Privacy notice

1. Who processes the data and how to contact us

The data controller is Alfatauri di Curcio Andrea, a sole proprietorship, VAT number 03666510791, based at Piazza Tommaso Campanella 6, Lamezia Terme (CZ), Italy. For any request about your data: ciao@tobia.io; for formal communications: andreacurcio@pecaruba.it (Italian certified email, PEC).

In this notice, “we” means Alfatauri di Curcio Andrea; “you” means anyone who uses Tobia; “Space” means the journey involving several parties that you open or are invited to join.

2. The general rule, before anything else

Tobia has one form of closure: the envelope stays closed for a period, and that period has an end date. Until every party has finalized their answers, nobody can see anyone else’s answers: they can only see whether the others have finished. Once everyone has finalized, what you declared about the shared project becomes visible to the people sitting at the same table as you. This is how the product works, not an accident, and from that point it cannot be reversed.

This rule matters more than any other line on this page: read the rest with it in mind.

3. What we collect, at each step

Here is what enters the system, in the order it happens.

• You join the waiting list. Only your email and the sign-up date, so we can let you know when Tobia is ready.
• You arrive through a referral link. If you open Tobia through a link someone sent you, that link carries an eight-character code that ends up in a cookie in your browser (cookie notice, section 4). If you later open an account, we save a record saying you came from that person, and the date, so we can award them a complimentary entry. The record is written only once and never changes. The person who referred you cannot see your name or know it was you: they only see numbers (section 5).
• You open an account. You sign in through a link sent to your email, or through Google or Apple if you choose that option: in that case, we receive your name and email from the provider you chose. We do not store passwords.
• You accept the pact of a Space. We ask for your phone number, once: not to call you, but because the document sealed at each step has to say who declared, not only what. If you have already given it, we do not ask again.
• You close the “Venirsi incontro” step. Before sealing it we ask for your Italian tax code (codice fiscale) and home address. From that step on, the document is no longer a summary: it is an instrument that identifies the people who signed it, and that is the reason it exists. The tax code remains your own declaration: we only check its format and check character, we do not compare it against any public register and we do not ask for identity documents.
• You download the document of a step. Before handing it over we email you a six-digit code, valid for ten minutes and for a single download: it exists so that a browser left open is not handed a document carrying other people’s tax codes. We never keep the digits, only their hash, and the code is discarded once used or expired. For every download we record who, when, from which IP address and with which browser, plus two hashes: one of the content and one of the confirmation. This log is visible to all parties of the Space (section 5).
• You complete your profile. First name, last name, occupation. They let the other party know who they are speaking with: that is central to the service.
• You upload a profile photo. It goes into a bucket that is currently public: anyone who knows the file address can view it, even without an account or signing in. We chose this to avoid generating a signed link on every screen. If you do not want this exposure, do not upload a photo.
• You open a Space. The name you give the project and the scope you describe (what it is about). If you write text, dictate, provide a website, or upload a PDF so we can identify the scope, we do not save that material ourselves: it passes in real time to an artificial intelligence provider (section 7), which processes it to give you a suggestion.
• You invite someone. The email of the person you invite and, when you state it, the role you expect them to have. By giving us a third party’s email, you declare that you are entitled to do so and have informed them; the terms require this too.
• You state your role. When you enter a Space, you state the role you believe you have. It is compared openly at the table with the role that had been assigned to you.
• You pay. When a step requires payment (entry to the table, an opinion, or a subscription), payment takes place on a page run by our provider, Stripe: your card details never pass through Tobia and we do not store them. We keep the order (which Space, which step, amount, status, and type of payment method used, never its number), technical transaction identifiers, and proof of the two boxes you tick before paying (the final paragraph of section 3). If you choose Klarna or PayPal, those providers also process your data as independent controllers under their own notices.
• You earn or use a complimentary entry. The first time someone who arrived through your link pays for something, we save a record awarding you a complimentary entry: the person it came from, the payment that triggered it, when it happened, and later the Space where you spent it. You do not learn what that person paid for or when: only that the complimentary entry arrived.
• You answer the Probe. Your answers about money, time, family, risk, and your way out remain invisible to everyone until the envelope opens.
• You complete the Cucitura. What you think about each person at the table and what you would lose if they left: section 6 deals with this separately because it is the most sensitive part of this notice.
• You receive the report (Lettura). A document comparing the answers of all parties: from then on it is immutable and can no longer be edited (section 10 explains why and what this means for your right to erasure).
• You state the outcome. How things went, even months later. This is optional, but if you respond, your statement becomes visible to everyone at the table, with your name.
• You request a reference. The name, email and signed response of an external person whom you identify as a reference for one of your skills: you gave us their address, declaring that you are entitled to do so.
• You upload a file. Documents you provide to support the Space go into private storage visible only to the parties in your Space.
• You use the live room. Messages you write to Tobia in the room (Boiler Room): the conversation context, including the report, passes to the artificial intelligence provider for the duration of the request. We also record how many times you use it and which model, to enforce the applicable usage limits.

