Privacy policy

1. Data controller and contacts

The controller is Made in Evolve S.r.l., Via Rosalba Carriera 26, 41126 Modena (MO), Italy — VAT IT03497200364, REA MO-392876, Share capital €12,000. General contact: hello@madeinevolve.com. For anything related to personal data (requests, questions, complaints) write to privacy@nucleoplatform.com or, by certified email, to madeinevolve@pec.it.

Made in Evolve has appointed an external Data Protection Officer (art. 37 GDPR): Dott. Luca Lodi (external DPO). The DPO can be reached at privacy@nucleoplatform.com — requests addressed to the DPO are forwarded to him without delay — or by certified email at madeinevolve@pec.it.

2. Scope of this notice

• Website visitors — everyone who browses nucleoplatform.com (including /it), the pricing configurator, the docs, the changelog and the status page.
• Prospects and contacts — people who submit a form (demo/assessment request, contact, partner application, integration request, waitlist), subscribe to the newsletter, or exchange emails, calls or meetings with our team about Nucleo.
• Customers' representatives — administrators and billing contacts of organizations that subscribe to Nucleo: for account, contract and invoicing data we are the controller (see section 10).
• Platform users and their data — employees, customers and contacts of our customers whose data is processed inside Nucleo: here the customer is the controller and we are a processor under art. 28 GDPR. Section 10 tells you where to address your requests.
• This site has no user accounts and is intended for businesses and professionals; it is not directed to anyone under 18 and we do not knowingly collect their data.

3. What data we collect and where it comes from

• Form data (provided by you) — only what you type: name, work email, company, role, company website, annual revenue bracket, modules of interest, message, agency type and client platforms (partner form), software and API documentation link (integration request), module of interest (waitlist), and, if you attach one, the link to the stack you configured on the pricing page. Fields marked with * are required to handle your request; the others are optional.
• Newsletter data (provided by you) — email address, date, language and source of subscription (home page or opt-in box on a form), the record of the consent given (date, IP address, form), and interaction data on the emails we send (delivery, opens, clicks, unsubscribes): open and click tracking is active on newsletter emails and is used only to measure the newsletter and to remove inactive subscribers (see section 8).
• Correspondence and meeting data (provided by you) — the content of emails, calls and video meetings you have with our team, notes taken by our staff and, where you have been informed and agreed at the start of the call, recordings and AI-generated transcripts and summaries of the meeting (see section 11).
• Company data from public sources (not provided by you) — to qualify a request we may complete the record of your company (not of you as a person) with publicly available business information taken from public VAT registers (VIES), the company's own website and public business directories: website, sector, size, VAT number, registered address. We do not build profiles of individuals from social networks.
• Technical data (collected automatically) — our servers keep standard access logs: IP address, user agent, requested pages, timestamps, referrer and response codes, plus rate-limiting counters keyed on a hashed IP to prevent form abuse. A honeypot field in the forms detects bots without collecting anything from humans.
• Analytics and behavioural data (only with your consent) — through Google Tag Manager we load Google Analytics 4 (pages visited, approximate location derived from the IP and then discarded, device and browser type, interaction events; Google Signals is disabled, so no cross-device or demographic/interest data is collected) and Microsoft Clarity (heatmaps and session replays: clicks, scrolls, mouse movement; any text you type is masked at the source). Without your consent no analytics cookie is set and no identifier is created; Google Consent Mode v2 only sends cookieless, aggregated pings. Details in the Cookie policy.
• Pricing configurations (provided by you, anonymous) — the stack you compose on the pricing page is stored in your own browser (localStorage) and never leaves it unless you click “Save & share”: an anonymous copy (modules, packages, connections, volumes — no personal data) is then stored on our EU servers for 12 months and reachable by anyone with the link.

4. Why we process it — purposes and legal bases

For each purpose, the legal basis is indicated under art. 6(1) GDPR.

• Answering your request, scheduling demos and assessments, preparing quotes — pre-contractual measures taken at your request, art. 6(1)(b). The checkbox on each form documents that you have read this notice and asked to be contacted; providing the required data is necessary to handle the request, otherwise we cannot process it.
• Following up on the request for a reasonable period, keeping a record of the conversation in our CRM and contacting you about the same topic (for example to re-schedule a demo or to follow up on a quote) — our legitimate interest in developing business relationships with the organizations that approached us, art. 6(1)(f). You can object at any time (see section 9).
• Sending the newsletter — your consent, art. 6(1)(a), given by subscribing: the consent is recorded in our CRM with date, IP address and source form, and the address is then synchronised to our newsletter platform. Subscription is never a condition to use a form. Every issue includes an unsubscribe link; unsubscribing takes effect immediately.
• Measuring how the site is used and improving it (Google Analytics 4, Microsoft Clarity) — your consent, art. 6(1)(a) and art. 122 of the Italian Privacy Code, given through the cookie banner and revocable at any time from “Cookie preferences” in the footer, with no consequence other than turning those tools off.
• Keeping the site secure and running (logs, abuse and bot prevention, rate limiting, incident response) — our legitimate interest, art. 6(1)(f).
• Fulfilling legal obligations (accounting, tax, anti-fraud, responding to authorities) when a request becomes a contract — art. 6(1)(c).
• Establishing, exercising or defending legal claims — our legitimate interest, art. 6(1)(f).
• We do not sell personal data, we do not send marketing communications without your consent, and we do not use the data of website visitors and prospects to train AI models.

