Legal
Privacy & Cookie Policy
1. Introduction and scope
This notice describes how the personal data of users who visit the bynor.ai website and the app.bynor.ai application (together, the "Site" and the "Services") and/or use the services offered is processed, in accordance with Regulation (EU) 2016/679 (the GDPR) and Italian Legislative Decree No. 196/2003 (the Italian Privacy Code) as amended by Legislative Decree No. 101/2018.
This notice is provided pursuant to Article 13 of the GDPR to everyone who interacts with the Site.
2. Data Controller
- Data Controller: Bynor SRL
- Registered office: Milano (MI) - Via Giuseppe Pogatschnig 40 - 20148
- VAT number: 14800270960
- Email: [email protected]
3. Categories of personal data processed
3.1 Data provided voluntarily by the user
When the user fills in the waitlist sign-up form or the contact form, the following data is collected: first name, last name, email address, any phone number, and the content of the message.
3.2 Data collected automatically
While browsing, the following data is collected automatically: IP address, user agent, date and time of access, pages visited, traffic source, and interactions (clicks, scrolling, time on page).
3.3 Data collected through cookies and tracking technologies
The Site uses cookies and similar technologies (pixels, tags, localStorage) for various purposes. For the full list, see Part II, Cookie Policy.
3.4 Data collected through advertising platforms
If the user arrives through advertising campaigns (e.g. Meta Ads), data may be collected relating to the interaction with the ad, campaign parameters (UTM) and conversions.
4. Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Waitlist and contact management, waitlist registration, sending confirmations, responding to requests | Art. 6(1)(b), pre-contractual measures |
| Technical operation, loading fonts and icons, storing preferences (theme) | Art. 6(1)(f), legitimate interest |
| Statistical analysis, understanding use of the Site through Google Analytics 4 | Art. 6(1)(a), consent |
| In-app product analytics, measuring feature usage in the application through PostHog (events, funnels, retention) | Art. 6(1)(a), consent |
| Lead and CRM management, collecting and managing sign-ups through HubSpot (waitlist and contact forms) | Art. 6(1)(b), pre-contractual measures |
| Marketing and remarketing, personalized ads, conversion measurement through Meta Pixel | Art. 6(1)(a), consent |
| Tag management, centralized script management through Google Tag Manager | Art. 6(1)(a), consent (for optional tags) |
| Payments, payment processing through Stripe | Art. 6(1)(b), performance of a contract |
| Direct marketing, newsletters and updates (with consent only) | Art. 6(1)(a), consent |
| Legal compliance, responses to authorities, protection of rights | Art. 6(1)(c), legal obligation |
Note: Analytics (GA4) and marketing (Meta Pixel) activities require the user's explicit consent, in accordance with the guidelines of the Italian Data Protection Authority (Garante Privacy) and the EDPB.
5. Provision of data
The data marked as mandatory in the forms is necessary to handle the request. Providing data for marketing purposes is optional. Refusing analytics or marketing cookies does not affect browsing.
6. Processing methods and security
Processing is carried out using electronic tools, with adequate security measures (HTTPS/TLS, restricted access, backups), in compliance with the principles of data minimization, storage limitation and integrity.
7. Data retention period
| Data | Period |
|---|---|
| Waitlist/contact form data | 24 months from collection |
| Data for direct marketing | Until consent is withdrawn, max 24 months |
| Google Analytics data | 14 months (GA4 setting) |
| PostHog data (in-app product events) | 12 months |
| HubSpot data (waitlist leads and contacts) | 24 months from the last interaction |
| Meta Pixel data | 180 days (raw data), up to 2 years (aggregated) |
| Technical and security logs | 12 months |
| User preferences (localStorage) | Persistent (on the user's device) |
| Data for legal compliance | As required by applicable law |
8. Recipients and data processors
| Provider | Service | Location |
|---|---|---|
| Google Ireland Limited | Google Fonts, Material Symbols, Google Tag Manager, Google Analytics 4, Google Apps Script | Ireland/USA |
| Meta Platforms Ireland Ltd | Meta Pixel (marketing and remarketing) | Ireland/USA |
| Stripe, Inc. | Payment processing | USA |
| Netlify, Inc. | Hosting and delivery of the Site | USA |
| Loops Email Inc. | Sending transactional and marketing emails (sequences, newsletters) | USA |
| HubSpot, Inc. | CRM, lead capture from forms (waitlist and contacts) | USA |
| PostHog, Inc. | In-app product analytics (product events, funnels, retention) | USA |
Meta Pixel joint controllership: For processing through Meta Pixel, the Data Controller and Meta act as joint controllers pursuant to Article 26 of the GDPR. Agreement: facebook.com/legal/controller_addendum
9. Transfer of data to third countries
Some providers are based, or have sub-processors, in the USA. Transfers take place on the basis of the EU-U.S. Data Privacy Framework (the European Commission's adequacy decision of July 10, 2023). The user may request a copy of the safeguards by writing to [email protected].
10. Data subject rights
Pursuant to Articles 15 to 22 of the GDPR, the user has the right to: access, rectification, erasure (the "right to be forgotten"), restriction, portability, objection, and withdrawal of consent (without affecting the lawfulness of processing carried out beforehand).
To exercise these rights: write to [email protected] with the subject line "Privacy rights request". A response will be provided within 30 days.
Complaint to the Italian Data Protection Authority (Garante): gpdp.it · [email protected]
11. Profiling
The Site uses profiling technologies through Google Analytics 4 (user segmentation) and Meta Pixel (custom audiences). Legal basis: consent. The user may object by refusing marketing cookies through the banner or by changing the settings on Meta and Google.
The Data Controller does not carry out automated decision-making that produces legal effects on the user within the meaning of Article 22 of the GDPR.
12. Minors
The Site and the services are not intended for children under 16. The Data Controller does not knowingly collect the personal data of minors. If this happens, contact [email protected] to have it deleted.
Part II, Cookie Policy
13. What cookies are
Cookies are small text files saved on the user's device while browsing. They may be session or persistent, first-party or third-party. In addition to cookies, the Site uses tracking pixels (Meta Pixel), localStorage and tags/scripts (Google Tag Manager).
14. Types of cookies and technologies used
14.1 Necessary (no consent required)
| Name | Type | Purpose | Duration |
|---|---|---|---|
cookie-consent | localStorage | Stores cookie choices | Persistent |
bynor_utm_*, bynor_first_url | First-party cookies (.bynor.ai) | Remember where the visit came from (utm parameters and first landing URL) to correctly attribute requests submitted by the user. No profiling, no sharing with third parties. | 90 days |
theme | localStorage | Light/dark theme preference | Persistent |
14.2 Third-party technical services (no cookies, but data transfer)
| Service | Provider | Data transferred |
|---|---|---|
| Google Fonts (Montserrat) | Google Ireland Ltd | IP, User Agent |
| Google Material Symbols | Google Ireland Ltd | IP, User Agent |
| Google Apps Script (forms) | Google Ireland Ltd | IP, form data |
| HubSpot Forms API (lead capture) | HubSpot Inc. | IP, form data (name, email, phone) |
| Loops Form API (mailing list sign-up) | Loops Email Inc. | IP, email, contact data |
| Tailwind CSS CDN | Tailwind Labs | IP, User Agent |
14.3 Analytics (consent required)
| Service | Cookie | Duration | Data collected |
|---|---|---|---|
| Google Tag Manager | No cookies of its own | – | Technical data |
| Google Analytics 4 | _ga, _ga_<ID> | 2 years | User ID, pages, time, traffic source, IP (anonymized) |
| PostHog (in-app) | ph_*_posthog, ph_*_window_id | 1 year | Anonymous distinct_id, product events, pages, device, session (active only within app.bynor.ai) |
GA4 is configured with: IP anonymization enabled, 14-month data retention. Opt-out: tools.google.com/dlpage/gaoptout
PostHog is active only within the app.bynor.ai application to measure feature usage. Opt-out: available from the profile settings inside the app, or by writing to [email protected].
14.4 Marketing/Profiling (consent required)
| Service | Cookie | Duration | Data collected |
|---|---|---|---|
| Meta Pixel | _fbp, _fbc, pixel | 3 months / 2 years | IP, pages, conversions, device data, Facebook ID (if logged in) |
Meta opt-out: Ad settings · Off-Facebook activity
15. Cookie banner and consent management
On the first visit, a banner is shown that lets the user: accept all cookies, reject all but the necessary ones, or customize choices by category (Necessary, Analytics, Marketing).
The user can change these choices at any time by clicking the cookie icon in the bottom left or "Manage cookies" in the footer.
16. Managing cookies from the browser
The user can manage cookies from the browser settings:
17. Third-party services' privacy policy links
| Service | Privacy Policy |
|---|---|
| Google (Fonts, GTM, GA4) | policies.google.com/privacy |
| Meta (Pixel) | facebook.com/privacy/policy |
| Stripe | stripe.com/privacy |
| Netlify | netlify.com/privacy |
| Loops | loops.so/privacy |
| HubSpot | legal.hubspot.com/privacy-policy |
| PostHog | posthog.com/privacy |
Part III, Final provisions
18. Governing law
This notice is governed by Italian law and by Regulation (EU) 2016/679. For disputes: the Court of Barcellona Pozzo di Gotto (ME), except where a different, mandatory jurisdiction applies for the protection of consumers.
19. Changes
The Data Controller reserves the right to amend this notice. In the event of material changes, a notice will be published on the Site.
20. Contact details
Email: [email protected] · Data Controller: Bynor SRL · Address: Milano (MI) - Via Giuseppe Pogatschnig 40 - 20148
21. Change log
| Date | Version | Changes |
|---|---|---|
| Jul 17, 2026 | 2.2 | Data controller details updated: Bynor SRL, registered office Via Giuseppe Pogatschnig 40, 20148 Milano (MI), Italy, VAT no. 14800270960. |
| May 27, 2026 | 2.1 | Email provider replaced (Brevo → Loops). Added HubSpot (CRM/lead capture forms) and PostHog (in-app product analytics). Scope extended to app.bynor.ai. |
| Mar 18, 2026 | 2.0 | Added section on GTM, GA4, Meta Pixel, Stripe. Updated profiling, joint controllership, granular cookie banner. |
| Jan 19, 2026 | 1.0 | First publication |