Privacy Policy

• Papaip OÜ
• Registered address: Sepapaja tn 6, 15551 Tallinn, Estonia
• Registry code: 17048933
• VAT code: EE102767306
• Data Protection contact: fabrizio@fabrizioscoglio.com

Contact form: name, company, email, website (optional), and message content.

Newsletter: email address.

Event form (for example after a talk): name, email, phone number (optional), team size, and whether you agreed to follow-up emails and to WhatsApp messages.

WhatsApp messages with our number +351 937 421 554, which we also use at events: your phone number, your WhatsApp profile name, what you write and what we reply, when each message was sent, and whether our replies were delivered and read. Photos, voice notes and documents up to 16 MB that you send us are stored with the conversation; videos, stickers and larger files are not, and of those we keep only a note of their type.

Emails you exchange with Fabrizio at fabrizio@fabrizioscoglio.com, if you are a contact in our CRM: sender, recipients, subject, text and date.

AI self-diagnostic: your name, what your business does, your company name and your role, the tasks that take most of your week and the one you'd fix first, how many hours it takes, your country, company size, the software and AI tools you use, the report built from them, and the email you give to receive the report. Anyone with the report's link can open it, so share it only with people you choose. The messages you type in the chat are used only to answer you and record your answers, and nothing is stored until you ask for your report.

When you ask for your diagnostic report: whether you also want the newsletter, and, if you came from the WhatsApp link we send after a talk, whether you agree to follow-up emails and to WhatsApp messages. On a report made before this step existed, the email you give to receive The One-Page SOP.

From every diagnostic we also keep statistics: the tapped answers (hours band, country, company size, software, AI tools, type of role and number of tasks), with the month as the only date, without your name, company, business description or task descriptions and without the report's link.

Automatically collected via server logs: IP address, browser user-agent, referring URL, timestamp of visit.

Analytics (only if you accept analytics cookies): pseudonymised identifiers, pages visited, events, device category, and approximate location derived from IP (the full IP is not stored by Google Analytics 4).

• Responding to contact inquiries — Art. 6(1)(b) GDPR: performance of a contract or pre-contract measures.
• Sending newsletter emails — Art. 6(1)(a) GDPR: consent, which can be withdrawn at any time.
• Delivering the resource you request through an event form — Art. 6(1)(b) GDPR: steps taken at your request.
• Sending follow-up emails after an event, only if you tick that box — Art. 6(1)(a) GDPR: consent, which can be withdrawn at any time.
• Sending WhatsApp messages, only if you tick that box, to the number you gave us or wrote to us from — Art. 6(1)(a) GDPR: consent, which can be withdrawn at any time.
• Replying to your WhatsApp message after a talk with the link to the event form, and sending you once, the next morning, the link to the AI self-diagnostic you asked for, on WhatsApp and, if you gave your email in the event form, by email — Art. 6(1)(b) GDPR: steps taken at your request.
• Keeping your phone number, name and a deal in our CRM after you write to our event WhatsApp number, even if you don't fill in the event form, so Fabrizio can follow up about the self-diagnostic you asked for — Art. 6(1)(f) GDPR: legitimate interest. You can object at any time by telling us on WhatsApp or writing to us (section 7), and we stop.
• Keeping the emails and WhatsApp messages Fabrizio exchanges with you in fabri-crm, our own CRM, so he can read the whole conversation and reply from one place — Art. 6(1)(f) GDPR: legitimate interest. A WhatsApp message from a number that is not in our CRM is held apart for up to 30 days, so Fabrizio can decide whether to add you as a contact or delete it. You can object at any time by telling us on WhatsApp or writing to us (section 7).
• Replying to you in the diagnostic chat while you answer — Art. 6(1)(b) GDPR: steps taken at your request. Nothing from the chat is stored.
• Building, storing and showing your diagnostic report — Art. 6(1)(a) GDPR: consent, given with the checkbox when you ask for your report, which can be withdrawn at any time by deleting the report. We keep a record of which consent text was in force and when the report was created.
• Emailing you the diagnostic report you asked for, with The One-Page SOP attached — Art. 6(1)(b) GDPR: steps taken at your request.
• Sending The One-Page SOP and recording the request in our CRM — Art. 6(1)(a) GDPR: consent, given with the checkbox next to the email box, which can be withdrawn at any time.
• Measuring Site usage via analytics — Art. 6(1)(a) GDPR: consent collected via the cookie banner.
• Maintaining security and preventing abuse — Art. 6(1)(f) GDPR: legitimate interest.
• Keeping your email and a summary of your diagnostic report in our CRM after you ask for the report, so Fabrizio can follow up about it — Art. 6(1)(f) GDPR: legitimate interest. You can object at any time by replying to any of our emails or writing to us (section 7), and we stop.
• Meeting legal, accounting, and tax obligations — Art. 6(1)(c) GDPR: legal obligation.

