Privacy Policy
Summary
Incomedia processes your data to provide WebSite X5, its online services and support, and uses it for marketing and advertising only with your consent. Here are the key points; the details are in the sections below.
- Who we are: Incomedia S.r.l., Ivrea (Italy), the controller. Contact: policy@incomedia.eu.
- What we process: account data (name, email, country), licences and purchases, technical data from the software and websites, support requests, and the content you enter into the artificial intelligence features.
- Artificial intelligence: MagicText, MagicSite and the support assistant use third-party AI services (OpenAI, ZipChat). What you write is sent to these providers to process your request. Do not enter unnecessary personal data or other people's data.
- Payments: licences and credits are normally purchased through 2Checkout/Verifone, which handles the payment; some purchases from Italy are made directly with Incomedia through PayPal. Incomedia does not see your payment card details.
- Marketing: newsletters, offers from selected partners and personalised advertising only with your consent. You can turn off email tracking and stay subscribed.
- Where your data is: most data is hosted in the United States (Amazon Web Services) and some providers process it in the EU; transfers are protected by the safeguards provided for by the GDPR.
- Your rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent and complaint to the Italian Data Protection Authority (Garante).
1. Controller and contact details
The controller is Incomedia S.r.l., Via Burolo 22/A, 10015 Ivrea (TO), Italy, VAT number and tax code 07514640015 ("Incomedia").
For any question about this notice, or to exercise your rights, write to policy@incomedia.eu with "Privacy" in the subject line, or send a letter to the address above.
Incomedia has not appointed a data protection officer (DPO), as the appointment is not mandatory for its activities (Art. 37 GDPR).
↑ Back to contents2. What this notice covers
This notice, provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR"), describes the processing of personal data carried out by Incomedia through:
- Incomedia's websites, namely incomedia.eu, websitex5.com and its subdomains (for example Help Center, Marketplace and guides) and webanimator.com;
- the WebSite X5 software, including the MagicText and MagicSite features and the built-in support assistant;
- related services, such as support, newsletters, credits and the hosting included in licences.
It does not apply:
- to the websites you create with WebSite X5: you are the controller of your visitors' data, and you must provide your own privacy notice. If your website is hosted on the hosting included in your licence, Incomedia processes the data contained in the website only on your behalf, as a processor, under the terms of the hosting service;
- to the checkout and payments handled by 2Checkout/Verifone and PayPal, which process data as independent controllers under their own privacy notices;
- to third-party websites reached through links on our websites.
3. What data we process, why and on what legal basis
We only process the data necessary for each purpose. If the processing is based on a contract or a legal obligation, providing the data is necessary: without it, we cannot provide the service. If it is based on consent, providing the data is optional and you can withdraw your consent at any time, with no consequences for other services. Retention periods are set out in section 8.
| Activity | Data processed | Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|---|---|
| Account for the Help Center and Marketplace | First name, last name, email, country, password (stored encrypted), IP address and date of email validation, login history | Creating and managing the account, linking licences and credits to it | Contract (point b); for the validation IP address and login history: legitimate interest in security and in proof of registration (point f) |
| Trial version | Email, IP address and date of validation, trial licence, technical activation data | Activating and managing the trial version, providing support, preventing abuse | Pre-contractual steps (point b); legitimate interest in preventing abuse (point f). Marketing communications only with your consent |
| Purchases of licences and credits | Order data received from 2Checkout/Verifone (name, email, country, product purchased). For purchases made directly with Incomedia through PayPal, also tax and billing data and amounts | Delivering licence keys and credits, handling refunds and order support, invoicing and tax compliance | Contract (point b); legal obligations (point c) |
| Software activation and use | Licence key, device identifier, software and operating system version | Activating and verifying the licence, checking for updates, preventing unauthorised use | Contract (point b); legitimate interest in protecting the licence (point f) |
| Error reports from the software | Technical crash data, any comments you choose to add | Fixing errors and improving stability | Consent: a report is sent only if you choose to send it (point a) |