5. Automated decision-making, profiling and AI

• We do not take decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you (art. 22 GDPR).
• Profiling limited to analytics: only with your consent, Google Analytics 4 builds aggregated usage statistics (Google Signals is disabled: no demographic, interest or cross-device reports) and Microsoft Clarity records how pages are used and assigns a pseudonymous user identifier. Neither is combined with the data you type into our forms and neither is used for advertising by us. You can refuse or withdraw consent at any time.
• AI assistance in our CRM: incoming requests and emails may be classified, summarised and prioritised by Atomo, our AI assistant, which relies on third-party language models (see section 11). A person from our team always reads and decides how to handle your request; the AI never decides whether or how we answer you.

6. Who receives the data

Within Made in Evolve, data is accessible only to the sales, customer success and technical staff who need it, bound by confidentiality. Data is processed by the following suppliers acting as processors under art. 28 GDPR, or, where indicated, as independent controllers:

• DigitalOcean LLC (USA) — hosting of this website and of the Nucleo platform, on data centres located in Frankfurt (Germany) and Amsterdam (Netherlands); object storage on EU region.
• Twilio Inc. — SendGrid (USA, EU region) — delivery of form notifications and transactional emails, configured on the EU data residency region with click and open tracking disabled.
• Klaviyo, Inc. (USA) — newsletter delivery and subscriber management, only if you subscribe; the address is synchronised from our CRM (no Klaviyo script runs in your browser and the site does not call Klaviyo directly).
• Nucleo Brain (our own CRM, hosted on DigitalOcean in the EU) — storage of requests, contacts, consent history and correspondence. Form submissions are forwarded to the CRM directly via API, together with the record of the consents given (what you accepted, when and from which form); no mailbox is indexed to import them.
• Google Ireland Ltd. / Google LLC (USA) — Google Tag Manager and Google Analytics 4, only with your consent to analytics cookies.
• Microsoft Ireland Operations Ltd. / Microsoft Corporation (USA) — Microsoft Clarity, only with your consent to analytics cookies.
• AI model providers — Anthropic, OpenAI and Google (Gemini API), whose large language models are routed by Atomo — processing, via API, of the text we submit to Atomo for classification, summaries and transcripts, under API terms that exclude the use of the data to train their models and limit the retention of prompts. Transfers to the United States are covered by the EU-U.S. Data Privacy Framework or by Standard Contractual Clauses, depending on the provider (see section 7).
• Google Workspace (Google Ireland Ltd.) — our corporate email, calendar and document storage; Fireflies.ai Corp. (USA) — the AI notetaker our team uses on sales and assessment calls to record, transcribe and summarise them, only where the participants have been informed at the start of the call and have agreed.
• Professional advisors (accountants, lawyers), banks and payment providers, and public authorities where required by law — as independent controllers.
• We never share your data with advertisers or data brokers.

7. Transfers outside the EEA

Our services are configured on EU regions, but some suppliers are headquartered in the United States and may access data from there (for support, or for analytics and newsletter data). Such transfers rely on: (a) the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, for the suppliers that participate in the Framework as stated in their respective privacy notices (the list is published on dataprivacyframework.gov); and (b) in all other cases, the Standard Contractual Clauses adopted by the Commission (Decision 2021/914), complemented by a transfer impact assessment and supplementary measures such as encryption in transit and at rest. You can request a copy of the safeguards in place by writing to us.

8. How long we keep it

• Requests and CRM records of prospects: 24 months from our last meaningful contact with you, then deleted or anonymised — unless a contract is signed, in which case data is kept for the duration of the relationship and for 10 years afterwards for accounting and tax purposes (art. 2220 Italian Civil Code).
• Correspondence, call notes, recordings and AI transcripts: 24 months from the last contact; recordings and transcripts of meetings that did not lead to a contract are deleted within 12 months of the meeting.
• Newsletter: until you unsubscribe. Subscribers who have not opened any email for 24 months are removed from the list. Proof of consent (date, source, IP of confirmation) is kept for 24 months after unsubscription or removal to demonstrate compliance.
• Server logs and rate-limiting counters: up to 12 months (rate-limit counters expire within minutes).
• Google Analytics 4: user- and event-level data 14 months, then only aggregated reports. Microsoft Clarity: session recordings 30 days, heatmaps and aggregated data 13 months.
• Cookie consent choice: 6 months (then the banner asks again).
• Shared pricing configurations: 12 months from creation (they contain no personal data). Your local configuration stays in your browser until you clear it.

