PRIVACY POLICY

Information pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003.

1. Data controller

Missing Potato S.r.l., Via Giuseppe Di Vittorio 20, 33170 Pordenone (PN), Italy — Tax code and VAT no. 02011500937, REA PN-382706 — certified email (PEC): missingpotato@pec.it. No Data Protection Officer has been appointed, as one is not required for our activities.

2. Data we process

• Conversation with Spud: the messages you write to the assistant and the generated answers.
• Contact details: only if you ask to talk to the team — name, email, company (optional), the conversation summary and the consents given.
• Technical data: IP address and browser information needed to serve the site; for Spud we store only a daily cryptographic fingerprint of the IP, never the plain IP.
• Statistical data: only with your consent, aggregate browsing data via Google Analytics 4 with anonymised IP.

We do not ask for or want special categories of data (health, opinions, etc.) or third-party data: please do not enter them in the chat.

3. Purposes and legal bases

• Answering your questions through Spud and your contact requests — pre-contractual measures at your request (Art. 6.1.b).
• Protecting the site and the assistant from abuse and automated use, keeping costs under control — legitimate interest (Art. 6.1.f).
• Sending you updates from Missing Potato — only with optional, revocable consent (Art. 6.1.a).
• Usage statistics with Google Analytics 4 — consent via the cookie banner (Art. 6.1.a and Art. 122 Italian Privacy Code).
• Complying with legal obligations and defending our rights — legal obligation and legitimate interest (Art. 6.1.c and f).

4. Spud assistant and artificial intelligence

Spud is an AI-based assistant: you are talking to an automated system, not a person. Answers are hypotheses generated by a model, may contain inaccuracies and do not produce automated decisions with legal or similarly significant effects under Art. 22 GDPR. Messages are processed through the Lovable AI gateway and the model provider (OpenAI) only to generate the answer; we do not use them to train models.

5. Retention

• Spud conversations and IP fingerprint: 24 hours, with automatic deletion running every hour. In your browser the conversation stays in the open tab and is removed when you close it or use “Start over”.
• Contact requests: up to 24 months from the last exchange, unless a contractual relationship follows.
• Consent to updates: until withdrawn and in any case no longer than 24 months from the last contact.
• Google Analytics 4 statistical data: 14 months.

6. Sending requests to the team

Automatic delivery of requests from the chat is not active yet: Spud says so clearly and does not collect your name and email until it can deliver them. Once the channel is enabled, contact details will be processed only to handle your request, and the providers involved will be listed here before activation. You can always write to the PEC address above.

7. Recipients and transfers

Data is processed by authorised Missing Potato staff and by providers appointed as data processors (Art. 28): Lovable (site hosting, database and AI gateway), OpenAI (AI model) and Google Ireland Ltd. (Google Analytics 4, consent only). We do not sell or disclose data to third parties for their own purposes. Any transfers outside the European Economic Area rely on adequacy decisions (EU-US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.

8. Your rights

You may at any time request access, rectification, erasure, restriction, portability and object to processing, and withdraw consent without affecting the lawfulness of prior processing (Articles 15–22 GDPR), by writing to the PEC address above. We reply within one month. You may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

9. Provision of data

Using Spud is optional. Name and email are needed only if you want us to contact you; consent to updates and to analytics cookies is optional, and refusing does not limit your use of the site.

10. Minors and changes

The site is aimed at businesses and professionals and is not intended for children under 14. Any changes to this notice will be published on this page with the update date. For cookies see the Cookie Policy.

Last updated: November 2026.