Envify will be at Ecomondo 2026: come meet the team in person.Find us at Ecomondo 2026: Envify at Ecomondo

Privacy policy

Last updated: September 2026.

This page is also available as an automatic translation. The Italian version is the only legally binding one.

Envify S.r.l. (VAT no. 17737451009), with registered office in Rome, 00128, Via Carmelo Maestrini 340, in the person of its legal representative pro tempore (hereinafter also the "Company", "Provider" or "Envify"), as data controller, respects your privacy and is committed to protecting your personal data.

This privacy policy (hereinafter, "Policy") sets out the reasons for and the methods of collection, management and protection of personal data in connection with the services offered through the Website www.envify.ai

The Company undertakes to process your data in accordance with the General Data Protection Regulation (Reg. EU 2016/679), better known as the "GDPR", and any other applicable privacy law. In particular, the processing of personal data carried out by Envify will be guided by the principles of lawfulness, fairness, transparency, purpose and storage limitation, data minimisation, accuracy, integrity and confidentiality.

It is understood that, with regard to personal data entered, uploaded or processed by the Customer and/or the Users in the course of normal use of the service, the Customer acts as data controller, while Envify acts, within the limits of the technical activities of provision, configuration, maintenance and management of the service, as a possible data processor pursuant to art. 28 of the GDPR, in accordance with the General Terms and Conditions of Contract, where provided for in the appointment agreement.

The Provider does not use the Customer's data and content for autonomous purposes other than the performance of the service and acts in compliance with the documented instructions given by the Customer, without prejudice to the need to rely on third-party technology providers (such as, by way of example, cloud services and providers of language models – LLMs) for the operation of the service, as further set out in this Policy and in the respective policies.

  1. PURPOSE OF THIS PRIVACY POLICY

This Policy is drawn up pursuant to articles 13 and 14 of the GDPR and is intended to provide information on how Envify processes your personal data, collected through the use of the Website, including all data that the user provides in order to stay informed about news (for example, to subscribe to our newsletter, to interact with our customer service or to take part in a promotion or survey).

It is the User's responsibility to read this Policy, together with any other notice we may provide to supplement, update or expand on the information regarding the collection and processing of your personal data. We will endeavour to coordinate these notices so as to reflect at all times the conditions applied to the processing of personal data in the most transparent and easily accessible way.

  1. DATA CONTROLLER

The Company acts as data controller and is responsible for your personal data. You may contact the data controller to obtain information about the processing of personal data and to exercise the rights that the GDPR grants to the data subject, at the following email address: hello@envify.ai

This Policy also applies to the processing connected with the provision of the "Envify" Software in SaaS mode. In such processing, the privacy roles vary according to the categories of data processed: (i) for account, billing, security and technical log data (e.g. access events, invitations, roles and permissions), Envify acts as Data Controller; (ii) for the data and documents uploaded to the application by the Company or the Consultant (and by their respective authorised users), such parties take on the status of autonomous Data Controllers pursuant to art. 4, no. 7, of the GDPR.

Roles and responsibilities (Company/Consultant)

The Company or the Consultant that uses the Software determines the purposes and means of the processing carried out through the platform in relation to the data subjects within its remit (employees, collaborators, suppliers, customers, etc.) and, as an autonomous Data Controller, is responsible for: (a) the lawful basis of the processing; (b) information obligations towards the data subjects; (c) the exercise of the rights under arts. 15–22 of the GDPR; (d) the definition of the storage periods; (e) the accuracy/lawfulness of the data uploaded.

For such data, Envify acts as Data Processor and processes the information on the lawful basis of the performance of the contract (art. 6(1)(b)) within the limits of the Controller's instructions; Envify does not determine the purposes and means of the processing. Envify remains an autonomous Data Controller for the processing connected with: account management and billing, service security, support, log and audit records (art. 6(1)(b) and (f)), as well as legal obligations (art. 6(1)(c)).

  1. WHAT PERSONAL DATA DO WE COLLECT?

This section describes the categories of personal data that we process. In section 4 we will set out the purposes for which we process these categories of personal data.

The personal data we collect are subject to the use of our Website and to acceptance through the specific dedicated web form or through the subscription of the Envify software Licence Agreement.

