Last updated: 30 September 2026 · Versione italiana
This is an English translation of the Italian privacy policy, provided for convenience. In case of any discrepancy between the two versions, the Italian version prevails.
1. Data controller
The controller of personal data is Alessandro Pagani, who trades under the brand "Agentika" (hereinafter also "Agentika", "we" or "our"). This is an Italian sole proprietorship (ditta individuale) registered for VAT with the Italian Revenue Agency.
- Registered address: Viale Abbadia 16, 29121 Piacenza (PC), Italia
- VAT number: IT01914500333
- Tax code: PGNLSN77R08L219Y
- Email: myagent@agentika.io (general), privacy@agentika.io (privacy and GDPR)
- Phone: +39 338 133 7198
2. Data we collect
2.1 Data provided by the user
- Registration data: first name, last name, email address, company name
- Company profile: description of the business, industry, brand values, communication guidelines
- Content created: texts, captions, hashtags and editorial plans generated on the platform
2.2 Data from Meta (Facebook / Instagram)
When you connect your account through Facebook Login, we access the following data through Meta's APIs, exclusively for the permissions you explicitly grant on the OAuth consent screen:
- pages_show_list: the list of Facebook Pages you manage, so that you can select the one linked to the Instagram account to be managed with Agentika.
- instagram_basic: information about the linked Instagram Business profile (username, biography, profile picture, number of followers) for the dashboard and for post previews.
- instagram_content_publish: the ability to publish posts, carousels, reels and stories on the Instagram Business account, exclusively when you explicitly start publishing from the Agentika interface.
- instagram_manage_insights: metrics of published posts and of the Instagram account (likes, comments, reach, impressions, story navigation) for the analytics dashboard and for AI suggestions.
- business_management: read-only access to Business Manager assets so that you can select and manage multiple Instagram Business accounts under the same portfolio.
What we DO NOT do:
- We do not access private messages (DMs) or conversations
- We do not read the personal data of your followers (names, profiles, contacts)
- We do not manage advertising campaigns (we do not request ads_management)
- We do not sell, share or aggregate data with other companies
- We do not use Meta data to train artificial intelligence models
2.3 Data from LinkedIn
- When you connect your LinkedIn Company Page, we access: published posts, metrics (views, likes, comments, shares), company page information. We do not access personal profiles or connections.
2.4 Data collected automatically
- Usage data: pages visited, features used, session timestamps
- Technical data: browser type, operating system (only to ensure the service works correctly)
3. How we use the data
- Providing the service: AI content generation, editorial planning, publishing on social media, performance analysis
- Improving the service: aggregated and anonymous analysis to improve the AI algorithms
- Communications: service-related notifications, platform updates
We do not sell your data to third parties. We do not use your data for targeted advertising.
4. Artificial intelligence
Agentika uses artificial intelligence models from third-party providers. There are four of them, with different tasks:
- Anthropic (Claude models): writes texts, captions, hashtags, editorial plans and analyses; describes the images you upload to the archive.
- Google (Gemini models): generates and edits images and graphics; describes the videos you upload to the archive.
- OpenAI: turns the textual descriptions of images into numerical representations used to search the archive.
- Voyage AI: turns the images themselves into numerical representations used for visual search in the archive.
Depending on the feature you use, the following are sent to these providers: the texts you write to the assistants and their replies, your brand profile and guidelines, the company knowledge base, drafts and captions, the editorial strategy, the metrics of your social channels, the public posts of the competitors you monitor, the public content of your website and of your Instagram profile (during onboarding), the images and videos in your archive. We do not send the models your credentials, your social media access tokens or your billing data.
All four providers process the data in the United States: see section 6 on how this transfer is governed.
On the use of your data to train the models:
- Anthropic and OpenAI do not use data received through their programming interfaces to train their models; this is a contractual commitment. They retain inputs and outputs for a maximum of 30 days for security and abuse-prevention purposes, then delete them.
- Google does not use the data to improve its products when the service is paid, as in our case.
- Voyage AI: the data processing agreement referred to in its terms of service prohibits it from using personal data for purposes other than the service. Its general terms also provide, for all content transmitted, for its use to train its own models unless the customer explicitly opts out, an opt-out we have exercised: the data we send it are deleted immediately after processing.
The data sent to the models are limited to what is needed for the individual request and are subject to the security measures of the respective providers.
