Last updated: 11 October 2026.
This notice explains how we process personal data when you visit archademetrics.com and when you use the Archade Metrics service (https://app.archademetrics.com), under Regulation (EU) 2016/679 (GDPR).
Data controller
The controller is Archade Design Solutions di Carlo Maria Crespi Perellino, Via Santo Stefano 23, 40125 Bologna (BO), Italy, VAT no. 04249951205, REA BO 580050, email studio@archadedesign.com, certified email (PEC) archadedesignsolutions@pec.it, telephone +39 351 499 9599. We have not appointed a data protection officer (DPO): for any request, write to the email or certified email address above.
The website
The website does not use profiling cookies, analytics or advertising tools: it only uses the technical cookies described in the Cookie policy. The body text uses a font hosted on our server; the headings use a font served by Adobe Fonts (Adobe), which receives your IP address and technical browser data in order to deliver it, without using cookies (Adobe Fonts privacy notice). For security and operation, the server technically logs IP address, browser and requested pages; these logs are kept for a limited period and are not used to profile you.
If you email us, we use your address and what you tell us only to reply to you. Legal basis: pre-contractual measures requested by you or our legitimate interest in replying. We keep the correspondence for as long as needed to handle the request and any relationship that arises from it.
The Archade Metrics account
When you create an account we process your name, work email, password (stored only as an encrypted hash, nobody can read it), company details (company name, VAT number, tax code, registered office, certified email, recipient code), the consents you give (document, version, date, time, IP address and browser), login dates, connected devices (browser, IP address, last activity) and the details of the people you invite to your profile (email, name, role). If you turn on two-step verification we store the key in encrypted form and the recovery codes only as a hash. Legal basis: performance of the contract; for the consent log, also our legitimate interest in being able to prove acceptance of the terms.
For security we also log failed login attempts (to block anyone trying to guess passwords) and, if you ask to recover your password, a single-use link valid for one hour. Legal basis: legitimate interest in the security of the service.
Data from the platforms you connect
Connection happens through each platform's official login and only asks for read permissions. We read, only for the accounts you connect:
- Google: Google Analytics 4 (visits, users, sessions, conversions), Search Console (clicks, impressions, average position), YouTube (channel statistics), Google Business Profile (views, actions, reviews and average rating).
- Meta: Facebook Pages and Instagram professional accounts (followers, reach, views, interactions, list of posts with their statistics), ad accounts (spend, impressions, clicks, results).
- Pinterest, LinkedIn and Mailchimp, when available: aggregated statistics for profiles, pages, pins and campaigns.
These are mostly aggregated numbers, not data about individual people. We use them only to show you the dashboard, calculate comparisons and trends, generate the Adviser's suggestions and, if you turn it on, send you summaries. We do not sell them, we do not use them for advertising and we do not pass them on to third parties. We do not publish or change anything on your accounts.
Data received from Google APIs. The use and transfer to any other application of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Archade Metrics' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. No person reads this data, except with your explicit consent, for security, to comply with the law, or in aggregated and anonymous form for the operation of the service. Data received from Google APIs is not used to train artificial intelligence models.
YouTube API Services. If you connect a YouTube channel, Archade Metrics uses the YouTube API Services: by connecting you agree to the YouTube Terms of Service and the data is also covered by the Google Privacy Policy. You can revoke access at any time from the app or from the Google permissions page. After revoking from the app we delete the data received from YouTube within 7 days; if you revoke from the Google page, within 30 days. Data received from YouTube is refreshed or deleted at least every 30 days, as long as the authorisation remains valid. For questions write to studio@archadedesign.com.
Platform rules. We process data received from Meta, LinkedIn and Pinterest only on behalf of the customer who connected the account, keeping it separate for each organisation, and we keep it only for as long as each platform's rules allow. We do not sell, pass on or use this data for advertising or to profile people.
The Adviser
The Adviser reads the numbers in your profile and suggests advice using automatic rules, on our server. Answers to open-ended questions are generated by an artificial intelligence system, and this is shown in the app. For these answers, the question you write and a summary of the profile's numbers (not access keys, not data about individual people) are sent to Anthropic, which provides the Claude model and acts as our data processor; Anthropic does not use this data to train its models. Questions and answers stay in your profile so you can look back at the latest ones. Do not write unnecessary personal data in your questions.
Subscription and payments
If you start a subscription, payment takes place on Stripe (Stripe Payments Europe Ltd., Ireland), which processes card data as an independent controller: we do not see or store the card number. We receive from Stripe your name, email, billing address, any VAT number, and the status of the subscription and payments. Legal basis: performance of the contract and tax obligations. Billing data is kept for 10 years as required by law (art. 2220 of the Italian Civil Code). Stripe privacy notice.
Who processes data on our behalf
| Provider | What for | Where |
|---|---|---|
| Hostinger International Ltd. | App and website servers, backups | European Union (app server in Frankfurt, Germany) |
| Stripe Payments Europe Ltd. | Subscription payments and receipts | Ireland, with transfers to the United States covered by the Data Privacy Framework and standard contractual clauses |
| Adobe (Adobe Fonts) | Heading font | European Union and United States (Data Privacy Framework) |
| Anthropic PBC | Open-ended questions to the Adviser, when active | United States (standard contractual clauses) |
| Email provider | Service emails (password recovery, receipts) | European Union |
The platforms you connect (Google, Meta, Pinterest, LinkedIn, Mailchimp) process data according to their own privacy notices. A profile's data can only be seen by the people you invite and, for support or security, by Archade Design Solutions.
How long
We keep the data as long as your account is active. If you disconnect an account we immediately delete its access keys; the history of numbers stays until you delete it, except for data received from YouTube, which follows the rules above. If you close your account or ask us to, we delete the data within 30 days, except for what the law requires us to keep (billing data, 10 years) and the consent log, kept as proof of acceptance for the limitation period of rights (10 years). Backups are overwritten within 30 days. If an account has no logins for 12 months we delete it, after notifying you by email.
Your rights
You can request access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest, by writing to studio@archadedesign.com. We reply within one month. You can exercise many rights yourself in the app, from My account: you edit your details, download a copy in JSON format, manage your consent to communications and delete your account. You can also revoke access at any time from the settings of the connected platform. You have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it).
Should a personal data breach occur, we handle it in accordance with articles 33 and 34 of the GDPR: we notify the Garante within 72 hours where required and inform the people concerned when the breach poses a high risk to them.
The instructions for deleting your data are also on the page Data deletion. If you use the service for your customers' data, the following also applies: theData Processing Agreement.
Who can use the service
The service is reserved for businesses and professionals with a VAT number and is not intended for people under 18.
Changes
If we change this notice we update the date at the top and, for significant changes, we notify account holders by email before they take effect.