We rely on the following processors under Art. 28 GDPR:

• Vercel Inc. — website and CRM hosting (United States; EU-US Data Privacy Framework).
• Cloudflare, Inc. — CDN and edge routing (United States; Standard Contractual Clauses).
• Resend, Inc. — transactional email for contact form, newsletter, the diagnostic report and The One-Page SOP, plus our own notification emails about each submission and diagnostic report (United States; Standard Contractual Clauses — Resend is not certified under the EU-US Data Privacy Framework).
• HighLevel LLC — CRM for contact form, newsletter, purchase-enquiry, event-form and One-Page SOP submissions, the contacts who write to our event WhatsApp number, the emails sent after an event form, and a summary of the diagnostic report when you ask for the report or the PDF or contact us from it: your name, company, role, what your business does, company size, country, the task you picked, the software and AI tools you use, and the report link (United States; EU-US Data Privacy Framework).
• Meta Platforms Ireland Limited — WhatsApp Business messaging (Ireland; any transfer outside the EEA relies on the mechanisms in section 5).
• YCloud — WhatsApp Business messaging provider for our number +351 937 421 554: it receives your messages, sends our replies and reports whether they were delivered and read (Singapore; Standard Contractual Clauses).
• Supabase Pte. Ltd — database for diagnostic reports, for our own CRM, fabri-crm, which keeps the same website-form records as HighLevel LLC above as dated notes, together with the emails and WhatsApp messages Fabrizio exchanges with you (including the photos, voice notes and documents you send), and for the short list we use to send the next-morning link after an event: a coded version of your phone number that cannot be turned back into the number, your first name and your CRM record id (data stored in the EU, in Ireland; Standard Contractual Clauses).
• DigitalOcean, LLC — hosts the automation server that receives your WhatsApp message and sends our replies (data stored in the EU, in Germany; EU-US Data Privacy Framework).
• OpenRouter, Inc. — sends your messages in the diagnostic chat, the task descriptions and your answers (never your name or company name) to an AI model that writes the chat's replies, splits the tasks you describe and writes part of the report (United States; Standard Contractual Clauses). Requests go only to model providers that keep no copy of the data and do not use it for training; the current provider is Google.
• Google Ireland Limited — Google Workspace: the mailbox fabrizio@fabrizioscoglio.com, from which fabri-crm copies the emails exchanged with contacts in our CRM (Ireland; any transfer outside the EEA relies on the mechanisms in section 5).
• Google Ireland Limited — Google Analytics 4 (EU data centre; onward transfers to the US covered by the EU-US Data Privacy Framework).
• Consently (consently.net) — cookie consent management.

We do not sell personal data and we do not share data with third parties for their own marketing purposes.

Some processors are located outside the European Economic Area, primarily in the United States and, for messages to our event WhatsApp number, in Singapore. Transfers rely on the EU-US Data Privacy Framework where the processor is certified, or on Standard Contractual Clauses approved by the European Commission.

• Contact form submissions: 24 months from the last contact, then deleted.
• Newsletter subscribers: until the user unsubscribes.
• Event form submissions: 24 months from the last contact, then deleted. Follow-up emails and WhatsApp messages stop as soon as you withdraw consent.
• Messages to our event WhatsApp number: the list used to send the next-morning link is deleted 60 days after your message. Your CRM record follows the event-form rule: 24 months from the last contact, then deleted.
• Emails and WhatsApp messages in fabri-crm, with their attached photos, voice notes and documents: 24 months from the last message in the conversation, then deleted.
• WhatsApp messages from a number not in our CRM, with their attached files: 30 days from arrival, then deleted, unless Fabrizio adds you as a contact first.
• Server logs: up to 30 days.
• AI self-diagnostic reports: 24 months from the last time the report is opened, changed, emailed or used to contact us, then deleted. "Delete this report" removes the report and your answers straight away. It does not remove the statistics, the notification emails already sent to us, or the CRM record and newsletter subscription created when you asked for the report or the PDF or contacted us: those follow the rules above and can be erased on request (section 7).
• Diagnostic statistics: 24 months, then deleted.
• Analytics data: 14 months (Google Analytics 4 default).
• Accounting and tax records: for the period required by Estonian law (currently 7 years).

