Privacy policy

Data controller

Instal S.r.l., Via del Tiratoio 1, 50124 Florence (FI), Italy — tax code and VAT number 06681730484. For any privacy matter you can write to hello@amaki.ai. Instal’s data protection officer (DPO) can be reached at dpo@instal.it.

Browsing and security data

When you visit Amaki, our servers receive technical data such as your IP address, browser type and operating system, the pages requested and the times. We use it to run the site, protect it from abuse (for example with usage limits per IP address) and fix problems.

Legal basis: our legitimate interest in the security and operation of the service (Art. 6(1)(f) GDPR).

Anonymous profile

If you use Amaki without signing up, we create an anonymous profile with a random identifier, stored in your browser, to keep your conversations. If you later create an account, the anonymous profile is merged into it.

Legal basis: performance of the service you request (Art. 6(1)(b) GDPR).

Account

If you create an account we process your email, name, username and password (stored only in a non-reversible encrypted form). If you sign in with Google, we receive your name, email address and profile picture from Google. You may optionally add your surname, gender, date of birth and interests.

We also record sign-in sessions (IP address, browser, operating system, country derived from the IP address and times) to keep you signed in and protect your account.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and, for session security, our legitimate interest (point (f)).

Conversations and content you entrust to us

We process the messages you write to Amaki, the photos and documents you attach and the text we extract from them, the preferences Amaki remembers for you (its “memory”), wish lists and collections, price alerts and notification preferences, and the information you record in “My things” (items, subscriptions, bills, experiences and purchase receipts). We use them to answer your requests, personalise suggestions and let you find what you saved.

Legal basis: performance of the service (Art. 6(1)(b) GDPR).

Personalisation

Amaki uses your conversations, its memory and what you have saved to tailor its suggestions and to build a profile of your shopping tastes — for example, the score with which it shows how well a product suits you. This profile is used only to improve suggestions: we do not take decisions producing legal or similarly significant effects based solely on automated processing (Art. 22 GDPR).

Receipts and Gmail (optional)

You can forward receipts and bills to a personal email address we assign to you, upload them as photos or PDFs or, if you authorise it through Google, let Amaki read your Gmail mailbox in read-only mode to find purchase receipts. We store the access credentials issued by Google in encrypted form; you can revoke them at any time from your Google account settings. Data extracted from a bill you do not confirm is deleted after 90 days.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Legal basis: your consent and performance of the service you activated (Art. 6(1)(a) and (b) GDPR).

Clicks to shops and commissions

When you open an offer, the click goes through our servers: we record the product, shop, price, country, date and time, the conversation it started from, your identifier if you have an account, your IP address and, if present, the identifier of the advertising campaign you came from (gclid). We then redirect you to the shop through Price Ninja, Instal’s service that adds the affiliate parameters.

If you buy, the affiliate network or the shop reports the outcome linked to the click (for example the order identifier, value and status), without your payment details. We use this data to account for commissions, prevent fraud and measure the service. On the shop’s website, the shop’s own privacy policy and cookies apply.

Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

Analytics and service monitoring

Only if you accept it in the cookie banner, we use PostHog and Google Analytics 4 in your browser to understand how the site is used (pages viewed, clicks, where the visit came from, device). If you have an account, PostHog events are linked to your identifier, name and email. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Regardless of the banner, our servers record some service events in PostHog — sign-up, sign-in, clicks to shops, notifications sent, shares — and the monitoring of calls to artificial intelligence models, which includes the text of the request and of the response, linked to your profile identifier. We use them to measure how the service works, check its quality and costs and detect abuse. Legal basis: our legitimate interest (point (f)); you can object by writing to us.

Communications

We send you service emails (address verification, password recovery) and the notifications you switch on, such as price alerts, by email, browser notification or WhatsApp. We do not currently send newsletters or promotional messages; if we do in the future, it will only be with your consent.

Legal basis: performance of the service (Art. 6(1)(b) GDPR).

Shared content and connected channels

If you publish a conversation or a list, the content becomes visible to anyone with the link and is submitted to search engines. We record when shared links are opened (date, browser and whether the visitor is an automated program) to measure sharing. You can unpublish at any time.

If you connect Amaki to WhatsApp, Telegram or an external AI assistant through the MCP connector, we process the identifiers needed for the connection (for example the account identifier and display name) and the messages exchanged. Those services process data under their own privacy policies.

Artificial intelligence

To generate answers, extract information from photos, receipts and bills and organise the memory, we send the necessary content to OpenAI, which processes it as our provider. Under the terms of OpenAI’s API service, data sent through the API is not used to train its models.

Who we share data with

We process data with providers acting as processors, bound by contract:

• Hetzner Online GmbH (Germany): hosting of servers, database and files.
• OpenAI (United States): artificial intelligence models.
• PostHog (servers in the European Union): usage analytics and service monitoring.
• Google (Ireland and United States): Google Analytics 4, sign-in with Google and Gmail reading, if enabled.
• Twilio SendGrid (United States): sending emails and receiving forwarded receipts.
• Meta Platforms (WhatsApp) and Telegram, if you connect those channels, and the browsers’ notification services, if you switch on notifications.
• LivingLocal: search for travel experiences, to which we send the search criteria.
• Amazon (Creators API and the Amazon Associates programme): search for Amazon products, to which we send the search criteria.

Shops, affiliate networks and authorities

When you open an offer, the shop and any affiliate network receive the click data and become independent controllers of the data they collect on their own websites. We may disclose data to authorities when the law requires it. We do not sell your personal data.

Transfers outside the European Union

Some providers (OpenAI, Google, Twilio SendGrid) may process data in the United States. In those cases the transfer is based on the EU-U.S. Data Privacy Framework, for certified providers, or on the standard contractual clauses approved by the European Commission.

How long we keep data

• Account and saved content: as long as the account is active. When you delete it, we delete the account and the related data; conversations are detached from your account and kept without being associated with it any more. If you want those deleted too, write to us.
• Anonymous profiles: deleted within 90 days; if merged into an account, 30 days after the merge.
• Data extracted from unconfirmed bills: 90 days.
• Sign-in sessions: the session cookie lasts 30 days; the session log stays associated with the account for as long as the account exists.
• Clicks to shops and commissions: for as long as needed to account for commissions, handle checks by affiliate networks and meet legal obligations. If you delete your account, they are detached from you.
• Analytics: according to the retention periods set in PostHog and Google Analytics.

Your rights

You can ask at any time to access your data, rectify it, erase it, restrict its processing, receive it in a structured format (portability) and object to processing based on legitimate interest. You can withdraw consent at any time, without affecting processing already carried out: for analytics cookies, the “Cookie preferences” button in the Cookie policy is enough.

You can delete your account from the settings; for any other request write to hello@amaki.ai. You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where you live or work.

Mandatory and optional data

An email and password, or sign-in with Google, are needed to create an account; without one you can still use Amaki with an anonymous profile. All other data is optional: if you do not provide it, some features will not be available.

Minors

Amaki is not directed at people under 16, who cannot create an account.

Security

We protect data with appropriate technical and organisational measures: encrypted connections, credentials and tokens stored in encrypted form, and access limited to the staff who need it.

Changes to this policy

We may update this policy. The date of the last update is shown at the top of the page; for significant changes we will notify account holders.