5. Data sharing and subprocessors
To provide the Service we use the providers listed below, who process data on our behalf. For each of them we state what it is used for, which data it receives and where it is based. The list is the same one referred to in the Terms of Service (art. 8.1).
5.1 Providers based and processing data in the European Union
- Supabase, Inc. (database, authentication) - stores all application data: profiles, content, calendar, conversations with the assistants, metrics, encrypted OAuth tokens, access logs. Our project is hosted on Amazon Web Services infrastructure in the Ireland region (eu-west-1). Supabase is a US company: for technical support outside the EU, the data processing agreement with standard contractual clauses applies.
- n8n GmbH (n8n Cloud, workflow orchestration) - runs the integrations with social networks, AI models and the other providers: all processed data pass through it. Execution logs, which may include the content of requests, are retained for 30 days. Instance hosted in Frankfurt, Germany (Microsoft Azure infrastructure).
- Aruba S.p.A. (Italy) - hosting of the website and storage of media files (images, videos, generated graphics) on servers in Italy; sending of emails related to demo requests and beta programme bookings.
- Brevo SAS (Paris, France) - sending of service emails: email address, name and content of the notifications (calendar summary, welcome email with temporary password, usage alerts, weekly proposals). Data processed in the EU.
- Nifty Software GmbH (Placid, Austria) - composition of graphics and videos from templates: receives the texts to be printed and the addresses of the images to be used; the resulting file is copied to our servers.
- Stripe Payments Europe Ltd. (Dublin, Ireland) - payments and subscriptions: email address, company name, billing address, payment method (entered directly on Stripe's pages, never on Agentika), invoice history. Stripe also processes data in the United States through its group companies: see section 6.
- Meta Platforms Ireland Ltd. (Instagram Graph API, Facebook Login) - publishing and analysis of posts on your Instagram and Facebook channels.
- LinkedIn Ireland Unlimited Company (LinkedIn API) - publishing and analysis of posts on your LinkedIn page.
5.2 Providers processing data in the United States
- Anthropic PBC (Claude models) - see section 4 for the data transmitted. Does not use the data for training; maximum retention 30 days.
- OpenAI (numerical representations of texts) - descriptions and tags of archive images, search text. Does not use the data for training; maximum retention 30 days.
- Voyage AI, Inc. (Palo Alto, MongoDB group; numerical representations of images) - the images in your archive and video previews, search text. On training, see section 4.
- Google (Gemini models; Google Drive integration) - for Gemini: the generation instructions, the photos, logos and sample images to be edited, the videos to be described. For Google Drive, only if you connect your account: the list and content of the files in the folder you choose to import. The contracting party for the European Union is Google Ireland Ltd.; processing also takes place in the United States.
- SideGuide Technologies, Inc. (Firecrawl, San Francisco) - reading of your website during onboarding and of the project pages you import: receives the address and returns the public content of the page. Servers in the United States; does not apply an automatic deletion period to the data received.
- AlphaAI Technologies, Inc. (Tavily) - web searches requested by the assistants: receives the search text, which may contain the name of your brand or your industry. Stores searches on servers in the United States and may use them to improve its own service.
- Cloudflare, Inc. (proxy to the Claude models) - every request addressed to Anthropic passes through it so that it can be attributed to the right customer and its usage counted. It does not store the content of the requests. The service runs on Cloudflare's global network, with no regional restriction.
We do not sell, rent or transfer your data to third parties for commercial, profiling or advertising purposes.
6. Transfer of data outside the European Union
Your data are stored in the European Union (Ireland, Germany, Italy). Some of them are, however, processed in the United States by the providers listed in section 5.2, whenever you use a feature that requires it: writing with the assistants, generating or searching images, analysing the archive, reading your website, running a web search, paying the subscription. The transfer concerns the content described in sections 4 and 5.2, not credentials or access tokens.
For each provider, the transfer is based on one of the safeguards provided for by the GDPR:
- EU-U.S. Data Privacy Framework adequacy decision (art. 45 GDPR) for the providers that participate in it: Anthropic, Google, Cloudflare, Stripe, Meta.
- Standard contractual clauses approved by the European Commission (art. 46 GDPR), included in the data processing agreements: OpenAI, Voyage AI, Supabase, LinkedIn, Stripe (in addition to the Data Privacy Framework).
