Privacy Policy — Rebel VIP S.r.l.

1. Introduction

Rebel VIP S.r.l. ("Company," "we," "us," or "our") operates the Animaflow platform and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our software, website, and services (collectively, the "Services").

CRITICAL CLARIFICATION: Animaflow is designed as a self-hosted, on-premise solution. We do not process your production data, HR data, or project files. All sensitive data remains entirely on your servers. This Privacy Policy covers only the limited personal data we collect for account management, licensing, and support.

By accessing or using our Services, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Services.

2. Information We Collect

2.1 Personal Data — Account and Billing Only

We collect personally identifiable information only when you voluntarily provide it for account creation and licensing:

• Name and surname
• Email address
• Company/Studio name
• Job title and role
• Billing information (processed by third-party payment processors — we do not store credit card details)
• Phone number (optional)
• Billing and licensing contact information

What we do NOT collect:

• ❌ Your production data (projects, creative assets, files)
• ❌ Your HR data (employee names, roles, performance data, candidate information)
• ❌ Your RAG (Retrieval-Augmented Generation) data
• ❌ Any content processed by Animaflow AI on your servers
• ❌ Your internal studio databases or documents

2.2 Usage Data — Aggregate and Non-Identifying

We automatically collect limited information when you access our Services and website:

• IP address and approximate geographic location
• Browser type and version
• Operating system
• Access times and dates
• Pages visited on our website
• Features used (aggregate feature adoption, NOT personal analysis)
• Referring website addresses
• License validation events (license key verification only — no data content transmitted)

What we do NOT collect:

• ❌ Data about your use of Animaflow AI on your servers
• ❌ Outputs or inputs to Animaflow AI HR
• ❌ Content of your files or projects
• ❌ Details of your studio's internal operations

2.3 Self-Hosted Deployment Data — Complete Isolation

Animaflow is deployed entirely on your infrastructure (on-premise or your cloud account). Complete data isolation is guaranteed:

• ✅ Your production data, project files, and creative assets remain entirely on your servers
• ✅ Your HR data (candidates, employees, performance reviews) remains entirely on your servers
• ✅ Your RAG (Retrieval-Augmented Generation) is generated and remains entirely on your servers
• ✅ Animaflow AI processes run locally — no data is transmitted to Rebel VIP servers
• ✅ We have no access to your self-hosted data under any circumstances
• ✅ License validation requires only minimal communication: license key verification, nothing more
• ✅ Support access (if needed) requires your explicit, written approval and temporary access tokens that expire automatically

Data Flow Diagram:

YOUR STUDIO
├─ Animaflow (licensed software)
│  ├─ AI HR Module (runs locally)
│  ├─ Your HR data (stays local)
│  └─ Your RAG (generated locally, stays local)
└─ No data exits your infrastructure

         ↕ ONLY: License key + Billing info

REBEL VIP SERVERS
├─ Licensing service
├─ Billing system
└─ Support channels (on-demand, with approval)

3. How We Use Your Information

We use the limited information we collect for the following purposes only:

What we do NOT use your data for:

• ❌ Training AI models (we NEVER use your data to train Animaflow AI)
• ❌ Profiling or analyzing your studio's operations
• ❌ Marketing beyond service announcements
• ❌ Selling or sharing with third parties for commercial purposes

4. Legal Basis for Processing (GDPR & AI Act)

If you are located in the European Economic Area (EEA), our legal basis for collecting and using your personal data depends on the specific context:

4.1 GDPR Legal Basis

• Contract Performance: Processing necessary to provide Animaflow services and manage your license
• Legitimate Interests: Processing necessary to operate, secure, and improve our Services
• Consent: Where you have given explicit consent (e.g., marketing communications)
• Legal Obligation: Processing required by law (e.g., tax, financial records)

4.2 AI Act Compliance (EU 2024/1689)

Important: Rebel VIP complies with the EU AI Act for high-risk AI systems:

• ✅ We provide transparent documentation of how Animaflow AI HR operates (see our "AI Act Compliance Documentation")
• ✅ We do NOT train on your data — your HR data never leaves your servers
• ✅ AI HR is supportive, not autonomous — your team always makes final decisions
• ✅ Explainability is built-in — Animaflow AI output includes reasoning (why a candidate was ranked, why a trend was identified)
• ✅ We support your DPIA — we provide technical documentation and templates so your studio can conduct its own Data Protection Impact Assessment
• ✅ We monitor for bias and provide guidance to help you test for bias in your deployment

You (the Studio) are the Data Controller for HR data. You are responsible for:

• Conducting a DPIA if you use Animaflow AI HR for recruitment or employment decisions
• Disclosing to employees/candidates that AI is used in HR processes (GDPR Art. 13-14)
• Ensuring no discriminatory outcomes (AI Act Art. 6)
• Testing for bias before production use
• Maintaining 3 years of audit logs (AI Act Art. 12)

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We share your information only in these specific circumstances:

5.1 Service Providers

We may share limited information with trusted third-party vendors:

• Payment Processors (Stripe, PayPal, etc.) — billing information only, bound by Data Processing Agreements
• Email Service Providers (Mailchimp, SendGrid, etc.) — email address + name for communications, bound by DPAs
• Analytics Providers (aggregate, non-identifying usage data only)

All service providers are contractually bound to process data only as instructed and to maintain confidentiality.