| AI features MagicText and MagicSite | Text and prompts you enter, generated content, user ID and licence ID, amount of text processed (tokens), credits, date and time, any feedback | Providing the requested feature, applying licence limits, preventing abuse; support, research, development and product improvement, including by consulting prompts and responses stored with OpenAI (section 4) | Contract (point b); legitimate interest in preventing abuse, in providing support and in improving the product (point f) |
| Images for MagicSite and Premium images | Search keywords, images selected, credits spent | Displaying images, purchasing the licence for Premium images on publication | Contract (point b). Searches are made from Incomedia's servers: the image providers (Pixabay, Depositphotos, Pexels, Lummi) receive only keywords, not your personal data |
| Support by email and tickets | Contact details, content of requests, attachments, licence data | Answering requests and solving problems | Contract or pre-contractual steps (point b); legitimate interest for requests not related to a contract (point f) |
| AI assistant on websitex5.com and in the software | Pseudonymous visit identifier, chat messages, technical connection data, any data you write | Answering support questions; handing over to a human agent where needed; analysing the quality of answers | Legitimate interest in offering fast support (point f); pre-contractual steps for purchase questions (point b) |
| Help Center: published content and moderation | Public name, badge showing the WebSite X5 edition you own (visible to everyone), optional profile information (for example how you heard about us and how you use WebSite X5), public or private topics, comments, attachments, reports | Publishing community contributions, managing private topics (visible only to Incomedia), moderating content in accordance with the Terms; internal statistics based on optional profile information | Contract (point b); obligations under the EU Digital Services Act, DSA (point c); legitimate interest in protecting the community and in internal statistics (point f) |
| Newsletter and promotional communications | Email, name, language, products owned, preferences on types of communication (for example partner offers), date, time and IP address of the double opt-in; also collected through the sign-up pop-ups on our websites, managed by Claspo | Sending news, offers and content about WebSite X5, selected according to your language and the products you own; if you enable the relevant preference, offers for partner products selected by Incomedia, without disclosing your data to partners | Consent (point a; ePrivacy Directive) |
| Email tracking | Opens, link clicks, date and time, device and approximate IP address | Measuring interest in content and improving our communications | Consent (ePrivacy Directive). You can turn it off from the link in every email and keep receiving the newsletter |
| Service communications | Email, licence data | Informing you of important updates, security matters, changes to services and terms | Contract (point b); legal obligations (point c) |
| Surveys and competitions | Answers, contact details | Collecting opinions, running competitions | Consent (point a) or competition rules; a specific notice is provided when you take part |
| Included hosting in licences | Account and licence data, domain and settings, website files and databases, technical logs | Providing web space, support, security and backups | Contract (point b); legitimate interest in security (point f). For the data contained in your website, Incomedia acts on your behalf (section 2) |
| Security and logs of websites and servers | IP address, date and time, pages or services requested, browser | Ensuring security and operation, preventing fraud and abuse | Legitimate interest (point f) |
| Legal obligations and protection of rights | Data needed for the specific case | Complying with requests from authorities, defending Incomedia's rights | Legal obligation (point c); legitimate interest (point f) |
For cookies, email tracking and promotional emails, the rules of Directive 2002/58/EC (the "ePrivacy Directive") also apply, as implemented in the country where you are located; in Italy, Articles 122 and 130 of the Italian Privacy Code.
Where processing is based on legitimate interest, you can object at any time on grounds relating to your particular situation (section 9). Personalised advertising and measurement through cookies are described in section 5. We also process the business contact details of partners, resellers and suppliers to manage business relationships, on the basis of the contract or of our legitimate interest.
↑ Back to contents4. Artificial intelligence features
Incomedia's AI features rely on services from external providers, which act as processors on Incomedia's behalf (Art. 28 GDPR). What you enter is sent to these providers only to process your request.
MagicText and MagicSite
- Requests pass through Incomedia's servers, which forward them to OpenAI (OpenAI Ireland Ltd., with processing also in the United States) together with a user and licence identifier. OpenAI uses the identifier to prevent abuse. Before generation, requests go through OpenAI's moderation filters.
- Incomedia does not store on its servers the text you write or the content generated: the history remains on your PC only for the work session. Incomedia stores usage data: user identifier, amount of text processed (tokens), credits, date and time, and any positive or negative feedback you choose to give.