- No formal safeguard, at present: Firecrawl and Tavily do not participate in the Data Privacy Framework and do not offer standard contractual clauses to customers of our type (Tavily reserves them for enterprise contracts). We are telling you because that is how it is. We do not send these two providers any data identifying you or your customers: Firecrawl only receives addresses of public web pages, Tavily only the text of the searches formulated by the assistants. We are assessing whether to replace them or to regularise the transfer.
You can ask us for a copy of the safeguards applied by writing to privacy@agentika.io.
7. Data security
- Encrypted communications (HTTPS/TLS)
- Secure authentication with JWT tokens
- Data isolation between customers (Row Level Security)
- OAuth tokens encrypted in the database
- Access to data limited to authorised personnel
8. Data retention
We retain your data for the entire duration of the contractual relationship. When the service ends, you have 30 days to export your content; after that period we delete it, and backup copies are deleted within 90 days. The only exceptions are data that the law requires us to retain for longer, such as tax and accounting records.
Conversations with the assistants: we retain the full content of the conversations you have with the platform's assistants, both in the main chat and in the post finalisation section: the messages you write, the replies generated, the images proposed and the outcome of each request. They serve to keep context from one message to the next, to show you the history and to diagnose malfunctions. They are stored on Supabase (Ireland) for the duration of the contractual relationship and deleted together with the rest of the data when it ends. The same conversations pass through the artificial intelligence providers, which retain them under the terms set out in section 4, and through the n8n Cloud execution logs, retained for 30 days.
Technical logs: we retain an excerpt (maximum 500 characters) of requests to the AI models that our system was unable to attribute to a customer, in order to identify the cause; the date, time and browser of each opening of the application; the IP address and browser with which you accepted the Terms of Service, as proof of acceptance; the IP address from which you sent a contact request from the website. These data also follow the duration of the contractual relationship.
Meta and LinkedIn OAuth tokens: social media access tokens are deleted immediately in the following cases:
- When you disconnect the account from the Settings section of Agentika
- When you revoke the app's permissions directly from the settings of your Facebook or LinkedIn account
- When you request the complete deletion of your data (see section 9 and the Data deletion page)
When a Meta token is revoked by the user, Meta automatically notifies Agentika through the data deletion callback. Following the notification, we immediately stop any API call to the account concerned and delete the token within 24 hours.
9. Your rights (GDPR)
In accordance with EU Regulation 2016/679 (GDPR), you have the right to:
- Access: request a copy of your personal data
- Rectification: correct inaccurate or incomplete data
- Erasure: request the deletion of your data ("right to be forgotten")
- Portability: receive your data in a structured and readable format
- Objection: object to processing in certain circumstances
- Restriction: request the restriction of processing
- Withdrawal of consent: withdraw your consent at any time
To exercise your rights you have two options:
- Go to the dedicated Data deletion page to request complete deletion through a guided procedure
- Or write to privacy@agentika.io for any other request (access, rectification, portability, objection, restriction)
We will reply within 30 days of receiving the request.
You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
10. Cookies
Within the platform (after logging in) we only use technical cookies and the browser's local storage that are necessary for it to work (authentication, session, display preferences). We do not use profiling cookies or advertising cookies.
On the public pages of the website only (home, pricing, beta programme) we use Google Analytics 4, provided by Google Ireland Ltd., to count visits and understand which sections are read. The IP address is anonymised before processing, we do not combine the data with other sources and measurement is disabled for users who have an active session on the platform. Google Analytics sets its own cookies on your browser; you can block them from your browser settings or with the opt-out extension provided by Google.
The application's typefaces are served by Google Fonts: on each load your browser requests the files from Google, which receives your IP address in order to respond.
11. Compliance with Meta's policies
Agentika uses Meta's APIs (Instagram Graph API and Facebook Login) to offer publishing and analysis features on its Customers' Instagram and Facebook channels. In the context of this use, Agentika operates in compliance with:
Access to Meta data takes place exclusively through the standard Facebook Login OAuth flow, with the user's explicit consent to the permissions requested. Agentika does not circumvent or attempt to circumvent Meta's access controls, does not share data obtained through Meta's APIs with unauthorised third parties and does not use such data for purposes other than those stated on the consent screen and in this Privacy Policy.
In accordance with Meta's policies, Agentika gives each user the possibility to disconnect the app and to request the deletion of their data through the Data deletion page.
12. Changes to the Privacy Policy
We reserve the right to update this Privacy Policy. In the event of substantial changes, we will notify users by email or by a notice on the platform. The date of the last update is always shown at the top of this page.
13. Contact
For questions about privacy or the processing of your data:
