Privacy Policy

Last updated: August 21, 2026

This Privacy Policy describes how from9to10 S.r.l. processes personal data in connection with the from9to10.com website, the from9to10 SaaS platform, and related services.

This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and applicable Italian data protection law.

1. Data Controller

from9to10 S.r.l.
Via Moretto da Brescia 22, 20133 Milan (MI), Italy
VAT and Tax ID No. 14551150965
Email: [email protected]

2. Scope of this Notice and Privacy Roles

from9to10 may process personal data under different roles depending on the specific activity.

2.1. from9to10 as Data Controller

from9to10 acts as Data Controller when it independently determines the purposes and means of processing. This applies, in particular, to:

management of the from9to10.com website;
contact requests, information requests, quotes, and demo requests;
creation and management of platform accounts;
management of relationships with customers, prospects, partners, and suppliers;
administrative, accounting, and contractual management;
user assistance and support;
system security and prevention of improper use;
analysis of website and platform usage;
sending informational or marketing communications, where applicable and on the relevant legal basis.

2.2. from9to10 as Data Processor

When a customer uses the from9to10 platform or related services to process personal data of its own users, customers, prospects, employees, collaborators, or other individuals, the customer determines the purposes of processing and acts as Data Controller, while from9to10 processes such data on behalf of the customer as Data Processor pursuant to Article 28 GDPR.

This may include, by way of example, personal data contained in materials provided by the customer, in uploaded documents, in analyzed websites, in editorial content, in linked social media accounts, in integrated CMS or CRM systems, as well as data collected through lead generation features.

Such processing is governed by the Data Processing Agreement (the “DPA”) entered into between from9to10 and the customer.

3. Categories of Personal Data Processed

Depending on the features used, from9to10 may process the following categories of data.

3.1. Identification and Contact Data

first and last name;
email address;
phone number, where provided;
company, organization, and professional role;
information contained in communications sent to from9to10.

3.2. Account and Platform Data

identifiers of the user and their organization;
credentials and information necessary for authentication;
roles and permissions;
project configurations, preferences, and settings;
information relating to the use of platform features;
technical and security logs.

3.3. Technical and Browsing Data

IP address;
device type, browser, and operating system;
date and time of access;
pages visited and features used;
application events;
information relating to sessions and interactions with the website or platform;
cookies and other online identifiers, as set out in the Cookie Policy.

3.4. Materials and Content Provided by the Customer

The platform allows users to enter, import, link, index, and analyze information necessary for content production and management, including:

documents, texts, presentations and other materials;
editorial and multimedia content;
information relating to brands, products, services, markets, competitors and buyer personas;
content originating from the client’s website or other sources indicated by the client;
data originating from CMS, CRM and connected services;
content intended for publication on websites and social networks;
any personal data present in the materials or sources analyzed.

The client is responsible for the lawfulness of the data and materials made available to from9to10 and must ensure it has the legal bases necessary for their processing.

3.5. Data from publicly accessible sources

As part of the analysis, research and knowledge base construction functionalities, the platform may analyze publicly accessible online information, including web pages indicated by the client or relevant to the configured project.

Such information may incidentally include personal data already publicly available. from9to10 processes it exclusively to the extent necessary for the provision of the service and according to the applicable privacy role.

4. Purposes, legal bases and retention

Purpose	Legal basis	Retention
Responding to requests for contact, information, quotes and demos	Pre-contractual measures requested by the data subject, Art. 6(1)(b) GDPR	For the time necessary to handle the request and any subsequent relationship
Account creation and provision of the platform and services	Performance of the contract, Art. 6(1)(b) GDPR	For the duration of the contractual relationship and thereafter within the limits necessary for compliance with legal obligations and the protection of rights
Management of clients’ contacts, employees and collaborators	Legitimate interest in the proper management of the contractual relationship, Art. 6(1)(f) GDPR	As a rule, up to 10 years from the termination of the contractual relationship, where necessary for administrative or protective purposes
Administrative, accounting, tax and legal obligations	Legal obligation, Art. 6(1)(c) GDPR	For the periods established by applicable law, as a rule up to 10 years
Platform security, abuse prevention and incident management	Legitimate interest of the Data Controller, Art. 6(1)(f) GDPR	For a period proportionate to security purposes and in any case not exceeding what is necessary
Technical and functional analysis and improvement of the service	Legitimate interest and, where required for the use of cookies or tracking tools, consent	According to the type of data, the tool configuration and the preferences expressed by the user
Newsletter and commercial communications	Consent, where required, or another legal basis provided for by applicable law	Until consent is withdrawn or the right to object is exercised
Establishment, exercise or defense of a legal claim	Legitimate interest of the Data Controller, Art. 6(1)(f) GDPR	For the period necessary to manage the dispute or litigation

5. Commercial communications and newsletters

from9to10 may send newsletters, product updates and commercial communications when it has a suitable legal basis.