- OpenAI retains prompts and responses for a limited period, normally 30 days, to monitor abuse and, for MagicSite, to let you pause and resume generation; it may retain them for longer only where required by law. OpenAI does not use this data to train its models.
- While they remain with OpenAI, authorised Incomedia staff may consult prompts and responses for support, security, research, development and product improvement.
- The images suggested by MagicSite come from Pixabay, Depositphotos, Pexels and Lummi. Searches are made from Incomedia's servers and contain only keywords, so these providers do not receive your personal data; the images you choose are saved in your project.
AI support assistant
- On websitex5.com and in the software you can chat with an AI assistant provided by ZipChat (Zipchat Inc., United States). The chat tells you that you are talking to an AI system.
- An Incomedia agent can read the conversation and step in, for example if the assistant cannot answer.
- Incomedia analyses conversations to assess the quality of the answers, including with automated indicators of the tone of the conversation.
Help Center moderation
- To check whether published content complies with the Terms, Incomedia uses an OpenAI-based tool that can automatically decide whether to publish or remove content. If your content is not published or is removed, you can ask for the decision to be reviewed by a person.
What we ask of you
- Do not enter into the AI features any unnecessary personal data, other people's data without a legal basis, or special categories of data such as health information.
- Always check generated content before using or publishing it. The terms of use of the AI features are set out in the Additional Terms for AI Features.
Automated decisions: Incomedia does not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The automated moderation of Help Center content does not produce effects of this kind.
↑ Back to contents5. Cookies and similar technologies
Incomedia's websites use cookies and similar technologies. Technical cookies, which are necessary for the website to work, do not require consent; all others are set only if you accept them in the banner.
| Category | Purpose | Consent |
|---|---|---|
| Technical and strictly necessary functionality | Account login, cart, language, currency, storing your cookie choices, security | Not required |
| Statistics | Measuring and analysing the use of the websites (Google Analytics 4 via Google Tag Manager, Microsoft Clarity) | Required |
| Marketing and profiling | Measuring campaigns and showing personalised advertising, including on other websites (Google Ads, Meta); showing personalised pop-ups and forms based on browsing (Claspo) | Required |
You can accept, reject or choose by category on your first visit, and change your mind at any time using the cookie preferences icon on every page. Rejecting non-technical cookies does not limit your use of the websites. Consents are managed with the Cookie-Script tool.
For Meta cookies, the collection and transmission of data through our websites take place under joint controllership with Meta Platforms Ireland Ltd.; any further processing is carried out by Meta as an independent controller, under its own privacy policy.
Detailed cookie list: the full list, with the name, provider, purpose and duration of each cookie, is in the tables below, one for each website, updated automatically by the consent management tool. The tables can also be reached from the banner.
Email tracking (pixels) is described in section 3.
↑ Back to contents6. Recipients and providers
Your data is accessible to authorised and trained Incomedia staff, only to the extent necessary for their duties. Incomedia does not sell your data.
Data is disclosed to the providers listed below. Processors act on Incomedia's instructions under a contract (Art. 28 GDPR); independent controllers process data for their own purposes, under their own privacy notices.
