Privacy Policy

1. Who We Are

Advanced AI Institute for CEOs ("we", "us", "our") operates the aiforceos.eu website and the "AI for CEOs" mobile apps for iOS and Android. We are the data controller for the personal data described in this policy. Contact: info@digimindsphere.com.

2. Data We Collect

• Account: your email address and a password (the password is held by our sign-in provider, Supabase, not by us in readable form). If you sign in with Apple or Google, the name and email address that Apple or Google shares with us. Apple may share a private relay address instead of your own.
• Profile: full name, company or affiliation (the iOS app does not ask for it), country, phone number (optional), your language choice, and on the website the interests you select during onboarding.
• Learning activity: which lessons you have completed and when, and which notifications you have read. The point where you stopped watching is kept only on your device (in the app) or in your browser (on the website).
• Subscription record: plan, status, how it is paid (card, PayPal, Apple in-app purchase or complimentary access), billing period dates and, where Stripe is used, the Stripe customer and subscription identifiers.
• Invoice details, only if you request an invoice on the website: private or business type, name or company, email, address, city, postal code, country, phone, tax identifiers (codice fiscale, P.IVA, SDI code, PEC address), invoice number and amount.
• Payment details: card and PayPal details are entered on Stripe's pages and are never received or stored by us.
• Ask Digi: the text of the question you type. It is sent to Google to produce an answer and is not stored by us (see Section 6).
• Messages: if you use the contact form, your name, email address, subject and message, which reach us by email. If you write to us, or send a mentoring-session request from your own mail app, we keep what you send.
• Newsletter: your email address, if you subscribe on the website. It is stored separately from your account.
• Technical data: when you use the website or the app, our hosting and backend providers process your IP address, the type of browser or device, the app version (the app identifies itself as "AIforCEOs-App", its version number and "ios" or "android") and the time of each request. We use this to deliver the service, keep it secure and limit abuse, for example by limiting how many contact messages or password-reset emails one address can send.

Fields marked optional can be left empty. We collect only what the service needs.

3. What We Do Not Do

• No advertising. There are no ads, no advertising identifiers, and we do not sell your data or share it for advertising.
• No tracking. We do not track you across other companies' apps or websites. The app contains no analytics, advertising or crash-reporting SDKs, and the website uses no analytics scripts.
• No push notification tokens. The current app does not ask for notification permission and does not collect or store a push token. The notifications list in the app shows announcements you read inside the app.
• No device data beyond the above. The app does not ask for access to your location, contacts, photos, camera or microphone.

Earlier 1.x versions of the app asked iOS for notification permission; the token was never sent to or stored by us.

4. How We Use Your Data

• To create and run your account, sign you in and keep you signed in
• To provide the programme: lessons, podcasts, news, your progress and your language choice
• To recognise your subscription and give you the access it includes
• To process payments and issue invoices on the website (through Stripe and Resend)
• To send transactional emails only: email confirmations, password resets, invoices and replies to messages you send us
• To answer your questions in Ask Digi
• To comply with legal obligations (including tax and accounting requirements)
• To detect and prevent fraud, abuse or security incidents

5. Legal Basis (GDPR)

We process your data on the following legal bases: (a) Contract: processing necessary to deliver the account and subscription you signed up for; (b) Legal obligation: where required by EU/Italian law (e.g. tax and accounting requirements); (c) Legitimate interests: keeping the platform secure and preventing abuse; (d) Consent: for optional communications such as the newsletter, and, in the app, for sending your Ask Digi question to Google (you can withdraw consent at any time). On the website, we process the question you choose to submit to Ask Digi in order to give you the answer you asked for, as part of providing the service under (a).

6. Ask Digi and Google

• Digi, the assistant, answers questions using Google's Gemini artificial intelligence service.
• What is sent: only the text of the question you type, together with a fixed set of instructions that describes the Institute and how Digi should answer. Your name, email address, account identifier, progress and any other account data are never sent.
• Who receives it: Google, which processes the question under its own terms and privacy policy to write the answer. How long Google keeps it, and what it may use it for, is set by Google's terms and not by us.
• What we keep: nothing. We do not store your questions or the answers on our servers.
• Consent: in the app, before your first question, a screen names Google and explains what is sent. Nothing is sent until you agree, and you can withdraw consent at any time with the "Ask Digi" switch in Account. On the website, the chat widget sends your question to Google when you submit it.
• Please do not enter personal, confidential or sensitive business information in your questions.