5.2 Legal Requirements

We may disclose your information when required by:

• Court order or judicial authority
• Government request (with proper legal process)
• Law enforcement investigation
• Applicable laws or regulations

5.3 Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred with appropriate notice and opportunity to object.

5.4 Protection of Rights

To protect our rights, privacy, safety, or property, and that of our users, we may disclose information if necessary (e.g., preventing fraud or abuse).

5.5 With Consent

We share information with your explicit consent for any other purpose.

5.6 What We Do NOT Share

• ❌ We do not share your production/HR/project data (we don't have access to it)
• ❌ We do not sell analytics about your studio's usage to competitors or third parties
• ❌ We do not share identifiable data with marketing partners

6. Data Security

We implement appropriate technical and organizational security measures to protect your personal data:

6.1 Technical Measures

• ✅ Encryption in transit: TLS 1.2+ for all data transfer
• ✅ Encryption at rest: AES-256 for stored data
• ✅ Access controls: Role-based access, multi-factor authentication for admin access
• ✅ API security: Token-based authentication, rate limiting
• ✅ Regular security updates: Patches applied promptly
• ✅ Penetration testing: Annual third-party security audits
• ✅ Intrusion detection: Monitoring for unauthorized access

6.2 Organizational Measures

• ✅ Employee training: All staff trained on data protection and confidentiality
• ✅ Vendor vetting: Third-party services assessed for security compliance
• ✅ Incident response: Documented procedures for security breaches
• ✅ Data minimization: We collect only necessary data

6.3 Limitation of Liability

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. You are responsible for the security of your self-hosted Animaflow deployment.

7. Data Retention

We retain your personal data only for as long as necessary:

Upon account deletion:

• ✅ All your personal data is deleted within 30 days
• ✅ Billing records retained only as required by law (7 years)
• ✅ Usage logs anonymized/deleted

8. Your Rights

Depending on your location, you have the following rights regarding your personal data:

8.1 GDPR Rights (EU/EEA Residents)

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restriction: Request restriction of processing in certain circumstances
• Right to Portability: Request your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
• Right to Lodge a Complaint: File a complaint with your local data protection authority

8.2 AI Act Rights (EU Residents Using AI HR)

If you use Animaflow AI HR:

• Right to Explanation: You can request an explanation of how AI made a specific recommendation (e.g., ranking a candidate)
• Right to Human Review: You can request that important HR decisions be reviewed by a human, not just AI
• Right to Appeal: You can appeal any AI-based HR decision or recommendation
• Right to Opt-Out: You can choose not to use AI HR and use only traditional methods

8.3 How to Exercise Your Rights

To exercise any of these rights, please contact us:

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. When we transfer data internationally (including to non-EEA countries), we implement appropriate safeguards:

• ✅ Standard Contractual Clauses (approved by the European Commission) with all third-party processors
• ✅ Adequacy decisions where applicable
• ✅ Binding Corporate Rules for internal transfers
• ✅ Your consent for any transfers without formal legal mechanisms

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website (not in the Animaflow software itself):

10.1 Types of Cookies

10.2 Your Cookie Choices

• ✅ You can control cookies through your browser settings
• ✅ You can opt-out of analytics via our cookie consent banner
• ✅ Disabling certain cookies may affect website functionality but not software performance
• ✅ We respect Do Not Track (DNT) signals

11. Children's Privacy

Our Services are not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take immediate steps to delete that information.

12. Third-Party Links

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

13. Data Protection Officer

If you have concerns about our data practices or wish to file a formal complaint, you may contact:

For EEA residents, you also have the right to lodge a complaint with your local data protection authority.

14. AI Act Compliance Documentation

Important: If you use Animaflow AI HR, please also review our:

• "Dichiarazione di Conformità AI Act + Documentazione Tecnica" — Technical documentation of Animaflow AI, bias testing guidance, security measures, and your obligations as a Data Controller
• DPIA Template for Clients — Guidance to help you conduct your own Data Protection Impact Assessment
• Bias Testing Guidance — How to test Animaflow AI for fairness in your studio's context
• Privacy Notice Template (AI HR) — Template language to disclose AI use to your employees/candidates

These documents are provided to all clients at onboarding and are available upon request.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending you an email notification (if changes are significant)

Your continued use of the Services after changes constitutes acceptance of the updated Privacy Policy.

16. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: