Privacy &
Cookie Policy

Controller

The data controller for the processing described in this notice is Francesco De Falco.

Privacy enquiries and requests to exercise data protection rights may be sent to info@nocturlabe.ai.

Data, purposes and legal bases

Website operation and security

When the website is accessed, the technical infrastructure may process IP address, date and time, requested resource, browser and device information, response status and security events. These data are used to deliver the website, maintain its integrity, prevent abuse and diagnose faults. The legal basis is the controller’s legitimate interest in providing a secure and reliable service (Article 6(1)(f) GDPR).

Language preference

The website stores the language selected by the visitor in the browser. This preference is used only to serve the requested language and is necessary to provide that user-requested functionality.

Enquiries by email

If you contact us, we process the contact details and information included in your message to respond, assess a possible business relationship and manage subsequent communications. The legal bases are steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and, where applicable, our legitimate interest in managing professional enquiries (Article 6(1)(f) GDPR).

Strategic demo bookings

The “Book a strategic demo” link opens Calendly, a third-party service. Data entered there are collected through Calendly and then made available to us to organise and conduct the meeting. Before submitting data, you can review Calendly’s privacy notice. Our processing of the booking data is based on steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).

Consented analytics and campaign measurement

If you select Analytics, Google Analytics 4 may process online identifiers, device and browser information, approximate location, referring and visited pages, and approved website interactions to measure audience, acquisition and performance. Google Tag Manager distributes the approved tags and receives the consent state. If you select Marketing, the Meta Pixel may process browser and device identifiers, IP address and technical information, the viewed URL and referrer, and approved events such as page views, strategic-demo requests, email-contact clicks and confirmed leads. We use these data for campaign measurement, attribution, audience creation, retargeting, advertising personalisation and optimisation. The legal basis is your consent (Article 6(1)(a) GDPR).

Legal obligations and disputes

Information may also be processed where necessary to comply with a legal obligation (Article 6(1)(c) GDPR) or to establish, exercise or defend legal claims (Article 6(1)(f) GDPR).

Sources and provision of data

Technical data are generated automatically when the website is accessed. Contact and booking data are provided directly by you, including through the external scheduling service you choose to use.

Providing the technical data necessary to establish the connection is required to access the website. Providing contact or booking information is optional, but without the information marked as required it may not be possible to answer the enquiry or arrange the requested meeting.

Retention

• Technical and security logs are generally retained for up to 30 days, unless a longer period is required to investigate security events or comply with legal obligations.
• Enquiries and demo-related communications are generally retained for up to 24 months after the last meaningful interaction, unless a business relationship begins or longer retention is required for legal claims.
• Records required by law are retained for the applicable statutory period.
• The language preference remains in the browser until it is changed or deleted by the user.
• Google Analytics event-level and user-level data are retained for 14 months under the property setting; aggregated reports may remain available for longer.

Recipients and transfers

Data may be accessed by authorised persons and by technical service providers supporting hosting, security, email, scheduling and consented measurement, acting under appropriate contractual and confidentiality safeguards where required. Google Ireland Limited and its affiliates may process consented analytics data through Google Tag Manager and Google Analytics under the applicable Google data-protection terms and privacy policy. For customer scheduling data made available through the service, Calendly generally acts as a processor on the customer’s instructions; it may act as an independent controller for data it processes for its own account, service and website purposes, as described in its privacy notice.

Some providers may process data outside the European Economic Area. Where applicable, transfers are based on an adequacy decision, Standard Contractual Clauses or another mechanism permitted by Chapter V GDPR, together with any necessary supplementary safeguards.

Links to Calendly and to NOCTURLABE’s social profiles lead to external websites. Their providers process data under their own privacy notices once those services are accessed.

Your rights

Subject to the conditions set by the GDPR, you may request access, rectification, erasure, restriction, portability or object to processing. Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

Send requests to info@nocturlabe.ai. We may ask for information reasonably necessary to verify identity. You may also lodge a complaint with the Italian Data Protection Authority or another competent supervisory authority.

Cookies and similar technologies

NOCTURLABE uses Google Tag Manager as its consent-controlled delivery layer. Google Analytics 4 is activated only after Analytics consent. Meta Pixel is activated only after Marketing consent. No non-essential tracker is activated before the corresponding consent.

The website uses the following first-party browser-storage items for technical preferences, consent governance and security:

Google Analytics may set first-party identifiers such as _ga and property-specific _ga_* identifiers, normally for up to two years, after Analytics consent. Their actual duration may be shortened by browser controls, deletion, withdrawal or Google configuration. Google Tag Manager is a delivery mechanism and does not require a separate consent category beyond the purpose of the tag it delivers.

Consent architecture

Optional technologies are denied by default and activated only for the categories selected by the visitor. Analytics enables Google Analytics 4. Marketing enables Meta Pixel, supplied by Meta Platforms Ireland Limited, only after an affirmative choice. Meta may use cookies or similar identifiers and process the approved event data to provide measurement, attribution, audience, retargeting, personalisation and campaign-optimisation services. Meta determines the retention applicable within its systems and may process data outside the European Economic Area under the transfer safeguards described in its privacy documentation. NOCTURLABE does not send Calendly answers, free-text messages or special-category data through the Pixel. Conversions API and consented first-party matching are not active until a controlled server-side implementation and a further privacy and payload review are completed.

The “Cookie settings” control in the footer can be used at any time to review or withdraw a choice. A new consent will be requested when the policy version or the configured purposes change.

Managing browser storage

You can delete local storage and cookies through your browser settings. Doing so resets the saved language preference. Blocking technical storage may affect the ability to remember choices between visits.

Updates

This notice may be updated when the website, processing activities or legal requirements change. The effective date shown above identifies the current version. Material changes affecting consent will be presented again before the relevant non-essential processing is activated.