7. Third-Party Services

• Supabase: database, sign-in (including sign-up confirmation emails and, as a fallback, password-reset emails) and file storage. Holds your account, profile, progress, subscription and invoice records.
• Stripe: card and PayPal payments, subscription management and tax calculation on the website (PCI-DSS compliant). Receives your email address, the payment details you enter and your account identifier.
• Google (Gemini): writes Ask Digi answers. Receives the question text only (Section 6).
• Resend: sends email on our behalf: invoices (with a PDF), password-reset emails and contact-form messages.
• Vercel: hosts the website and the service the app talks to.
• Apple: Sign in with Apple in the iOS app, and billing of subscriptions bought through Apple in earlier versions of the app.
• Google: "Continue with Google" sign-in, on Android and on the website.
• RevenueCat: receives records of subscriptions bought through Apple in earlier versions of the app and tells us their status. The current app has no purchase flow.
• api.country.is: on the website's sign-up page only, your browser sends your IP address to this third-party country-lookup service to suggest your country. The service handles that request under its own terms.
• YouTube and Google Drive: if a lesson on the website is a YouTube video, the YouTube player loads from Google when you watch it; some podcast audio may be retrieved from Google Drive through our service. Google handles that under its own terms.
• News publishers: news items come from publishers' public feeds. Opening an article takes you to the publisher's own website, which has its own privacy policy.

Each provider processes data under its own terms and security measures and has its own privacy policy. We share only the minimum data necessary for each service. We do not sell personal data.

8. Data Retention and Deletion

You can delete your account yourself, in the app or on the website. Deleting takes effect immediately: you can no longer sign in, and your account and the records below are removed from our database. In general, we keep personal data only for as long as needed for the purposes described in this policy, and then delete or anonymise it.

• Account, profile, learning progress, notification read state, subscription record and invoice details: kept while your account exists, deleted when you delete it.
• Deleted data and backups: our database provider may keep routine backups, and deleted data can remain in them until they are overwritten or expire under that provider's own schedule.
• Card subscriptions: when you delete your account, in the app or on the website, we first check that an active Stripe subscription belongs to your account and cancel it, so it is not charged again. If it cannot be cancelled, or cannot be confirmed as yours, nothing is deleted and we ask you to contact us. A subscription bought through Apple cannot be cancelled by us: cancel it in your Apple ID settings (see the deletion page).
• Records held by others: Stripe keeps its own payment, invoice and customer records, and Apple (and RevenueCat, for earlier in-app purchases) keep purchase records. We do not delete these when you delete your account; each is governed by that provider's own policy.
• Invoices and accounting records: the invoice details we store about you are deleted with your account. Financial and accounting records held by payment processors, and any records we are legally required to keep, may be retained for as long as the law requires.
• Ask Digi questions and answers: not stored by us.
• Messages sent through the contact form or by email: kept in our support mailbox for as long as needed to answer you and follow up.
• Newsletter address: kept until you ask us to remove it. It is not linked to your account and is not removed when you delete your account. To have it removed, email us at info@digimindsphere.com.
• Server logs kept by our hosting and backend providers: kept for the period those providers set under their own terms and security measures.
• On your device: signing out or deleting your account clears the resume point. Your language choice and your Ask Digi consent stay on the device until you change them or remove the app.

How to delete your account and what it removes →

9. Cookies and Local Storage

Website: we use essential cookies for sign-in and session management, and a language cookie ("locale", with "locale_picked") that remembers your language choice for one year. Your browser's local storage keeps your resume point (the last lesson you watched). We do not use advertising or third-party tracking cookies. You can disable cookies in your browser settings, but this may affect your ability to sign in and use the platform. App: no cookies. The app keeps your sign-in session in the iOS Keychain or Android Keystore, and your language choice, Ask Digi consent and resume point in its own storage on the device.

10. Your Rights (GDPR)

• Right of access: request a copy of your personal data
• Right to rectification: correct inaccurate data (you can edit your profile in the app and on the website)
• Right to erasure: delete your account and associated data (in the app, Account → Delete account; on the website, Account → Delete Account; see Section 8)
• Right to portability: receive your data in a machine-readable format
• Right to restrict processing: limit how we use your data
• Right to object: object to processing based on legitimate interests

To exercise these rights, email us at info@digimindsphere.com. We will respond without undue delay and within the time limits set by data protection law.

11. Data Security

We implement appropriate technical and organisational measures to protect your data, including encrypted connections (TLS), access controls, and regular security reviews. On your phone, the app keeps your sign-in session in the iOS Keychain or Android Keystore. In the event of a data breach affecting your rights, we will notify you and the relevant supervisory authority as required by GDPR.

12. International Transfers

Some of the providers named in Section 7 are international companies and may process data outside the European Economic Area. Each provider processes data under its own terms and security measures, described in its own privacy policy. For questions about where your data is processed and how transfers are protected, contact us at info@digimindsphere.com.

13. Children's Privacy

The Service is intended for adults (18+) and business professionals. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform. The date at the top of this page reflects the most recent update.

15. Contact & Complaints

For privacy-related questions or to exercise your rights, contact us at info@digimindsphere.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at www.garanteprivacy.it.