Where required by law, such communications are sent exclusively with the prior consent of the data subject.

Creating an account on the platform or submitting a contact request does not automatically result in subscription to promotional communications.

In the cases permitted by Art. 130(4) of Legislative Decree 196/2003, from9to10 may use the email address obtained in connection with a relationship with a client for communications relating to its own similar services, always ensuring the possibility to opt out free of charge and at any time.

6. Use of Artificial Intelligence systems

The from9to10 platform uses Artificial Intelligence systems and language models to support activities such as source analysis, research, editorial planning, generation, transformation, optimization and verification of content.

The platform’s architecture may use various Artificial Intelligence components and models depending on the activity requested.

Data and materials provided by the client may therefore be transmitted to the technological services used by the platform to the extent necessary to perform the specific feature.

When such materials contain personal data processed on behalf of the client, from9to10 acts on the client’s instructions and in compliance with the applicable DPA. Any providers involved in the processing are managed in accordance with Art. 28 GDPR and the provisions applicable to international transfers.

The platform is not designed for the systematic processing of special categories of personal data under Art. 9 GDPR. The client is therefore advised not to enter health, biometric, racial or ethnic origin, political opinion, religious or philosophical belief, sex life or sexual orientation data, unless such processing has been expressly agreed and is legally permitted.

from9to10’s features are intended to support editorial and marketing activities. They are not used to make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals under Art. 22 GDPR.

7. Knowledge base, RAG, and source analysis

from9to10 may build an information base related to the client’s projects using content provided by the client, documents, websites, editorial materials, and other sources indicated or authorized.

Information may be indexed and used through Retrieval-Augmented Generation (“RAG”) techniques and similar information search and retrieval systems.

These features allow the platform’s agents to use the client’s information assets as context for content production and review.

If the sources contain personal data, such data is processed solely for purposes related to the provision of the service and in accordance with the privacy role applicable to from9to10.

8. Integrations with CMS, CRM, and other services

The platform may be connected, at the client’s request, to CMS, CRM, third-party platforms and services, including, by way of example, WordPress, WooCommerce, HubSpot, Shopify, Liferay, and Magnolia.

Depending on the integration activated, from9to10 may process:

identifiers of the connected account;
authentication tokens and API authorizations;
pages, articles, images, and other content;
metadata relating to content and its publication;
technical data necessary for synchronization between systems;
any personal data present in the connected systems, to the extent necessary for the requested feature.

The connection is made at the client’s initiative and the authorizations are used solely to provide the requested features.

The connected external services also operate in accordance with their respective terms of service and privacy notices.

9. Social media management and publishing – Mixpost

from9to10 uses Mixpost as a software component for managing, scheduling, and publishing content on social networks connected to the platform.

Mixpost is used in self-hosted mode, within the infrastructure managed by from9to10. The software orchestrates the connection of social accounts and publishing activities without the mere use of the software automatically resulting in the content being disclosed to Mixpost’s developer.

When a client connects a social account, the following may be processed:

identifiers of the connected account, profile, or page;
name and public information of the account;
access tokens and OAuth or equivalent authorizations;
technical identifiers provided by the social network;
text, images, and other content intended for publication;
dates, times, and status of publications;
information and metrics made available by the social network’s APIs;
any comments, interactions, or other data made available by the APIs, when the relevant feature is activated.

The social network credentials are not requested directly by from9to10 when the connection takes place via OAuth: the user authorizes the connection through the procedures made available by the social network, and from9to10 receives the necessary tokens and technical authorizations.

The data is used exclusively to carry out the activities requested by the client, such as management, scheduling, publication and monitoring of content.

When the client connects a LinkedIn account or page, the data necessary to perform the requested operations is shared with LinkedIn. For users located in the European Union and the European Economic Area, the LinkedIn service is managed by LinkedIn Ireland Unlimited Company, which processes data in accordance with its own privacy policy.

Facebook and Instagram

When the client connects a Facebook or Instagram account, the data necessary to perform the requested operations is shared with Meta services. For users in the European Region, the relevant services are managed by Meta Platforms Ireland Limited, in accordance with Meta’s terms and privacy policy.

Any additional social networks that can be connected to the platform are subject to the terms and privacy policies of their respective providers.

10. Lead generation and CRM integration

If the client activates the relevant features, from9to10 may provide tools for collecting contacts through content published on the client’s website, such as forms, popups, paywalls or similar tools.

In such cases, the client acts as Data Controller for the data collected through its own website and determines the purpose, legal basis and content of the notice provided to users.

from9to10 processes such data on behalf of the client in its capacity as Data Processor and may transmit it to the CRM or other systems specified by the client.

Where provided for by the service, data submitted by users may be supplemented with professional information or information relating to their employer, obtained from legitimately usable sources, as agreed with the client.

11. Platform hosting – Hetzner

The main application components of the platform and the data uploaded or generated therein are hosted on infrastructure made available by Hetzner Online GmbH.

The infrastructure used by from9to10 is located within the European Union, at Hetzner data centers located in Falkenstein and/or Nuremberg, Germany, depending on the specific infrastructure used.

The application software is installed and managed by from9to10. Application access and encryption keys are managed under the control of from9to10. Any platform backups are stored on Hetzner infrastructure located within the European Union.

For more information: Hetzner Privacy Policy.

12. Google Cloud

from9to10 uses Google Cloud services as part of the platform’s technological infrastructure and features.

For contractual relationships regarding Google Cloud services for Italian clients, the relevant contracting company may be Google Cloud Italy S.r.l., in accordance with the contractual terms applicable to the relevant account.

Depending on the specific feature used, technical data, content and information necessary for the processing required by the platform may be processed.

Google Cloud is among the providers used by from9to10 for the processing of data within the platform’s services, in accordance with the applicable contractual and data protection agreements.

For more information: Google Cloud Privacy.

13. Google Workspace

from9to10 uses Google Workspace for business activities such as email, document management, storage and collaboration.

As part of these services, data relating to clients, prospects, partners and suppliers, contained in communications or documents necessary for managing the relationship with from9to10, may be processed.

The processing is subject to the data processing agreements and terms applicable to Google Workspace services.

For more information: Google Workspace Privacy.

14. PostHog – platform usage analysis

from9to10 uses PostHog to analyze the operation and usage of the platform, identify technical issues, and understand how the various features are used.

The data processed may include:

technical identifiers;
events generated during use of the platform;
pages and features used;
browser and device information;
technical information necessary for error diagnosis and service improvement.

from9to10 configures the service according to data minimization criteria, limiting the data processed to what is necessary for technical and product analysis purposes.

For more information: PostHog Privacy Policy.

15. Brevo – contact and communication management

from9to10 uses Brevo, a service previously known as Sendinblue, for managing contacts, communications, automations, and, where applicable, for sending newsletters and marketing communications.

As part of the use of Brevo, the following may be processed:

first and last name;
email address;
phone number, where provided;
company and professional role;
information relating to the relationship with from9to10;
communication preferences;
information relating to the sending, delivery, and interaction with communications sent;
technical information necessary for managing the service.

Brevo is used both for operational communications with customers, prospects, and users, and, where a suitable legal basis exists, for newsletters and marketing communications.

Promotional communications are sent in compliance with applicable regulations and, where necessary, subject to the data subject’s consent. The data subject may withdraw consent or object to receiving marketing communications at any time by using the unsubscribe link included in the communications or by contacting from9to10.

According to information made available by Brevo, the databases relating to the services are hosted on infrastructure located within the European Union. Brevo processes data in accordance with the applicable contractual and data protection agreements.

For more information: Brevo Privacy Policy.

16. Microsoft Clarity

from9to10 may use Microsoft Clarity, a service provided by Microsoft, to understand how users interact with the site and/or the platform’s interfaces and to improve the user experience.

Clarity may collect information relating to how pages are viewed and to user interactions, such as clicks, movements, scrolling, and navigation sequences, and may enable the generation of heatmaps and session recordings.

from9to10 configures the service to limit the collection of information that is not necessary and to avoid, as far as possible, recording content that is confidential or entered into sensitive fields.

For users located in the European Economic Area, Microsoft Clarity is activated, in modes requiring cookies or similar tracking tools, only after consent has been obtained.

Processing carried out by Microsoft is also governed by the privacy policy and terms applicable to Microsoft services.

For more information: Microsoft Privacy Statement.

17. Matomo Analytics

from9to10 uses Matomo to collect statistical information about website usage and analyze its performance.

Matomo may process information such as:

pages visited;
date and time of the visit;
origin of the visit;
technical information about the browser and device;
identifiers necessary to distinguish visits and sessions.

When configured with cookies, Matomo may use identifiers such as _pk_id, _pk_ses and _pk_ref.

Statistical cookies are activated in accordance with the preferences expressed by the user through the consent management system, except in cases where the specific configuration may legitimately benefit from the exemptions provided for by applicable law.

18. Google Tag Manager

The site uses Google Tag Manager, a service provided by Google, for the centralized management of tags and scripts present on the site.

Google Tag Manager allows other services to be activated and managed, including statistical and analytics tools.

The use of Google Tag Manager does not change the legal basis required for the individual tools activated through it. Tags that require the user’s consent must therefore remain disabled until such consent is given.

19. Google Analytics

The site uses Google Analytics, a service provided by Google, to collect statistical information about browsing and use of the site.

Google Analytics may process usage data, online identifiers, information about the browser and device, and approximate information about the geographic origin of the visit.

Google Analytics is activated in compliance with the preferences expressed by the user and, where required by applicable law, only upon consent.

For more information: Google Privacy Policy.

20. Google Fonts and Font Awesome

The site may use external services to display fonts and icons, including Google Fonts and Font Awesome.

When these resources are loaded directly from the servers of the respective providers, the technical request may involve the transmission of the IP address and other technical information necessary for the delivery of the resource.

When these resources are instead hosted locally on from9to10’s infrastructure, no communication is made to the relevant provider for the sole purpose of displaying the font or icon.

21. Cookies and other tracking tools

The website uses cookies and similar technologies to enable the correct functioning of its pages, store preferences and consents, carry out statistical analyses and, where applicable, use additional measurement tools.

Strictly necessary cookies and tools essential to the provision of the service may be used without consent within the limits permitted by applicable law.

Statistical or tracking tools that do not meet the requirements to be treated as technical tools are instead activated only after obtaining the user’s consent.

Users can accept, reject or modify their preferences through the consent management system available on the website.

The updated list of cookies, their purposes, providers and retention periods is available in the Cookie Policy (EU).

22. Data processors, sub-processors and other recipients of data

Personal data may be processed by from9to10’s staff and collaborators, expressly authorized and instructed in relation to the activities performed.

from9to10 also relies on technical and professional providers who may process personal data as Data Processors or sub-processors, where applicable.

The main providers used in the provision of the service include:

Hetzner Online GmbH, for infrastructure and hosting;
Google and Google group companies involved in providing the related services, for cloud and technology services;
PostHog, for technical and product analytics;
Brevo, for managing contacts, communications, automations and newsletters.

In connection with specific activities, data may also be received, according to their respective roles, by:

Google, for Google Analytics, Google Tag Manager, Google Workspace and other Google services used;
Microsoft, for Microsoft Clarity;
LinkedIn Ireland Unlimited Company, when LinkedIn is linked or used;
Meta Platforms Ireland Limited, when Facebook or Instagram is linked or used;
any additional CMS, CRM, social networks or external services that the customer chooses to connect to the platform.

Mixpost, when used in the self-hosted configuration adopted by from9to10, constitutes a software component of the infrastructure and does not, solely by virtue of its use, qualify as a recipient of the data processed through that installation.

The updated list of Data Processors and sub-processors may be requested by writing to [email protected].

23. Transfers of Data Outside the European Economic Area

from9to10 favors, where possible, infrastructure and data localization within the European Union.

Some technology providers used by from9to10, however, belong to international groups or may carry out processing in countries located outside the European Economic Area.

