Legal
Privacy & Cookie Policy
1. Introduction and scope
This notice describes how the personal data of users who visit the bynor.ai website and the app.bynor.ai application (together, the "Site" and the "Services") and/or use the services offered is processed, in accordance with Regulation (EU) 2016/679 (the GDPR) and Italian Legislative Decree No. 196/2003 (the Italian Privacy Code) as amended by Legislative Decree No. 101/2018.
This notice is provided pursuant to Article 13 of the GDPR to everyone who interacts with the Site.
This notice describes in detail the processing carried out on the bynor.ai website. For the app.bynor.ai application, the app's own Privacy Policy and Cookie Policy also apply: they describe the data processed in the app, including the measurement of advertising campaigns on Meta, TikTok and Google. The website and the app each collect cookie consent with their own banner.
2. Data Controller
- Data Controller: Bynor SRL
- Registered office: Milano (MI) - Via Giuseppe Pogatschnig 40 - 20148
- VAT number: 14800270960
- Email: [email protected]
3. Categories of personal data processed
3.1 Data provided voluntarily by the user
When the user fills in the waitlist sign-up form or the contact form, the following data is collected: first name, last name, email address, any phone number, and the content of the message.
3.2 Data collected automatically
While browsing, the following data is collected automatically: IP address, user agent, date and time of access, pages visited, traffic source, and interactions (clicks, scrolling, time on page).
3.3 Data collected through cookies and tracking technologies
The Site uses cookies and similar technologies (pixels, tags, localStorage) for various purposes. For the full list, see Part II, Cookie Policy.
3.4 Data collected through advertising platforms
If the user arrives from an ad (Meta, TikTok, Google), the page address may contain the campaign parameters (UTM), the identifiers of the ad, ad set and campaign, and a click identifier of the platform (fbclid from Meta, ttclid from TikTok, gclid, gbraid and wbraid from Google). How we use them is described in sections 4 and 14.
4. Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Waitlist and contact management, waitlist registration, sending confirmations, responding to requests | Art. 6(1)(b), pre-contractual measures |
| Technical operation, loading fonts and icons, storing preferences (theme) | Art. 6(1)(f), legitimate interest |
| Statistical analysis, understanding use of the Site through Google Analytics 4, Microsoft Clarity and PostHog (heatmaps and session recordings) | Art. 6(1)(a), consent |
| In-app product analytics, measuring feature usage in the application through PostHog (events, funnels, retention) | Art. 6(1)(a), consent |
| Lead and CRM management, collecting and managing sign-ups through HubSpot (waitlist and contact forms) | Art. 6(1)(b), pre-contractual measures |
| Origin of visits and requests, knowing which channels and campaigns bring in contacts: campaign parameters (UTM), identifiers of the ad, ad set and campaign, first page visited, referring site, channel and the platform the click came from, without its identifier. We store them in first-party cookies (section 14.1), send them with the forms to HubSpot, our CRM; to links to the app we add the campaign parameters and the identifiers of the ad, ad set and campaign. We store the ad click identifier, and send it to HubSpot, only with consent to marketing cookies (section 14.4). Links to the app also carry the click identifiers contained in the page address and, only with consent to marketing cookies, those of the last Google or TikTok ad you arrived from, kept in the tab's session storage (section 14.4): the app stores them only according to the consent collected in the app | Art. 6(1)(f), legitimate interest (knowing which channels and campaigns bring in contacts), with the right to object; Art. 6(1)(a), consent, for the click identifier |
| Marketing and remarketing, personalized ads and conversion measurement in the browser through the Meta pixel, the TikTok pixel and Google Ads tags (through Google Tag Manager) | Art. 6(1)(a), consent |
| Advertising measurement from our servers to TikTok, Site events (a visit to a product page, a contact or demo request, contact details left in a form) may also be sent from our servers through the TikTok Events API, with the same event identifier, so that an event sent both by the pixel and by our servers is counted only once. Only with consent to marketing cookies: without consent we send nothing to TikTok, neither from the browser nor from our servers | Art. 6(1)(a), consent |
Advertising effectiveness measurement, counting visits and conversions generated by campaigns, sent from our servers to Meta through the Conversions API. Without consent to marketing cookies we transmit only the IP address, user agent, page URL (with Meta's campaign parameters only), the ad click identifier (fbclid) contained in the address and the time of the click: no cookie is read or installed on the device and no identifying data (email, name, phone) is transmitted, nor is any profiling or remarketing performed. The fbclid and the time of the click are kept in the tab's session storage (bynor_fbclid, bynor_fbclid_ts), so that all events from the same click carry the same click identifier, and are deleted when the tab is closed. With consent to marketing cookies the same transmission also includes the Meta identifiers (_fbp, _fbc) and contact data in encrypted form (SHA-256 hash). The reduced transmission concerns only Meta and only the Site | Art. 6(1)(f), legitimate interest (aggregate measurement of advertising spend) for the reduced transmission; Art. 6(1)(a), consent, for the extended transmission |
| Tag management, centralized script management through Google Tag Manager | Art. 6(1)(a), consent (for optional tags) |
| Payments, payment processing through Stripe | Art. 6(1)(b), performance of a contract |
| Direct marketing, newsletters and updates (with consent only) | Art. 6(1)(a), consent |
| Legal compliance, responses to authorities, protection of rights | Art. 6(1)(c), legal obligation |
Note: Analytics (Google Analytics 4, Microsoft Clarity, PostHog) and marketing (Meta and TikTok pixels, Google Ads) activities require the user's explicit consent, in accordance with the guidelines of the Italian Data Protection Authority (Garante Privacy) and the EDPB. The only exception is the advertising effectiveness measurement described above when it takes place in reduced form (server to server, without cookies and without identifying data): in that case there is no access to the user's device within the meaning of Article 122 of the Italian Privacy Code, and the processing is based on the Data Controller's legitimate interest in knowing the return on its advertising spend. The user may object at any time by writing to [email protected] (section 10, Data subject rights).
5. Provision of data
The data marked as mandatory in the forms is necessary to handle the request. Providing data for marketing purposes is optional. Refusing analytics or marketing cookies does not affect browsing.
6. Processing methods and security
Processing is carried out using electronic tools, with adequate security measures (HTTPS/TLS, restricted access, backups), in compliance with the principles of data minimization, storage limitation and integrity.
7. Data retention period
| Data | Period |
|---|---|
| Waitlist/contact form data | 24 months from collection |
| Data for direct marketing | Until consent is withdrawn, max 24 months |
| Google Analytics data | 14 months (GA4 setting) |
| PostHog data (in-app product events) | 12 months |
| PostHog data on the Site (pages viewed, clicks, scrolling, session recordings) | 12 months; session recordings 30 days |
| HubSpot data (waitlist leads and contacts) | 24 months from the last interaction |
| Meta Pixel data | 180 days (raw data), up to 2 years (aggregated) |
| Advertising cookies on the device (only with consent to marketing cookies) | _fbp and _fbc: 90 days; _ttp: 13 months from last use, as stated by TikTok; Google _gcl_*: 90 days; bynor_click_id: 90 days; bynor_app_* (session storage): until the tab is closed. When consent is withdrawn we delete _fbp, _fbc, _ttp, bynor_click_id and bynor_app_*; _gcl_* cookies remain until they expire, but with Consent Mode Google tags no longer read them (section 15) |
Origin cookies bynor_* (section 14.1) | 90 days |
Copies in the browser's session storage (bynor_*) | Until the tab is closed |
| Technical record of what was sent to the platforms (random identifier of the event, or of the subscription for purchases, and time of sending; no email, phone, IP address or cookies), to avoid sending the same event twice | No automatic expiry |
| Data received by Meta, TikTok and Google | According to each platform's rules |
| Technical and security logs | 12 months |
| User preferences (localStorage) | Persistent (on the user's device) |
| Data for legal compliance | As required by applicable law |
8. Recipients and data processors
| Provider | Service | Location |
|---|---|---|
| Google Ireland Limited | Google Fonts, Material Symbols, Google Tag Manager, Google Analytics 4, Google Ads, Google Apps Script | Ireland/USA |
| Meta Platforms Ireland Ltd | Meta pixel and Conversions API (campaign measurement, marketing and remarketing) | Ireland/USA |
| TikTok Technology Limited | TikTok pixel and TikTok Events API (campaign measurement, marketing) | Ireland (transfers in section 9) |
| Microsoft Corporation (and its affiliates, including Microsoft Ireland Operations Limited) | Microsoft Clarity (heatmaps, session recordings) | Ireland/USA |
| Tolt, Inc. | Affiliate program: attributing sign-ups to partners (section 14.5) | USA |
| Stripe, Inc. | Payment processing | USA |
| Netlify, Inc. | Hosting and delivery of the Site | USA |
| Loops Email Inc. | Sending transactional and marketing emails (sequences, newsletters) | USA |
| HubSpot, Inc. | CRM, lead capture from forms (waitlist and contacts) | USA |
| PostHog, Inc. | In-app product analytics (product events, funnels, retention) and Site usage statistics (pages, clicks, scrolling, heatmaps, session recordings) | USA |
Roles of the advertising platforms. Meta: for the collection of data with the pixel and the Conversions API and for its transmission to Meta, the Data Controller and Meta Platforms Ireland Limited are joint controllers pursuant to Article 26 of the GDPR, under Meta's Business Tools Terms and the related Controller Addendum (facebook.com/legal/controller_addendum). Meta is responsible, as an independent controller, for the processing it carries out after receiving the data, including their use to show you personalized ads; for matching the hashed data with Meta accounts and for reports on our campaigns it acts as our processor.
TikTok: for the collection and transmission of data with the pixel and the TikTok Events API and for the measurement and reporting of our campaigns, the Data Controller and TikTok Technology Limited are joint controllers pursuant to Article 26 of the GDPR, under TikTok's advertising terms for the European Economic Area. TikTok is responsible for the processing it carries out on the data it receives.
Google: Google Ireland Limited receives the data from Google Ads tags as an independent controller, under the Google Ads Controller-Controller Data Protection Terms; for matching hashed email and phone with Google accounts (enhanced conversions) it acts as our processor, under the Google Ads Data Processing Terms. For Google Analytics 4, Google acts as our processor.
Microsoft (Clarity): under the Microsoft Clarity Terms of Use, the Controller and Microsoft are independent controllers. Microsoft may also use the data collected through Clarity for its own purposes, including improving its services and advertising (Microsoft Advertising), under the Microsoft Privacy Statement (privacy.microsoft.com/en-gb/privacystatement).
In short: the Data Controller informs you, collects consent and is responsible for collecting and transmitting the data; the platforms may also use them for their own purposes, according to their privacy policies (section 17). You can exercise your rights directly with the platform or by writing to [email protected]: if the request concerns a platform, we forward it.
9. Transfer of data to third countries
Some providers are based, or have sub-processors, outside the European Economic Area, in particular in the USA. For recipients certified under the EU-U.S. Data Privacy Framework (including Google LLC, Meta Platforms, Inc., Stripe and HubSpot) the transfer is based on the European Commission's adequacy decision of July 10, 2023 (Article 45 GDPR); for the others, and wherever the contract provides for them as an additional safeguard, on the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914, Article 46(2)(c) GDPR). Data collected by Meta Platforms Ireland may be transferred to Meta Platforms, Inc. Data sent to TikTok is stored by TikTok group companies also in the United States, Malaysia and Singapore, and may be accessed remotely by group companies in other countries, including China, on the basis of the Standard Contractual Clauses or, for some countries, adequacy decisions, as described on TikTok's page on transfers. The user may request a copy of the safeguards by writing to [email protected].
10. Data subject rights
Pursuant to Articles 15 to 22 of the GDPR, the user has the right to: access, rectification, erasure (the "right to be forgotten"), restriction, portability, objection, and withdrawal of consent (without affecting the lawfulness of processing carried out beforehand).
To exercise these rights: write to [email protected] with the subject line "Privacy rights request". A response will be provided within 30 days.
Complaint to the Italian Data Protection Authority (Garante): gpdp.it · [email protected]
11. Profiling
The Site uses profiling technologies through Google Analytics 4 (user segmentation), the Meta pixel, the TikTok pixel and Google Ads tags (custom audiences and campaign measurement). Legal basis: consent. The user may object by refusing marketing cookies through the banner or by changing the ad settings on Meta, Google and TikTok.
The Data Controller does not carry out automated decision-making that produces legal effects on the user within the meaning of Article 22 of the GDPR.
12. Minors
The Site and the services are not intended for children under 16. The Data Controller does not knowingly collect the personal data of minors. If this happens, contact [email protected] to have it deleted.
Part II, Cookie Policy
13. What cookies are
Cookies are small text files saved on the user's device while browsing. They may be session or persistent, first-party or third-party. In addition to cookies, the Site uses tracking pixels (Meta and TikTok pixels), localStorage, the browser's session storage (sessionStorage) and tags/scripts (Google Tag Manager).
14. Types of cookies and technologies used
14.1 Necessary (no consent required)
| Name | Type | Purpose | Duration |
|---|---|---|---|
bynor_cookie_consent, bynor_cookie_consent_at | localStorage | Store cookie choices and when they were made | Persistent |
bynor_utm_*, bynor_first_url, bynor_bid, bynor_bsid, bynor_bcid, bynor_bpl, bynor_referrer, bynor_channel, bynor_click_source | First-party cookies (.bynor.ai) | Remember where the visit came from (utm parameters, identifiers of the ad, ad set, campaign and placement, first landing URL, referring site, channel and the platform the click came from, without its identifier) to attribute requests submitted by the user. We send them with the forms to HubSpot, our CRM, and the app reads them back at sign-up. No profiling. The click identifier (bynor_click_id) is stored only with consent to marketing cookies (section 14.4). | 90 days |
bynor_* (utm parameters, ad identifiers, first page visited, partner code bynor_via) | Browser session storage | Copies of the same data for forms and for links to the app, even when cookies are not available | Until the tab is closed |
theme | localStorage | Light/dark theme preference | Persistent |
14.2 Third-party technical services (no cookies, but data transfer)
| Service | Provider | Data transferred |
|---|---|---|
| Google Fonts (Montserrat) | Google Ireland Ltd | IP, User Agent |
| Google Material Symbols | Google Ireland Ltd | IP, User Agent |
| Google Apps Script (forms) | Google Ireland Ltd | IP, form data |
| HubSpot Forms API (lead capture) | HubSpot Inc. | IP, form data (name, email, phone) |
| Loops Form API (mailing list sign-up) | Loops Email Inc. | IP, email, contact data |
| Tailwind CSS CDN | Tailwind Labs | IP, User Agent |
14.3 Analytics (consent required)
| Service | Cookie | Duration | Data collected |
|---|---|---|---|
| Google Tag Manager | No cookies of its own | – | Technical data |
| Google Analytics 4 | _ga, _ga_<ID> | 2 years | User ID, pages, time, traffic source, IP (anonymized) |
| Microsoft Clarity | _clck, _clsk | 1 year / 1 day | Pages, clicks, scrolling, heatmaps, session recordings, device (active only on the Site) |
| PostHog (in-app) | ph_*_posthog, ph_*_window_id | 1 year | Anonymous distinct_id, product events, pages, device, session (active only within app.bynor.ai) |
| PostHog (Site) | ph_*_posthog, ph_*_window_id | 1 year | Anonymous ID, pages, clicks, scrolling, heatmaps, session recordings, device (active only on the Site, in a project separate from the app's) |
GA4 is configured with: IP anonymization enabled, 14-month data retention. Opt-out: tools.google.com/dlpage/gaoptout
Google Tag Manager loads on every page of the Site and manages the Google Analytics 4 and Google Ads tags with Consent Mode v2: the default setting is "denied" and the banner updates it with your choice. Without your consent, Google tags neither write nor read their cookies.
Microsoft Clarity loads only with consent to analytics cookies and only on the Site; when consent is withdrawn we ask Clarity to delete its cookies.
On the Site, PostHog loads only with consent to analytics cookies, in a project separate from the application's and with a cookie that stays on the bynor.ai domain only; when consent is withdrawn it stops collecting data and we delete its cookies. Within the app.bynor.ai application PostHog measures feature usage: opt-out is available from the profile settings inside the app, or by writing to [email protected].
14.4 Marketing/Profiling (consent required)
| Service | Cookie | Duration | Data collected |
|---|---|---|---|
| Meta pixel | _fbp, _fbc | 90 days | IP, browser and device, pages visited, events (page visit and, on product pages, ViewContent), click identifier fbclid, Facebook ID (if logged in). The pixel has automatic configuration enabled: it detects the buttons clicked and, with automatic advanced matching, reads from the forms you fill in email, first and last name and phone number and hashes them in the browser, before sending; it may also send Meta information about the page content, such as title, description and prices shown |
| TikTok pixel | _ttp, ttclid, ttcsid, ttcsid_<ID> | _ttp: 13 months from last use, as stated by TikTok; the others according to TikTok's settings | IP, browser and device, page visited, events (page visit and, on product pages, ViewContent, with the same event identifier sent to Meta), click identifier ttclid. We do not pass email or phone to the pixel |
| Google Ads (through Google Tag Manager) | _gcl_au, _gcl_aw and other _gcl_* | 90 days | Conversions from Google ads, click identifier (gclid, gbraid, wbraid), IP, browser, pages visited |
| First-visit click identifier (Bynor) | bynor_click_id (first-party cookie on .bynor.ai, with a copy in session storage) | 90 days | The click identifier of the ad you first arrived from (fbclid, ttclid, gclid, gbraid, wbraid, msclkid, li_fat_id), which we send with the forms to HubSpot, our CRM |
| Click identifiers for the app (Bynor) | bynor_app_gclid, bynor_app_gbraid, bynor_app_wbraid, bynor_app_ttclid (tab session storage) | Until the tab is closed | The click identifier of the last Google or TikTok ad you arrived from, to carry it to the app when you change page before signing up. Deleted when consent is withdrawn |
The code of the Meta and TikTok pixels is downloaded only after consent to marketing cookies and only on the Site. With the same consent our servers send Site events to Meta (Conversions API) and to TikTok (TikTok Events API) with the _fbp, _fbc and _ttp cookies and the click identifiers, when present, IP address and browser and, for forms, the contact details you entered (email and phone; to Meta also first and last name), hashed (SHA-256). We do not send first or last name to TikTok. The platforms may also use these data to show you personalized ads.
Meta opt-out: Ad settings · Off-Facebook activity
14.5 Affiliate program (Tolt)
The Tolt script, the service we use to run our affiliate program, loads on the Site's pages: it recognizes the link of the partner who referred you to Bynor (ref or via parameter) and stores the partner code and the identifiers of the click on their link in tolt_* cookies, for 40 days. We also store the partner code in the browser's session storage (bynor_via) and add it to links to the app, so that any sign-up and payment are attributed to the partner. For the app, the rules of its Cookie Policy apply.
15. Cookie banner and consent management
On the first visit, a banner is shown that lets the user, with the same number of clicks: accept all cookies ("Accept all"), reject all but the necessary ones ("Reject") or customize choices by category (Necessary, Analytics, Marketing). Closing the banner with the X equals "Reject": only technical cookies remain. When providers or purposes change we ask for consent again: with version 2.4 the banner is shown again also to those who had already chosen.