If you visit our Website, your browser automatically transmits certain data, such as the date and time you visited our web pages, the type and settings of your browser, your operating system and your IP address. For further details on the processing of the personal data collected through our website, we invite you to also review the cookie policy available here: https://envify.ai/terms-and-privacy/cookie-policy

Through our Website, we process as controllers the following personal data relating to the following categories of data subjects:

Personal data provided by the Customer/User:

First and last name

Date and place of birth

Email address

Residential/domicile address and shipping address

Telephone number

Personal identifiers of natural persons acting on behalf of companies

Tax code and VAT number

Traffic and log data

Personal identifiers and details of the company's suppliers (where provided by the User)

Envify does not request or process special categories of data pursuant to art. 9 of the GDPR, nor data relating to health, biometric or otherwise sensitive data, within the processing governed by this Policy.

  1. FOR WHAT PURPOSES DO WE PROCESS YOUR PERSONAL DATA?

Envify processes the personal data of data subjects exclusively for specified, explicit and legitimate purposes, closely connected with the provision of its digital services and the management of the contractual relationship.

In particular, personal data are processed to enable the management of contacts, the subscription and performance of the contractual relationship, the creation and management of the account, the identification of the Customer and of the Authorised Users, as well as access to the functionalities of the Software platform.

The data are also processed for the performance of the technical and organisational activities necessary for the correct provision of the service in Software as a Service (SaaS) mode, including configuration, maintenance, technical support, security and operational continuity activities.

Personal data are also processed for the management of the contractual relationship, including administrative, accounting and tax activities, such as the issuing of invoices, the management of payments and compliance with the obligations laid down by the applicable legislation. Such processing is based on the need to perform the contract to which the data subject is party and on compliance with legal obligations to which the Data Controller is subject.

To aid understanding, the following table sets out the categories of data processed, the purposes, the lawful basis and the storage periods:

  1. Contact details of the User or of the person acting on behalf of a customer that is a legal entity

Purpose of the processing: Creation of automatic emails for informational newsletters; sending communications to the User for purposes connected with the performance of the contract; contacting the User at their request.

Lawful basis: Contract

Storage period: For the entire duration of the contractual relationship and for the 2 years following the termination of the Contract, unless a longer period is indicated by law.

  1. Identity data of the User acting on behalf of the company

Purpose of the processing: Management of support requests received through online forms; performance and fulfilment of the Licence Agreement.

Lawful basis: Contract

Storage period: For the entire duration of the contractual relationship and for the 2 years following the termination of the Contract, unless a longer period is indicated by law.

  1. Identity data; Personal data relating to the activity carried out by the User when using the Software; Personal data contained in identity documents and/or company documents

Purpose of the processing: Performance and fulfilment of the Licence Agreement; automated processing for the generation of analysis results; automated processing for the VSME KPI functionalities; automated or analogue processing for ancillary support services.

Lawful basis: Contract

Storage period: For the entire duration of the contract and for the 30 days following the termination of the Contract, unless a longer period is indicated by law.

  1. User’s contact data

Purpose of the processing: Marketing communications and sending of informational or commercial newsletters; communication of updates relating to the platform.

Lawful basis: Consent for commercial and marketing communications. Contract for communications concerning the update of the platform.

Storage period: Until consent is withdrawn.

  1. Invitation and user management data: email addresses of invitees, user–tenant/company association, roles and permissions assigned, invitation status/acceptance, timestamps of operations; Audit and technical logs: access and authentication events, changes to roles/permissions, creation/removal of users, entries/changes/deletions of company data (metadata), session identifiers, IP address, user agent

Purpose of the processing: Performance and fulfilment of the Licence Agreement; legitimate interest in security/anti-abuse.

Lawful basis: Contract

Storage period: For the entire duration of the contractual relationship and for the 2 years following the termination of the Contract, unless a longer period is indicated by law.

  1. Data on browsing of the Website collected through the Meta Pixel: pages visited, actions taken (for example, submitting a trial or demo request), browser identifier contained in the _fbp and _fbc cookies, IP address, browser and device information

Purpose of the processing: Measurement of the effectiveness of Envify’s advertising campaigns on Facebook and Instagram, attribution of the requests received to the ads, and selection of relevant ads for those who have visited the Website (custom audiences), through Meta Platforms Ireland Limited.

Lawful basis: Consent (art. 6(1)(a) GDPR), given by enabling the “Marketing” category in the cookie banner and which may be withdrawn at any time via the “Cookie preferences” link.

Storage period: For the duration of the pixel cookies (3 months) and in any case until consent is withdrawn; for the processing carried out by Meta, please refer to its privacy policy.

  1. Statistical data on browsing of the Website collected through Google Analytics 4: pages visited, interaction events, pseudonymous browser identifier contained in the _ga cookies, browser and device information, approximate location derived from the IP address, which is not stored

Purpose of the processing: Compilation of aggregated statistics on the use of the Website in order to improve its content and functioning, through Google Ireland Limited, which processes the data on behalf of Envify as data processor.

Lawful basis: Consent (art. 6(1)(a) GDPR), given by enabling the “Statistics” category in the cookie banner and which may be withdrawn at any time via the “Cookie preferences” link.

Storage period: For the duration of the cookies (2 years) and in any case until consent is withdrawn; event data are stored by Google Analytics according to the retention period configured in Envify’s Google Analytics property.

The Company also informs you that, for the purposes referred to above, your personal data will be processed using IT, electronic and manual tools, in compliance with the confidentiality and security rules established by law.

Identity and contact data may also be processed for the management of assistance, technical support and contact requests, as well as to respond to communications, reports or requests for information sent to Envify through the channels made available.

  1. THIRD-PARTY LINKS

Our website or our app may include links to third-party websites. By clicking on such links or enabling them, third parties may process your personal data; we therefore invite you to also refer to the privacy policy of such sites.

  1. WITH WHOM MAY WE SHARE YOUR PERSONAL DATA?

The personal data processed by Envify may be disclosed, within the limits strictly necessary to pursue the purposes indicated in this Policy, to third parties that act on behalf of the Provider or that provide services functional to the provision of the service and of the Software platform.

If you have enabled the “Marketing” category in the Website’s cookie banner, the browsing data collected through the Meta Pixel are disclosed to Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland), which processes them as joint controller for their collection and transmission (art. 26 GDPR, under the agreement available at facebook.com/legal/controller_addendum) and as independent controller for subsequent processing, described in its privacy policy (facebook.com/privacy/policy). Further details on the pixel cookies can be found in the Cookie policy.

If you have enabled the “Statistics” category, statistical browsing data are processed by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) through Google Analytics 4, acting as data processor pursuant to art. 28 GDPR on the basis of the Google Ads Data Processing Terms, with Google Signals and ad personalisation disabled.

In particular, personal data may be shared with providers of technological and infrastructure services, such as, by way of example, hosting providers, cloud services, workflow automation platforms, application monitoring tools, authentication and IT security systems.

The Customer declares that it is fully aware of and accepts that, for the provision of functionalities based on large language models (LLMs) and artificial intelligence services, the Envify service relies on specialised third-party providers that make available models, APIs and technological infrastructure. Such parties process personal data as autonomous data controllers or, where applicable, as external processors, in accordance with their respective privacy and data protection policies.

The customer user is clearly informed that they remain the sole and exclusive controller of the processing of any personal data entered into the application or contained in the uploaded documents, assuming in full all responsibility as to the lawful basis, the information notice, consents where necessary, security measures, storage periods, the exercise of data subjects' rights, and any other obligation laid down by the GDPR and the applicable legislation. The data entered by the user in the use of third-party LLMs are end-to-end encrypted.

With regard to the automated product classification functionalities, Envify also relies on the services made available by OpenAI, L.L.C., through the use of the GPT-4 model via the Chat Completions API in a commercial environment.

Within this integration, the data transmitted via the API consist exclusively of textual descriptions of products for the purposes of their classification, without references to identified or identifiable natural persons. No personal data within the meaning of art. 4, no. 1, of Regulation (EU) 2016/679 (GDPR) are therefore transmitted or processed.

For completeness of information, you are invited to consult OpenAI's privacy policy, available at the following link: https://openai.com/policies/privacy-policy.

With regard to the automated document analysis functionalities and the processing of accounting and financial documents, Envify also relies on the services of Anthropic Ireland Ltd., as the contractual entity for the European Union, within the commercial account "Envify S.r.l. — Commercial API Enterprise".

The processing carried out through such services may involve the transmission of text extracted from invoices, utility bills and financial documents uploaded by the Customer, potentially containing personal data that are even indirectly identifying (such as, by way of example, company names, supplier addresses, invoice numbers, amounts, consumption data, tax codes or company VAT numbers). Anthropic acts in compliance with its Commercial Terms, including the Data Processing Addendum (DPA) and Standard Contractual Clauses (SCCs) pursuant to arts. 28 and 46 of the GDPR.

The data transmitted via the API are subject to a storage period limited to 30 days, unless the Zero Data Retention (ZDR) mode is activated, where requested. The data are not used for the purposes of training artificial intelligence models, adherence to training programmes such as the Development Partner Program being excluded and the commercial API policy, which precludes their use for training purposes, being applicable.

Where the processing involves transfers to third countries, including the United States (Google Cloud Platform infrastructure – us-central1/us-east4), such transfers take place on the basis of the Standard Contractual Clauses incorporated into the contractual terms and of the further safeguards provided for by the DPA, in accordance with arts. 44 et seq. of the GDPR.

Anthropic may use sub-processors, including leading providers of cloud infrastructure and technology services (e.g. Google Cloud Platform, AWS, Cloudflare, Stripe), in compliance with the safeguards provided for by the GDPR. The updated list of sub-processors is available as set out in the provider's contractual documentation.

For further information on how Anthropic processes personal data, please refer to its privacy policy available at the following link: https://www.anthropic.com/legal/privacy.

The website, the platform and the technical environments used for the provision of the Envify service may also contain links to third-party websites, applications or services. Access to such resources means leaving the Provider's sphere of control, which assumes no responsibility for the methods of collection, use and processing of personal data carried out by such third parties. It is therefore recommended to review their respective privacy policies before providing any personal data.

Finally, personal data may be disclosed to:

  1. legal, tax and accounting advisors, for purposes connected with the fulfilment of regulatory obligations or the protection of the Provider's rights;

  2. public authorities, supervisory bodies or organisations, where the disclosure is required by legal provisions, regulations or legitimate orders of the Authority.

The personal data referred to in § 3, with the exceptions provided for in this section, are processed mainly within the European Economic Area (EEA). Should a transfer to third countries become necessary, Envify will ensure that such transfer takes place in compliance with the provisions of Chapter V of the GDPR, through the adoption of appropriate legal instruments, such as adequacy decisions or standard contractual clauses.

The data collected through the Meta Pixel, with prior consent, may be transferred to Meta Platforms, Inc. in the United States. Meta Platforms, Inc. participates in the EU-U.S. Data Privacy Framework, which is the subject of the European Commission’s adequacy decision of 10 July 2023; in addition, the Standard Contractual Clauses incorporated into Meta’s contractual terms apply.

Similarly, the data collected through Google Analytics 4, with prior consent, may be transferred to Google LLC in the United States: Google LLC participates in the EU-U.S. Data Privacy Framework and the Google Analytics terms include the Standard Contractual Clauses.

For the processing in which Envify acts as Data Processor, the Company may use sub-processors (e.g. cloud providers, email/invitation-sending services, application monitoring) appointed pursuant to art. 28 of the GDPR.

  1. HOW LONG WILL WE USE YOUR DATA?

The Provider stores the personal data of data subjects exclusively for the time necessary to pursue the purposes for which such data were collected and processed, in compliance with the principles of storage limitation and proportionality provided for by Regulation (EU) 2016/679.

In determining the storage periods, Envify takes into account the nature of the personal data, the purposes of the processing, the duration of the contractual relationship, as well as the applicable legal and regulatory obligations. In particular:

  1. the data relating to the account, contacts and the contractual relationship – including data uploaded and generated by the user – are stored for the entire duration of the relationship and for a subsequent period not exceeding two years from termination, unless storage for a longer period is necessary to comply with legal obligations or for the establishment, exercise or defence of a legal claim;

  2. billing and administrative data are stored for the period provided for by the applicable civil and tax legislation and, in any case, for ten years from the accounting entry;

  3. technical and security data, including access logs, system events and information relating to the operation of the technical environments and of the platform, are stored for the time strictly necessary to ensure the security of the systems and of the service and, in any case, for a period not exceeding twenty-four months from the termination of the contractual relationship, subject to any further storage obligations provided for by law.

Once the applicable storage period has elapsed, personal data are erased or irreversibly anonymised, unless their further storage is required by legal provisions or proves necessary for the purposes of protecting the rights of the Data Controller.

  1. AUTOMATED DECISION-MAKING

The Provider informs that, in the course of providing its digital services, Envify may use automated IT tools, including systems based on artificial intelligence technologies, in order to support the operation of the Software and improve the user experience.

Such tools are used exclusively for technical and operational purposes, such as, by way of example, the processing of textual inputs, the organisation of information, the optimisation of the Platform's functionalities and support for the activities carried out by the user through the Software.

In any case, the Developer does not subject data subjects to decisions based solely on automated processing, including profiling, that produce legal effects concerning them or similarly significantly affect them, pursuant to art. 22 of Regulation (EU) 2016/679.

Profiling for advertising purposes carried out through the Meta Pixel on the Website takes place exclusively with prior consent, concerns solely the selection of the ads shown on Meta platforms and does not produce legal effects concerning the data subject or similarly significantly affect them.