Under GDPR you have the right to:

• Access your personal data (Art. 15).
• Correct inaccurate data (Art. 16).
• Request erasure (Art. 17).
• Restrict processing (Art. 18).
• Data portability (Art. 20).
• Object to processing based on legitimate interest (Art. 21).
• Withdraw consent at any time, without affecting prior processing.

To exercise any right, email fabrizio@fabrizioscoglio.com. We respond within one month.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI), Tatari 39, 10134 Tallinn — www.aki.ee.

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

The AI self-diagnostic is AI-assisted: an AI model writes the chat's replies, matches typed answers to fixed options and splits the tasks you describe, and you see each recorded answer and can change it. Fixed rules calculate the figures, and one report line, labelled as AI-written, comes from an AI model working from your answers. The report is guidance for you to read and has no legal or similarly significant effect on you.

The Site is not directed to children under 16 and we do not knowingly collect personal data from minors.

The SOP chat at fabrizioscoglio.com/sop is offered under our OptiWorkflow brand by the same company, Papaip OÜ. This section says what it does with your data; the rest of this policy applies to it too.

What we collect: the email you give at the start, which of the 2 functions you used (a review of your SOP, or a first SOP written from your answers) and the date. If you came from the link we send after a talk, this is added to the contact you already have with us.

If you open the chat from the link in the email we send after a talk, it does not ask for your email: we already have it from the form you filled in at the event. We add which function you used, whether you created and downloaded the SOP, your answer to the call question and the dates to that contact, on the basis of our legitimate interest in recording that the gift you asked for was delivered (Art. 6(1)(f) GDPR). You can object at any time by writing to us (section 7).

What we don't keep: the files you upload, the text read from your website, your answers and the SOP written for you are not stored and not written to our logs. They are on our server only while your request is being answered. The written SOP stays in your browser until you close the page, and each download is built from what your browser sends back.

If you give your website's address, the chat reads the public text of its homepage and of one About page, once, to understand your business before the interview. That text is not stored and not written to our logs.

How the text is processed: the content of your files, the text read from your website and your answers (never your email) goes through OpenRouter, Inc. to an AI model that writes the review, the questions and the SOP (United States; Standard Contractual Clauses). Requests go only to model providers that keep no copy of the data (zero data retention) and do not use it for training; the current provider is Inception.

• Reviewing your SOP, interviewing you and writing your SOP — Art. 6(1)(b) GDPR: steps taken at your request.
• Keeping your email, the function you used, whether you created and downloaded the SOP, your answer to the call question and the dates in our CRMs, and contacting you about your SOP — Art. 6(1)(a) GDPR: consent, given with the checkbox at the start of the chat, which can be withdrawn at any time by writing to us (section 7).
• Limiting how many times a day the chat can be used, to prevent abuse — Art. 6(1)(f) GDPR: legitimate interest. We count uses per email and per IP address in memory for up to 24 hours; the count is not stored.

Recipients: HighLevel LLC, our CRM (United States; EU-US Data Privacy Framework), and fabri-crm, our own CRM on Supabase Pte. Ltd (data stored in the EU, in Ireland), receive your email, the function you used, whether you created and downloaded the SOP, your answer to the call question and the dates.

Retention: your data in the CRMs is kept for 24 months from the last contact, then deleted, or sooner if you withdraw your consent. The file, your answers and the written SOP are not retained.

The review and the SOP are written by an AI model and can contain mistakes, so read them before you rely on them. They have no legal or similarly significant effect on you.

We may update this policy to reflect changes in our services or applicable law. The "Last updated" date at the top reflects the most recent revision.