Whenever you accept a legal document—these terms and this notice when opening your account, the agreement when entering a Space, specific clauses if you declare that you are acting as a professional or for a company—we record proof: which document, which version, a digital fingerprint of the exact text you saw, the time, IP address, and browser or device used. This lets us show what you accepted if necessary. Once recorded, this proof cannot be modified or deleted.

We also collect automatically: a technical log of who did what and when (for security and diagnosis), a log of the emails we sent you with the recipient address (to avoid sending the same email twice), and the cadence and expiry dates that you or the system set for the Space. We also collect website visit statistics as described in the cookie notice.

4. Why we do it and on what legal basis

Almost everything we collect is needed to perform the contract you accept when using Tobia (the terms): profile, photo, Space, roles, answers, Cucitura, report, outcomes, materials, skills, live room, and scheduled dates. Phone number, tax code and home address fall under the same contract: the document that identifies the parties is what the service produces, and without those details we could not produce it. The exceptions are:

• the waiting-list email: consent, given when you submit the form;
• the six-digit code you confirm before downloading, and the hash of that confirmation kept in the log: contract, and our and the other parties’ legitimate interest in not handing a document carrying everyone’s identifying details to someone who is not that person;
• the download log, with IP address and browser: the legitimate interest of all parties in knowing who took a copy of their shared document, and ours in security. The pact itself promises this, which is why it is visible to the whole table and not only to us;
• the email of people you invite and references you identify: our legitimate interest in making the journey work, together with your declaration that you have informed them;
• the log of sent emails: contract (avoiding service failures for you) and legitimate interest (not sending the same thing twice);
• the technical event log: legitimate interest in security and diagnosing problems;
• proof of acceptance of legal documents (the agreement, terms, this notice, and any specific clauses): legitimate interest in being able to show what you accepted, when, and which version;
• website visit statistics: legitimate interest for the part without cookies, consent for Google Analytics 4;
• the fact that you arrived through a referral link and the complimentary entries arising from it: our and the referrer’s legitimate interest in recognizing word of mouth, and contract for the part that becomes a complimentary entry to use;
• payment data: contract for the order and its fulfilment, legal obligation for tax and accounting records, and legitimate interest in fraud prevention (which the payment provider also carries out as an independent controller).

5. Who can see what

The same rule applies as in the terms, section 7. What the other party can see: before all parties have finalized, nothing is shared except a binary status (“finished” / “not yet”). Once everyone has finalized, answers become visible to all parties in the same Space at the same time: nobody sees them before anyone else. From then on, disclosure is irreversible for you and for them.

There are some exceptions to this general rule:

• the profile photo is visible to anyone who has the file address, even without an account (section 3);
• a person confirming a skill sees only that skill and your name, never your Space or answers; the person who requested it sees the reference’s first name, last name, and role;
• judgments about people (Cucitura, expected roles, outcomes, progress status, group decisions) have their own visibility rules, set out one by one in section 6;
• of your identifying details — first name, last name, email, phone, tax code, home address — nothing is shown on screen: the other parties keep seeing your name and nothing else. They appear only inside the document of a sealed step, which is identical for every party and which each of them can download. From that moment the other parties hold your tax code and home address in a file that is as much theirs as yours: that is why the document exists, and there is no going back. Someone who has left the table does not enter documents sealed after their departure.
• the download log is visible to the whole table: who downloaded which step and when. The IP address and browser stay with us alone. This is a deliberate choice: recording who downloads without telling the others would be surveillance; telling everyone is a symmetrical fact.
• for payments, the other people at the table see only one binary fact: whether your entry is complete. They never see the amount, method, or whether your entry was included. If an entry is missing for a long time, the table may be asked to decide whether to wait or start without that person: the decision names the person, like other group decisions (section 6);
• for referrals, no person is visible. Someone who recommended Tobia sees only counts—how many people arrived through their link, how many opened a Space, and how many complimentary entries they earned and used—never a name, email, or date tied to a person. Someone arriving through a link cannot see anywhere within Tobia that they arrived through someone else.

6. Judgments about people

This is the most sensitive section of the notice. Tobia does not merely collect facts: it collects what you think about the people with whom you are considering working, and keeps it linked to their names. Read it carefully.

• The attributed Cucitura. “What would I lose if you left” does not remain a private thought: it becomes a signed, stored document about an identified person. Only two people can see it: its author and its subject, never the rest of the table. Someone who leaves the Space does not lose the right to read what was written about them: it concerns them, regardless of when they left.
• The role you expect from someone you invite. When you create a Space, you state the role you expect from each invitee. This is a judgment made before that person exists as a Tobia user, and before they can see or challenge it. For that reason, if the person never accepts the invitation, the statement dies with the invitation. No named trace remains in the system: a judgment the person can never see must not outlive the invitation.
• The role each person declares for themselves. When you join, you state the role you believe you have. It becomes visible to the table and is compared with the role assigned to you. This is normal product behavior, but it needs to be clear here.
• Stated outcomes. When someone states how things went, the statement identifies them and becomes visible to the whole table at once when everyone has stated an outcome or at the set deadline. It remains part of the report.
• Progress status. Whether you opened the invitation link, started but did not finish your answers, or have not yet reacted: these are behavioral data about an identified person, and we show them to the other parties in the Space. We always present them as facts—“has not opened it yet”—never as judgments about your commitment or reliability.
• The group decision about someone absent. If an invitee does not respond, the table may decide whether to wait or consider them out. This is a named statement about the absent person, made by those present. We tell the absent person what was decided about them.

None of these judgments produces automatic consequences outside Tobia. They remain information for the table, as section 8 also explains.

7. Who handles data outside Tobia

Some providers process data on our behalf as processors. Here they are in full, without referring you to another page:

• Supabase: database, authentication, uploaded files. The project runs on servers in Frankfurt, European Union.
• Vercel: hosts the website and runs its functions, with execution distributed across infrastructure in the United States; it also measures basic website visit statistics.
• Resend: sends all emails Tobia sends you (invitations, references, notices, recovery emails). It is based in the United States.
• Anthropic: processes material you provide to identify the scope of your Space and the conversation in the live room. It is based in the United States. As the terms already state in section 10, Anthropic acts as our processor and does not use your content to train its models.
• Stripe: Stripe Payments Europe Ltd, Ireland, European Union, with transfers to Stripe Inc., United States. It manages payments: it receives your email, amount, transaction outcome, and details of your chosen payment method, which remain with Stripe and never with us. For payments, it acts as our processor and, for its own obligations (fraud prevention, banking requirements), as an independent controller. If you choose Klarna or PayPal at checkout, they also process your data as independent controllers under their own notices.
• Google Analytics: measures website visits, but only if you accept the statistics category in the banner. It is based in the United States.
• Google or Apple: only if you choose to sign in through one of these channels instead of the email link; in that case, they receive the sign-in request as identity providers.

Tobia manages cookie preferences directly. Your choice, with its date and version, stays in your browser for 183 days; it is not linked to your account or collected in a central log. You can change it in the footer preferences. Details are in the cookie notice.

With Supabase, Vercel, Resend, Anthropic, and Stripe, we have (or are formalizing) a data processing agreement and, where a provider is based outside the European Union, standard contractual clauses for the transfer. Copies of these agreements are stored internally.

8. Automated processing

To identify the scope of your Space and run the live room, Tobia sends material to an artificial intelligence provider (section 7). That provider:

• does not use your content to train its models: the terms already make this promise in section 10, and it applies here too;
• returns automated outputs: an identified scope or a reply in the room, which may be incomplete or wrong. They are starting points to read and discuss, not verdicts;
• does not make automated decisions with legal effects for you: it does not exclude you, classify you for third parties, or create contractual consequences on anyone’s behalf. Decisions always remain with the people at the table.

9. How long we keep data

Six decisions set the most sensitive retention periods. Other items follow the lifetime of the Space to which they belong.

• Report and stated outcomes. For as long as the Space exists, but in any case no longer than 24 months from the outcome statement, unless a party expressly asks us to keep them as evidence.
• A journey that never started: an invitation never accepted, a table never complete. 90 days, then deletion, with notice 7 days beforehand.
• Inactive account: no sign-in. 6 months, then notice and, if you do not return, the deletion described in section 10.
• Role assigned to someone who never joins. It dies with the invitation: no named trace remains (section 6).
• Profile photo. It remains public while uploaded. It has no separate expiry date; you can remove it whenever you wish or when you close your account.
• Probe and Cucitura answers. They remain for as long as the report they contributed to remains (see above). If someone leaves the table or asks to be forgotten, their content remains in the calculation because it was true that day, but is no longer linked to their name (section 10).
• Phone number, tax code and home address. For the lifetime of your account: they belong to your profile, not to a single Space, and you can correct them at any time from your profile page.
• The frozen copy inside a sealed document. The first time a step is downloaded, the identifying details of that moment are fixed and no longer follow your profile: if you later correct your surname, the already sealed document keeps showing the previous one. This is what makes two copies of the same document identical. That copy lives as long as the document, and section 10 explains what happens if you ask to be forgotten.
• The six-digit code. Ten minutes, or until the first download: whichever comes first. We never keep the digits, only their hash.
• Download log and confirmation hashes. As long as the document they refer to: they are the record of who took a copy, and without them we could not say who holds one.
• Uploaded materials, skills, references, live-room messages, cadences and deadlines. For the lifetime of the Space to which they belong.
• Waiting-list email. Until the launch announcement, or until your request for erasure if it comes first.
• Sent-email log and technical event log. For as long as needed for their purpose: avoiding duplicate emails, identifying and correcting security problems, and in any case no longer than the lifetime of the Space they concern. There is currently no fixed number of months.
• Proof of acceptance of legal documents. There is currently no fixed number of months: we keep it for as long as it may be needed to show what you accepted. This is among the first items for which we will set a precise period once our lawyer gives us a defensible one.
• Invoices and tax documents for payments. Ten years, as required by law. Orders and technical transaction identifiers follow the same period because they support those documents.
• The fact that you arrived through a link, and complimentary entries. For the lifetime of your account: they explain why a complimentary entry exists, and without that record we could not say why it was awarded. The link cookie, by contrast, lasts thirty days and is deleted on first sign-in.

10. Your rights and the truth about erasure

You have the right to access your data, have it rectified or erased, object to processing, and request restriction and portability (Articles 15–21 GDPR). Write to ciao@tobia.io: we respond within thirty days. You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome: www.garanteprivacy.it).

On erasure, we owe you the same honesty as in the terms, section 17: we cannot promise that absolutely all of your data will disappear, for one technical and one legal reason, both real.

• The technical reason: the report artifact never contains a person’s name. Names are resolved when the document is displayed, by reading them from the table of people at the table. Erasing a person therefore does not mean changing the report: it means detaching the label from their identity. From then on, the report says “a person who left the table” where it previously showed your name.
• The legal reason: that report is also data about the other people at the table and may be needed to establish or defend a legal claim (Article 17(3)(e) GDPR). We cannot undo what the other parties have already lawfully seen, or erase it from their memory or the copies they made. The terms already say this in section 7.

When you ask to be forgotten, this is what we actually do:

• we delete everything that can be deleted: first name, last name, photo, occupation, and access to the Space;
• content already included in a report delivered to the other parties remains without your name: your answers, the Cucitura concerning you, and the outcome you stated;
• we delete your phone number, tax code and home address from your profile: from then on no new document will carry them;
• they do remain inside documents already sealed, with your name, because those documents are also data about the other parties and their integrity is exactly what makes them useful: altering them afterwards would make every copy the other parties already downloaded false. This is the legal reason above (Article 17(3)(e) GDPR) applied to the most identifying data Tobia handles. If this is unacceptable to you, the moment to say so is before closing the “Venirsi incontro” step: up to that point no document carries your tax code;
• data that the law requires us to keep, such as invoices, remains;
• we cannot undo what the other party saw before your request.

To ask to be forgotten, write to ciao@tobia.io: we verify the request and proceed according to this section.

11. People without an account: invitees and references

Some people enter our data without ever opening an account: people you have invited who have not yet accepted, and people you identify as references for a skill. Their email address does not come from the person concerned: we ask you for it, and you give it to us.

When we receive someone’s address from a third party, the law (Article 14 GDPR) requires us to inform them at the first suitable contact. For Tobia, that contact is the invitation email or the reference request email: that is where the person must find a concise explanation of what happens to their data, not only on this page.

• if an invitee never accepts, their address and any role assigned to them follow the “journey that never started” rule (section 9): 90 days, then deletion; the assigned role dies with the invitation in any case (section 6);
• if they accept, they become a party to the Space and everything this page says about an account applies from then on;
• a reference receives a request with a personal link, responds if they wish, and their response is visible to the person who requested it and the person who identified them as a reference, never to the rest of the table;
• any of them may ask us to delete their address by writing to ciao@tobia.io, even if they never had an account.

12. Security

We protect your data by restricting access to the providers listed in section 7, using encrypted connections and access rules that limit each person to what they need (database row-level rules, checked after every significant change). No measure makes a system invulnerable: if a security incident exposes your data in a way that poses a risk to you, we will tell you what happened and what to do within the time limits set by law.

Details of what the website stores in your browser and how to manage your choice are in the cookie notice. The full contract governing your use of Tobia is in the terms and conditions.