The automated processing carried out by the Platform does not involve assessments, classifications or decisions of a binding nature towards users and does not result in automatic legal consequences for them. Any use of outputs generated by automated systems always remains subject to the user's assessment and responsibility.

  1. HOW DO WE PROTECT YOUR PERSONAL DATA?

Envify adopts appropriate technical and organisational measures to ensure that personal data are processed in compliance with the principles of integrity, confidentiality and availability, preventing risks of unauthorised access, loss, destruction or unlawful disclosure of the data.

In particular, Envify implements security measures consistent with the nature of the data processed and with the risks connected with the processing, including, by way of example:

  1. authentication and access control systems for the platform and the technical environments used for the provision of the service;

  2. protection of the IT infrastructure, cloud services and technical accounts used for the operation of the AI Agent;

  3. tracking and monitoring of accesses, of events relevant to security and of operational anomalies;

  4. internal procedures aimed at ensuring the confidentiality of staff and collaborators authorised to process personal data.

Envify limits access to personal data to authorised persons only and within the limits strictly necessary to carry out the activities within their remit, ensuring that such persons are adequately trained and bound by confidentiality obligations of a contractual or legal nature.

The Provider periodically verifies the adequacy of the security measures adopted and updates them in line with technological developments, internal organisation and the risks identified, in order to ensure a level of protection of personal data compliant with the applicable legislation.

  1. YOUR RIGHTS

Pursuant to Regulation (EU) 2016/679, the data subjects to whom the personal data processed by Envify relate may exercise, in the cases and within the limits provided for by the applicable legislation, the rights indicated below.

  1. Right to be informed

Data subjects have the right to be informed about the collection and use of their personal data. This right is an expression of the principle of transparency enshrined in the GDPR and is satisfied by means of this Policy and any other communication provided pursuant to arts. 13 and 14 of the Regulation.

  1. Right of access to personal data

Data subjects have the right to obtain confirmation as to whether or not personal data concerning them are being processed and, in such case, to obtain access to the personal data and to the information provided for by art. 15 of the GDPR, as well as a copy of the data processed.

  1. Right to rectification

Data subjects have the right to obtain the rectification of inaccurate personal data concerning them and, taking into account the purposes of the processing, the completion of incomplete personal data, pursuant to art. 16 of the GDPR.

  1. Right to erasure (“right to be forgotten”)

Data subjects have the right to obtain the erasure of personal data concerning them in the cases provided for by art. 17 of the GDPR, where there are no legitimate grounds for the continuation of the processing. It is understood that the erasure request may not be granted where the processing proves necessary to comply with a legal obligation or for the establishment, exercise or defence of a legal claim.

  1. Right to object to processing

In the cases provided for by art. 21 of the GDPR, data subjects have the right to object to the processing of personal data concerning them, where the processing is based on the legitimate interest of the Controller or of third parties and there are grounds relating to their particular situation. The possibility of objecting at any time to processing carried out for marketing purposes remains unaffected.

  1. Right to restriction of processing

Data subjects have the right to obtain the restriction of processing in the cases provided for by art. 18 of the GDPR, such as, by way of example, the contestation of the accuracy of the data or the unlawfulness of the processing.

  1. Right to data portability

Data subjects have the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning them and to transmit them to another data controller, under the conditions and within the limits provided for by art. 20 of the GDPR. This right applies exclusively to processing carried out by automated means and based on the performance of a contract or on the data subject's consent.

  1. Right to withdraw consent

Where the processing of personal data is based on consent, the data subject has the right to withdraw it at any time, without affecting the lawfulness of processing based on consent given before its withdrawal.

Consent to statistics and marketing cookies, including the Meta Pixel, can be changed or withdrawn at any time via the “Cookie preferences” link at the bottom of every page of the Website.

  1. Right to lodge a complaint with the supervisory authority

Data subjects have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), with offices at Piazza Venezia no. 11, Rome, or to bring proceedings before the competent courts, where they consider that the processing of personal data concerning them infringes the applicable legislation.

  1. CONTACTS

To exercise your rights or to request information on how we process your personal data, you can contact us by email at hello@envify.ai and we will do our best to help you.

This Policy may be subject to updates or amendments over time, including as a result of any regulatory changes, technological developments or changes to the services offered. In such case, the updated version of the Policy will be made available through the channels used for the provision of the service and/or on the platform, indicating the date of the last update. The need to obtain the data subject's consent remains where the amendments concern the type of data processed, the purposes or the methods of processing for which consent is required by the applicable legislation.