The user can change or withdraw these choices at any time by clicking the cookie icon in the bottom left. When consent to marketing cookies is withdrawn, in the browser where you withdraw it we pause the Meta and TikTok pixels, set Google's Consent Mode signals back to "denied" and delete the _fbp, _fbc, _ttp, ttclid, ttcsid* and bynor_click_id cookies and the copies of the fbclid and of the click identifiers for the app (bynor_app_*) in the browser's storage. From then on our servers no longer send TikTok events from that browser, and send Meta at most the reduced transmission described in section 4.
The choice applies to the browser where you make it: if you use the Site from several browsers or devices, you need to make it in each one. The Site and the app have separate banners: the choice made on bynor.ai does not change the one made in the app, and vice versa (for the app see its Cookie Policy). Withdrawal does not delete data already sent to the platforms or already recorded in HubSpot: for those, write to [email protected] and contact the platform, according to its role (section 8). Withdrawal does not affect the lawfulness of processing carried out before it.
16. Managing cookies from the browser
The user can manage cookies from the browser settings:
17. Third-party services' privacy policy links
| Service | Privacy Policy |
|---|---|
| Google (Fonts, GTM, GA4, Google Ads) | policies.google.com/privacy |
| Meta (pixel, Conversions API) | facebook.com/privacy/policy |
| TikTok (pixel, Events API) | tiktok.com/legal/page/eea/privacy-policy |
| Microsoft (Clarity) | privacy.microsoft.com |
| Stripe | stripe.com/privacy |
| Netlify | netlify.com/privacy |
| Loops | loops.so/privacy |
| HubSpot | legal.hubspot.com/privacy-policy |
| PostHog | posthog.com/privacy |
Part III, Final provisions
18. Governing law
This notice is governed by Italian law and by Regulation (EU) 2016/679. For disputes: the Court of Barcellona Pozzo di Gotto (ME), except where a different, mandatory jurisdiction applies for the protection of consumers.
19. Changes
The Data Controller reserves the right to amend this notice. In the event of material changes, a notice will be published on the Site.
20. Contact details
Email: [email protected] · Data Controller: Bynor SRL · Address: Milano (MI) - Via Giuseppe Pogatschnig 40 - 20148
21. Change log
| Date | Version | Changes |
|---|---|---|
| Oct 11, 2026 | 2.6 | PostHog also on the Site, only with consent to analytics cookies: pages viewed, clicks, scrolling, heatmaps and session recordings, in a project separate from the application's. No new purpose. |
| Oct 4, 2026 | 2.5 | The click identifiers of the last Google or TikTok ad, only with consent to marketing cookies, stay in the tab's session storage (bynor_app_*) so they reach the app even when you change page before signing up. No new provider and no new purpose. |
| Sep 28, 2026 | 2.4 | Added the TikTok pixel and the TikTok Events API (joint controllership under Article 26), Google Ads through Google Tag Manager with Consent Mode v2, and Microsoft Clarity; described the roles of Meta, TikTok, Google and Microsoft (Clarity), transfers to TikTok and the _ttp, ttclid, ttcsid* and _gcl_* cookies. The ad click identifier is stored and sent to HubSpot only with consent to marketing cookies. Described withdrawal of consent, the affiliate program with Tolt and the reference to the app's privacy notice. Consent is requested again from everyone. |
| Jul 17, 2026 | 2.2 | Data controller details updated: Bynor SRL, registered office Via Giuseppe Pogatschnig 40, 20148 Milano (MI), Italy, VAT no. 14800270960. |
| May 27, 2026 | 2.1 | Email provider replaced (Brevo → Loops). Added HubSpot (CRM/lead capture forms) and PostHog (in-app product analytics). Scope extended to app.bynor.ai. |
| Mar 18, 2026 | 2.0 | Added section on GTM, GA4, Meta Pixel, Stripe. Updated profiling, joint controllership, granular cookie banner. |
| Jan 19, 2026 | 1.0 | First publication |