Privacy Policy

I run Artemis under the brand Underlay. I am not a registered company. This page covers underlay.studio and the demo at demo.underlay.studio.

Who is responsible

Data controller: Riccardo Saro, via Pietro Andrea Saccardo 8, 20134 Milano, Italy. Email: privacy@underlay.studio. I am the only controller. There is no data protection officer.

What I collect

• Waitlist: the email you type on this site, and a confirmation I send you.
• Demo account: email, the name you give, the work role you pick.
• Demo chat: messages, uploads, assistant replies, memories if capture is on.
• Voice on the demo: live audio to OpenAI, transcript stored in the chat.
• Technical logs on the demo: login, IP, user-agent, about 90 days.
• This website: Vercel Analytics page views, no advertising SDK.

Why, and on what legal basis

Waitlist: to confirm you joined and to email you about Artemis access and early progress. That is pre-contract / your request (GDPR Art. 6(1)(b)). It is not a newsletter blasted to demo accounts. Reply to stop those emails, or write to privacy@underlay.studio.

Demo: to run the product (magic link, chat, voice, memory). Basis: the Terms (Art. 6(1)(b)).

I do not sell personal data. I do not train my own models on your chats.

Who else sees it

• OpenAI (United States): demo chat, files for a turn, live voice. DPA. Sharing inputs and outputs to train their models is disabled in my organization. That is not zero data retention.
• Vercel (United States): this website, Analytics, and related hosting.
• Railway (United States): demo API and database.
• Resend (United States): waitlist confirmation email.
• PostgreSQL: waitlist emails, hosted with my database provider.

Transfers outside the EU

Those processors are in the United States. Transfers rely on their Data Privacy Framework certification and/or Standard Contractual Clauses in their terms. Demo chat and voice leave the EU.

Voice

Only on the demo. The browser asks for the microphone. Live audio goes to OpenAI Realtime. I do not store the raw audio file. The transcript stays in the chat until you delete it or the account. No speaker identification, emotion recognition, or biometric categorisation.

Cookies

This website uses Vercel Analytics. The demo uses a technical CSRF cookie and keeps session tokens in localStorage. No advertising cookies. No cookie banner for that setup.

How long I keep it

• Waitlist email: until you ask to be removed, or I shut the list down.
• Demo chats, transcripts, memories, uploads: until you delete them or the account.
• Demo audit logs and behaviour traces: 90 days.
• Demo magic-link tokens: minutes.

The demo may be reset. If I reset a tenant, that data goes with it.

Your rights

Access, correction, deletion, restriction, portability, objection: privacy@underlay.studio. On the demo you can export memories today. Full account export and self-serve delete are not in the app yet. I will do those by hand if you write.

Complaint: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, garanteprivacy.it.

Age

Work tool. You must be at least 16.

AI

Artemis is an AI system. It can be wrong. I do not use it for automated decisions with legal or similarly significant effects on people (hiring, firing, credit).

Changes

If this page changes in a way that matters, I update the date above.