Data controller
The data controller is BYTE42 S.r.l., Via Anna Magnani 38/54, 58100 Grosseto (GR), Italy, VAT no. 01762750535, REA GR-232344.
For questions about this policy or to exercise your rights, write to [email protected].
This policy covers the www.byte42.it website and Byte42's apps built on the Fantastico platform that connect to LinkedIn. Fantastico is a BYTE42 S.r.l. product, not a separate company.
Data collected on the website
Contact form
If you write to us through the contact form, we collect your name, email and message. We use them to reply and, if we end up working together, to handle the next steps. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). Without this data we cannot reply. The form is run by Jotform, which stores submissions on servers in the European Union.
Analytics and tag management
We use Google Analytics 4, loaded through Google Tag Manager, to see how many people visit the site, which pages they read and which buttons they use. It collects usage data (pages viewed, session length, browser and device, country) and identifiers stored in cookies. Google Analytics 4 does not log full IP addresses.
These tools only run if you consent in the cookie banner (Art. 6(1)(a) GDPR), and you can withdraw consent at any time.
Cookies
The cookie banner is provided by iubenda, which stores your choice in a technical cookie. The list of cookies and other tracking tools is in the Cookie Policy. You can change your choices in the cookie preferences.
Technical logs
Like any website, the server hosting byte42.it and the Cloudflare network log technical request data: IP address, date and time, requested page, browser. We need these logs to run the site and protect it from abuse, based on our legitimate interest (Art. 6(1)(f) GDPR).
Apps connected to LinkedIn
Byte42 builds apps on the Fantastico platform that let people and companies connect their LinkedIn account, or the LinkedIn Pages they manage, to handle their content. The connection uses LinkedIn's official authorization (OAuth): we never see or store your LinkedIn password, and LinkedIn shows you the requested permissions before you grant them.
What data we receive from LinkedIn
- Basic profile: first and last name, profile photo, LinkedIn identifier and the email address of the account.
- Pages you manage: Page name and public details, published posts, comments and reactions to posts.
- Page statistics: followers, impressions and other engagement metrics, in aggregate form.
- Content created in the app: drafts, posts and replies to comments to be published on LinkedIn.
- Access tokens issued by LinkedIn, which let the app act on your behalf within the permissions you granted.
What we use it for
- Signing you in and linking your LinkedIn account to your profile.
- Publishing posts you wrote or approved on your profile or Page.
- Showing you comments on your Page's posts and letting you reply.
- Showing you your Page statistics.
- Preparing drafts of posts and replies with artificial intelligence (see the next section).
We only publish on LinkedIn content that you wrote or approved. We do not sell data received from LinkedIn, we do not use it for advertising and we do not share it with anyone other than the providers listed on this page.
The legal basis is the performance of the contract for the service you requested (Art. 6(1)(b) GDPR). Comments on Pages may include the name and public profile of people who do not use the app: we process them only so the Page administrator can read and answer them, based on the legitimate interest in managing the Page (Art. 6(1)(f) GDPR).
How to disconnect your account
You can disconnect LinkedIn at any time from the app or from LinkedIn, under Settings › Data privacy › Permitted services. When you disconnect, we delete the access tokens right away and the data received from LinkedIn within 30 days, except data we are required by law to keep.
LinkedIn processes your data as an independent controller under its own privacy policy. For users in Europe, the service is provided by LinkedIn Ireland Unlimited Company.
Artificial intelligence
Some app features prepare drafts of content and replies using artificial intelligence models. Requests go through Byte42's Fantastico platform, which forwards them to the models via OpenRouter, Inc. (United States). OpenRouter routes each request to the provider of the selected model, which may be located outside the European Union.
We only send the models what is needed to write the draft: your instructions, the text of the posts or comments to reply to and Page information useful as context. We do not send access tokens or your email address.
The data is not used to train artificial intelligence models: we choose providers and settings that rule this out.
Drafts are only suggestions: you decide whether to publish, edit or discard them. We therefore make no automated decisions that produce legal effects concerning you (Art. 22 GDPR).
Providers and transfers
To run the website and the apps we rely on the following providers, which process data on our behalf as processors. The exception is LinkedIn, which is an independent controller.
- Contabo GmbH (Germany): website hosting.
- Cloudflare, Inc. (United States): website delivery and protection.
- Jotform Inc. (United States, data stored in the EU): contact form.
- Google LLC (United States): Google Analytics 4 and Google Tag Manager.
- iubenda S.r.l. (Italy): cookie banner and consent management.
- OpenRouter, Inc. (United States) and the AI model providers: preparing drafts.
- LinkedIn Ireland Unlimited Company (Ireland): independent controller of your LinkedIn account data.
When data leaves the European Economic Area, the transfer relies on the EU-U.S. Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the European Commission. You can ask us for the up-to-date list of providers at any time.
How long we keep data
- Contact form messages: as long as needed to handle the request and any relationship that follows.
- Google Analytics data: for the retention period set in the Analytics property, then deleted automatically.
- Data received from LinkedIn: while the account stays connected; after disconnection we delete it within 30 days.
- Technical logs: for the short period needed for security and maintenance.
We keep data longer only when the law requires it or to defend our rights in legal proceedings.
Your rights
Under the GDPR you can ask us at any time to:
- access your data and get a copy;
- correct or update it;
- delete it;
- restrict its processing;
- receive it in a structured format or have it sent to another controller;
- object to processing based on legitimate interest;
- withdraw your consent, without affecting processing already carried out.
Write to [email protected]: requests are free and we reply within one month. If you believe the processing breaks data protection law, you can lodge a complaint with the Italian Data Protection Authority (Garante) or with the authority of the country where you live.
Changes to this policy
We update this policy when our services or the law change. The date of the last update is at the top of the page. If a change affects processing based on consent, we will ask for your consent again where needed.
This policy is also available in Italian.