Privacy Policy

1. Who is the data controller

The data controller is Nexus Business Partner S.r.l., with registered office at Via dei Mille 191, 97019 Vittoria (RG), Italy, tax code and VAT number 01897490882, registered with the Registro delle Imprese del Sud Est Sicilia (REA RG-488772), share capital 10.000,00 € i.v. (fully paid up), acting through its legal representative.

For any privacy question and to exercise your rights you can write to assistance.bigbrotherstudio@gmail.com, to our certified email (PEC) nexusbusinesspartnersrl@pec.it, or by post to our registered office.

2. Two different roles: users' data and the data of the firms' clients

• Data of the people who use BigBrotherStudio (the admin who registers the firm and the staff members they invite): for this data Nexus Business Partner S.r.l. is the data controller.
• Data that a firm enters about its own clients (client records, accounting update dates, communications, email summaries): the controller is the firm, which decides what data to enter and why. Nexus Business Partner S.r.l. is a data processor (Article 28 GDPR): it processes this data only to provide the service to the firm, according to its instructions and to the data processing agreement that is part of the contract. If you are a client of a firm and want to exercise your rights over this data, please contact the firm: we help it to answer you.

3. What data we process

Account data

• first name, last name, email address, role in the firm (admin or staff member) and name of the firm;
• the password, which you choose: only the authentication service keeps it, in encrypted form, and nobody (not even us) can read it;
• if you use “Sign in with Google”: name, email address, Google account identifier and possibly your profile picture, which Google shares with us when you authorise it (section 5).

Usage and security data

• date and time of your last sign-in;
• the firm's activity log: who did what and when (for example invitations, client assignments, changes to permissions and settings), visible to the firm's admins;
• the servers' technical logs (IP address, browser type, request times), kept by our suppliers for the operation and security of the service;
• for the artificial intelligence features, numbers only: how many requests, how much text and with what outcome, never the content sent.

Data entered by the firm (as processor)

• the firm's client records: company name, owners, tax code, VAT number, phone, email addresses, notes, and work data such as turnover, number of employees, type of bookkeeping and level of difficulty;
• who in the firm each client is assigned to, and the dates up to which VAT and bookkeeping are up to date;
• communications with clients: entries written by hand, summaries of pasted conversations (emails, chats, text messages, notes) and, if the firm turns it on, summaries of emails read in read-only mode (section 5);
• the firm's tasks, with their comments and the documents uploaded to the tasks (for example PDF, Word, Excel files and images), kept in the service's private file storage, in the European Union;
• if the admin enters them, the firm's details for the notice on email reading: full name, address, privacy contact and any data protection officer.

Imported Excel and CSV files

The file is read in your browser and is not saved on our servers. If you choose the analysis with artificial intelligence, the rows of the file go through our server to the AI only to propose the import (section 6). Only the clients that the admin confirms are saved.

4. Why we process it and on what legal basis

• Providing the service: creating and managing accounts, letting the firm's people work on their clients, sending service emails (address confirmation, invitations, password recovery, important notices such as the deletion of the firm). Legal basis: performance of the contract with the firm and of steps requested by the user (Article 6(1)(b) GDPR) and, for invited staff members, the legitimate interest of the firm and ours in running the service the firm has chosen (Article 6(1)(f)).
• Security and abuse prevention, including activity and technical logs. Legal basis: legitimate interest in protecting the service, the firms and their data (Article 6(1)(f)).
• Legal obligations, for example tax obligations or requests from the authorities. Legal basis: legal obligation (Article 6(1)(c)).

We do not use data for advertising, we do not profile anyone and we do not sell data to anyone. We do not make decisions based solely on automated processing that produce legal effects on people (Article 22 GDPR).

5. Sign in with Google and data received from Google

Sign in with Google

If you choose “Sign in with Google”, we ask Google only for the basic sign-in permissions (your name, your email address and your profile picture). We use them only to create your account and recognise you when you sign in, never for other purposes.

Read-only email reading (Gmail)

This is an optional feature: it stays off until it is turned on for the firm, and each person decides whether to connect their own mailbox (“La tua email” page), by granting the permission on Google's screen. Everyone connects only their own mailbox: the firm's admin only sees whether it is connected, never the address or the emails. For email reading the data controller is the firm, which decides whether and why to use it; Nexus Business Partner S.r.l. runs it as data processor. Before connecting the mailbox, each person reads the notice for people who connect their mailbox (in Italian and in English: the language is chosen at the bottom right of the page), which inside the software shows the firm's details, and confirms with a checkbox that they have read it: the version read and the date are recorded. When the feature is on:

• we ask Google for a single, read-only permission (gmail.readonly): BigBrotherStudio cannot send, reply to, forward, draft, move, label or delete emails. If Google gave us a different permission, we refuse it and revoke it immediately;
• our server checks the mailbox every 10 minutes, from 8 am to 9 pm, Monday to Saturday (Italian time), and when someone in the firm presses “Update now”. It only looks at emails received or sent after the connection: it never reads the emails that were already there;
• for each new email the server first looks only at the sender and recipients (without the text) and compares them with the email addresses registered for the firm's clients. Emails that do not involve a client are ignored: their text is not opened, the AI does not see them and we store nothing about them, neither the sender, nor the subject, nor the message identifier. We only keep their number (for example “12 emails ignored”), for 30 days;
• for client emails, the text is sent to the artificial intelligence (section 6) to write a summary in the client's record. We keep the summary, sender and recipients, subject, date, attachment file names and the message and conversation identifiers (so as not to record the same email twice and to keep replies together). The full text of the emails is not stored (it stays in memory only for the seconds needed, never in technical logs) and attachments are never opened or downloaded;
• emails stay “unread” in your mailbox until you open them;
• the summaries are visible only to the firm's people who can see that client. No one at Nexus Business Partner S.r.l. reads your emails or the summaries, unless you or the firm ask for it for support, for security reasons or because the law requires it;
• the Google permission is stored encrypted on the server and you can revoke it whenever you want, with “Scollega” (Disconnect) in BigBrotherStudio or from your Google account (myaccount.google.com/permissions). We also revoke it at Google when your account in the firm is deactivated or suspended and when the firm is deleted.

Limited use of data received from Google

BigBrotherStudio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, the data received from Google is used only for the features described above, which are visible to the people who use the service; it is not used for advertising, it is not sold, it is not used to train artificial intelligence models (neither by us nor by the AI provider) and it is shared with others only as described in section 7, to provide the service.

6. Artificial intelligence

Some features use Claude, the artificial intelligence model of Anthropic PBC (United States), through its service for businesses:

• “Import from Excel”, if the admin chooses the analysis with AI: the rows of the file;
• “Paste a conversation”: the pasted text (an email, a chat, text messages, the notes of a call or of a meeting), to propose the date, the channel and the summary;
• email reading, if turned on: the text of client emails and, to follow the thread, the previous summaries of the same conversation.

We send the AI only this, never passwords or access permissions, and never the emails that do not involve a client. Under Anthropic's commercial terms, the data is not used to train models and, with the model used by BigBrotherStudio, Anthropic normally does not keep it after responding: it keeps it only if the law requires it or if its safety systems flag the content (in that case for up to 2 years). Imports and summaries of pasted conversations are saved only after a person confirms them (the pasted text is not saved in the service); summaries of emails read automatically go into the client's record on their own, marked as “automatic summary”. The AI can make mistakes: the firm checks the important information.

7. Where the data is and who processes it for us

BigBrotherStudio's database, accounts and files are hosted in the European Union. To provide the service we rely on these suppliers, which process data on our behalf as processors or sub-processors, under agreements that bind them to confidentiality and security:

• Supabase Inc.: database, authentication and file storage, with the data in a data centre in the European Union (Frankfurt, Germany);
• Vercel Inc. (United States): website hosting, with the server functions in the Frankfurt region;
• Sendinblue SAS (Brevo) (France): sending of service emails;
• Anthropic PBC (United States): artificial intelligence (section 6);
• Google: Sign in with Google and, if turned on, read-only email reading (section 5).

Some of these suppliers are based in the United States or may process data outside the European Union: in these cases the transfer takes place with the safeguards required by the GDPR, that is the standard contractual clauses approved by the European Commission and, where the supplier participates in it, the EU-U.S. Data Privacy Framework. Apart from these suppliers, we disclose data only to the authorities when the law requires it.

8. How long we keep the data

• Account and firm data: for as long as the firm uses the service. A deactivated person can no longer sign in, but their name remains in the firm's history.
• Deleted firm: for 30 days it remains “being deleted” and the admin can cancel; after that all the firm's data and its people's accounts are permanently deleted (earlier, on request).
• Deleted clients: they stay in the firm's recycle bin for 30 days, then they are permanently deleted.
• Task documents: they remain as long as the task exists, even when it is closed; they are permanently deleted, files included, when the firm permanently deletes the task's client (also from the recycle bin, after the 30 days) or when the firm is deleted. A file uploaded only in part and never confirmed is deleted within two days.
• Backups: the database is backed up every day and backups are kept for 7 days; deleted data also disappears from the backups within 7 days. The document files are not included in these backups.
• Emails: the text is never kept, and nothing is kept about emails that do not involve a client; summaries remain until the firm deletes them, together with the client or the firm. The mailbox check counts (how many new, client and ignored emails) are kept for 30 days. The Google permission is deleted when the mailbox is disconnected, together with the confirmation of the notice, which also remains in the firm's activity log.
• Technical logs of our suppliers: for the short periods set by their services, for security.
• Billing data, if provided for by the contract with the firm: 10 years, as required by law (Article 2220 of the Italian Civil Code).

9. Security and confidentiality

• all connections are encrypted (HTTPS);
• each firm is separated from the others directly in the database: access rules prevent a person from seeing the data of a firm that is not theirs, and within the firm everyone sees only what their role allows;
• passwords handled by the authentication service, Google permissions stored encrypted;
• documents uploaded to tasks are kept in private file storage: they have no public address and can only be opened with a temporary link, valid for a few minutes, created after checking that the person can see the task;
• an activity log of important operations and daily backups;
• Nexus Business Partner S.r.l.'s staff do not look at the data of the firms' clients: the platform management tools show only settings and numbers, never client data. Technical access to the data takes place only for support requested by the firm or because the law requires it.

10. Cookies

BigBrotherStudio uses only technical cookies, needed to keep you signed in and to remember the language you choose with the selector at the bottom right (Italian or English, for one year). It does not use profiling, statistics or third-party cookies, and fonts are served from our own website without calling external services. Technical cookies do not require consent (Guidelines of the Italian Data Protection Authority of 10 June 2021).

11. Your rights

At any time you can ask to access your data, correct it, delete it, restrict its processing, receive it in a machine-readable format (portability) and object to processing based on legitimate interest (Articles 15-22 GDPR). You can also revoke the email reading permission at any time, without consequences for the rest of the service.

Write to assistance.bigbrotherstudio@gmail.com or to our PEC nexusbusinesspartnersrl@pec.it: we reply within one month. For the data that a firm has entered about its clients, the request must be made to the firm (section 2). If you believe that the processing breaks the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

12. Minors and changes to this policy

BigBrotherStudio is a service for professional firms and is not intended for people under 18.

If this policy changes, we publish the new version here with its update date; we notify the firms' admins of important changes by email. See also the Terms of Service.