9. Your rights

You can exercise at any time, free of charge, your rights of access, rectification, erasure, restriction of processing, data portability and objection (arts. 15-21 GDPR), and withdraw any consent without affecting the lawfulness of processing carried out before withdrawal, by writing to privacy@nucleoplatform.com (or hello@madeinevolve.com). We answer within one month, extendable by two further months in complex cases. To object to processing based on our legitimate interest, tell us your specific situation; we will stop unless we can demonstrate compelling legitimate grounds.

Practical shortcuts: analytics — “Cookie preferences” in the footer; newsletter — the unsubscribe link in every issue.

You also have the right to lodge a complaint with the Italian supervisory authority — Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.gpdp.it — or with the authority of the EU country where you live or work, or where the alleged infringement took place.

10. The Nucleo platform (app.nucleoplatform.com): roles and where to address requests

• When an organization subscribes to Nucleo, it decides which data enters the platform (mailboxes, chats, calls, calendars, ERP, product data, orders, loyalty members, support tickets, marketing sources…) and why. That organization is the controller; Made in Evolve is its processor and acts only on its documented instructions under the Data Processing Agreement (see the DPA page).
• If you are an employee, customer, supplier or contact of one of our customers and want to exercise your rights on data processed inside Nucleo, please address the request to that organization: it is the one that can identify you and decide on your data. If you write to us, we will forward the request to the customer without delay and help it respond.
• For customers' administrators and billing contacts we are the controller of account data (name, work email, role, login and audit events, invoices) — to perform the contract (art. 6(1)(b)), meet legal obligations (art. 6(1)(c)) and secure the service (art. 6(1)(f)). This data is kept for the duration of the contract plus 10 years for accounting records; security and audit logs for 12 months.
• Nucleo runs on infrastructure in the European Union; each customer has a dedicated, logically separated database. Customer data is never used to train AI models, ours or third parties'.

11. How Nucleo uses AI (transparency under the EU AI Act)

• Atomo, the AI layer of every Nucleo module, uses large language models from third-party providers — Anthropic, OpenAI and Google (Gemini API) — selected through a routing layer that the customer can restrict in its settings, via API. Prompts and the data needed to answer are sent to the provider under API terms that exclude their use to train the provider's models and limit the retention of prompts. Atomo does not build its own models on customer data.
• You are always told when you interact with AI: Atomo's chat, suggestions, summaries, classifications and drafts are labelled as AI-generated in the interface. Small, reversible changes a user asks Atomo for (for example editing a product or adding a note) are applied directly and logged; sending messages, deletions, merges, bulk operations and price changes are only executed after a person confirms them. Some background AI activities run without a confirmation (for example classifying incoming emails, creating contacts or candidates from emails, filling empty fields): the customer can switch each of them off.
• Synthetic content: Catalog does not generate images or videos with AI, and Atomo does not generate them. Catalog can connect to third-party AI photo and video generation services chosen by the customer (including Made in Evolve's AI production service): those services produce the images and videos, which are then imported into the customer's DAM and linked to its products. Marking that content as AI-generated, as required by art. 50 of Regulation (EU) 2024/1689, is the responsibility of the provider of the generation service; customers who publish that content remain responsible for any additional disclosure required by the channel or by law.
• Meeting recordings and transcripts: Nucleo can attach recordings and AI transcripts of calls to contacts and deals. Whoever records must inform all participants at the start of the call and obtain their agreement where required; Nucleo does not record calls on its own initiative.
• AI outputs can be inaccurate or incomplete: they are aids to human decisions, never a substitute for them. Nucleo is not designed to and must not be used to evaluate employees' performance or behaviour, to infer emotions, or for any practice prohibited by art. 5 of the AI Act; see the Terms and the DPA.
• Made in Evolve is a deployer of general-purpose AI models and the provider of the Nucleo software that integrates them. We keep AI-literacy training for our staff (art. 4 AI Act), document the models in use and their limits, and update this notice when models or capabilities change.

12. Security

Data is encrypted in transit (TLS 1.2+) and at rest, access is role-based and logged, infrastructure is defined as code and patched regularly, backups are encrypted and stored in the EU, and secrets are never stored in the code base. Our infrastructure providers are selected for their security certifications (DigitalOcean data centres are ISO 27001 and SOC 2 certified).

13. Updates

We update this notice whenever the site, the tools we use or the law change; if a change materially affects you (for example a new purpose or a new tool that requires consent) we will ask for consent first or inform you before it takes effect. The date at the top reflects the latest revision; earlier versions are available on request.