When a processing activity involves an international transfer of personal data, from9to10 verifies the applicability of one of the safeguards provided for under Articles 44 et seq. of the GDPR, including:

an adequacy decision of the European Commission;
the EU-U.S. Data Privacy Framework, where applicable to the recipient;
the Standard Contractual Clauses approved by the European Commission;
other safeguards provided for by applicable law.

24. Data Retention

Personal data is retained for the period necessary to achieve the purposes for which it was collected and, subsequently, for the period required by applicable law or necessary to protect from9to10’s rights.

In particular:

account data is retained for the duration of use of the service and for the additional period necessary to manage contractual and legal obligations;
data relating to contractual and administrative relationships may be retained for 10 years from the termination of the relationship, subject to any further periods necessary in the event of litigation;
data used for commercial communications is retained until consent is withdrawn or the right to object is exercised, without prejudice to any further applicable obligations;
technical and security logs are retained for periods proportionate to security and abuse prevention purposes;
data processed on behalf of clients is retained in accordance with the relevant contract and DPA;
the retention periods for cookies and online identifiers are indicated in the Cookie Policy and depend on the specific configuration of the tool.

Upon termination of the services, data processed by from9to10 on behalf of the client is returned or deleted in accordance with the DPA, unless retention is required by European Union law or national law.

25. Data Security

from9to10 adopts technical and organizational measures appropriate to the risk in order to protect personal data from unauthorized access, loss, alteration, disclosure, or destruction.

The measures adopted include, where applicable:

encryption of communications via HTTPS/TLS protocols;
access control to systems;
individual accounts for authorized personnel;
management and protection of credentials;
restriction of access according to roles and operational needs;
security updates to systems;
backup and recovery procedures;
logging and monitoring of administrative access, where applicable;
security testing and vulnerability management activities;
training and instructions for authorized personnel.

26. Third-Party Personal Data

If a user or customer provides from9to10 with personal data relating to other individuals, the party providing such data is responsible for ensuring that the processing and disclosure to from9to10 are permitted under applicable law.

In particular, the customer must verify the existence of a suitable legal basis and fulfill the information obligations set out under the GDPR.

27. Nature of the Data Provision

Providing the data necessary to handle a request, create the account, or perform the contract is required in order to provide the relevant service.

Failure to provide the necessary data may make it impossible to respond to the request or provide the service.

Providing data for marketing purposes is instead optional, and withholding consent does not affect the ability to use from9to10’s other services.

28. Rights of the data subject

In the cases provided for by the GDPR, the data subject may exercise the rights set out in Articles 15-22 of the Regulation and, in particular:

obtain confirmation as to whether or not personal data concerning them exists;
obtain access to the personal data and to information relating to their processing;
obtain the rectification of inaccurate data and the completion of incomplete data;
obtain the erasure of data in the cases provided for by Art. 17 GDPR;
obtain the restriction of processing in the cases provided for by Art. 18 GDPR;
object to processing in the cases provided for by Art. 21 GDPR;
receive the data in a structured, commonly used and machine-readable format in the cases provided for by Art. 20 GDPR;
withdraw, at any time, any consent previously given, without prejudice to the lawfulness of processing carried out before the withdrawal;
lodge a complaint with the competent supervisory authority.

When from9to10 processes data exclusively on behalf of one of its clients acting as Data Processor, the data subject must normally exercise their rights against the client acting as Data Controller. from9to10 will cooperate with the client to enable the request to be handled within the terms set out by the GDPR.

29. How to exercise your rights

Requests relating to the processing of personal data and to the exercise of rights may be sent to:

[email protected]

from9to10 will handle requests without undue delay and, in any case, within the terms set out by applicable law.

30. Complaint to the Data Protection Authority

A data subject who believes that the processing of their personal data is being carried out in violation of applicable law has the right to lodge a complaint with the Data Protection Authority, without prejudice to any other administrative or judicial remedy provided for by law.

Data Protection Authority
www.garanteprivacy.it

31. Minors

The from9to10 website and platform are primarily intended for businesses, professionals and organizations, and are not specifically directed at minors.

from9to10 does not intend to knowingly collect personal data of minors through the platform, except where such data is processed on behalf of a client and in accordance with the client’s instructions and responsibilities.

32. Changes to the Privacy Policy

from9to10 may update this Privacy Policy to reflect changes to the platform, the services used, the processing methods, or applicable law.

Any changes will be published on this page, indicating the date of the last update.