods

• Account data — for the duration of the relationship. If an account is deleted, the name and e-mail address are anonymised immediately and irreversibly; what remains is a record stripped of any identifying data, needed to keep linked projects and organizations intact. Deleting an account does not delete the organization or its projects, which belong to the organization.
• Tax documents — ten years, as required by Italian civil and tax law.
• Uploaded content — until deleted by the customer or until the organization is closed.
• Raw analytics events — one to two days, until aggregation.
• Aggregated statistics — indefinitely, in anonymous form.
• Technical logs — for as long as needed for security purposes.

8. Your rights

You may at any time exercise the rights under Articles 15-22 GDPR: access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.

Consent to Google Analytics can be withdrawn immediately from the Cookie Policy.

Requests should be sent to privacy@ambirama.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

If you contact us as a visitor to a tour published by one of our customers, we will forward your request to that customer, who is the controller.

9. Whether providing data is required

Providing account and organization data is necessary to use the service: without it we cannot activate a subscription or issue the tax documents required by law. Consent to Google Analytics is entirely optional and refusing it does not limit the service in any way.

10. Automated decision-making

We do not carry out profiling or automated decision-making producing legal effects on data subjects.

11. Changes

Any updates to this notice are published on this page together with the date of last modification. Registered users are notified by e-mail of substantial changes.