| Provider | Service | Role | Place of processing |
|---|---|---|---|
| Amazon Web Services | Servers for websites, Help Center, Marketplace and online services; service emails | Processor | United States (Virginia) |
| OpenAI Ireland | Processing AI requests for MagicText, MagicSite and Help Center moderation | Processor | EU (Ireland) and United States |
| Zipchat Inc. | AI support assistant | Processor | United States |
| Freshworks (Freshdesk) | Support ticket management | Processor | United States |
| Google (Workspace) | Business email | Processor | EU and United States |
| Zucchetti | Invoicing of direct sales in Italy and management of suppliers and partners | Processor | Italy |
| Brevo | Sending newsletters and emails, email tracking | Processor | EU (France) |
| Cookie-Script | Banner and consent management | Processor | EU (Lithuania) |
| Claspo | Pop-ups, sign-up forms and personalised messages on the websites, only with consent | Processor | EU (servers in Ireland and Germany); company based in the United States, with Standard Contractual Clauses |
| Google (Analytics, Tag Manager, Ads) | Statistics and advertising, only with consent | Processor for Analytics; independent controller for advertising services | EU and United States |
| Microsoft Ireland Operations (Clarity) | Analysis of website use, only with consent | Independent controller | EU and United States |
| Meta Platforms Ireland | Advertising and measurement, only with consent | Joint controller for collection, then independent controller | EU and United States |
| 2Checkout/Verifone | Sale, payment and invoicing of licences and credits, as reseller (Merchant of Record) | Independent controller | EU (Netherlands, Germany, Romania) and other countries of the Verifone group, with Standard Contractual Clauses |
| PayPal | Payments | Independent controller | EU (Luxembourg) |
| Host.it (Vianova group) | Hosting included in licences | Processor for Incomedia's data; sub-processor for the data of hosted websites | Italy |
Data may also be disclosed to advisers and professionals (for example lawyers and accountants) bound by confidentiality, and to authorities where required by law. The up-to-date list of processors is available on request from policy@incomedia.eu. For some internal tasks, such as drafting texts, analysis and support, staff may use business artificial intelligence tools (for example from OpenAI, Anthropic, Google and Perplexity), and are prohibited from entering unnecessary personal data.
↑ Back to contents7. Transfers outside the European Economic Area
Some providers process data in the United States: in particular Amazon Web Services, which hosts Incomedia's servers, OpenAI, Zipchat Inc., Freshworks (Freshdesk) and, for some services, Google, Microsoft and Meta.
These transfers take place only with the safeguards provided for by the GDPR (Art. 44 et seq.):
- the European Commission's adequacy decision on the EU-US Data Privacy Framework, for providers certified under it (Amazon Web Services, Google, Microsoft, Meta, Freshworks and Zipchat);
- the Standard Contractual Clauses adopted by the European Commission, included in our contracts with providers, also as an additional safeguard.
You can request information on the safeguards adopted, and a copy of those that apply, by writing to policy@incomedia.eu.
↑ Back to contents8. How long we keep data
We keep data for as long as necessary for the purposes in section 3; after that, we delete or anonymise it. The exceptions are cases where the law requires longer retention or where the data is needed to defend our rights in a dispute, until the limitation period expires.
| Data | Retention period |
|---|---|
| Account, licences, credits and related history | Until the account is deleted, which you can request at any time. Licences are perpetual: we keep the data so that you can recover them. After the account is closed, we keep only the data needed for licences to work (email address, keys and activations) |
| Trial version | Until you request deletion, to allow activation of the product |
| AI feature usage data (tokens, credits, date and time) | Until the account is deleted |
| Text entered and content generated with MagicText and MagicSite | Not stored on Incomedia's servers; on your PC only for the work session; with OpenAI normally 30 days (section 4) |
| Accounting and tax records | 10 years, as required by law |
| Support tickets, emails and chats | 5 years from the closing of the request or the last interaction |
| Conversations with the AI assistant | For the duration of the service, under the terms of Zipchat Inc.; you can request their deletion at policy@incomedia.eu |
| Content published in the Help Center | Until it is removed or the account is deleted; content older than 6 years is gradually removed |
| Newsletter | Until you withdraw your consent or object. If you do not open or click our emails for 18 months, we stop sending you marketing communications, unless you have turned off tracking. We keep proof of consent and of its withdrawal for as long as necessary to demonstrate them |
| Email tracking data | For the duration of the subscription, unless tracking is turned off |
| Website statistics and advertising data | 18 months, unless individual tools use shorter periods |
| Software error reports | 18 months |
| Technical and security logs | 18 months |
| Included hosting | The web space and its data are deleted one month after the service expires, unless renewed |
| Cookies | According to the duration stated in the cookie list (section 5) |
9. Your rights
At any time you can ask Incomedia for:
- access: to know whether we process your data and to obtain a copy (Art. 15 GDPR);
- rectification of inaccurate or incomplete data (Art. 16);
- erasure of your data, in the cases provided for by law (Art. 17);
- restriction of processing, in the cases provided for by law (Art. 18);
- portability: to receive the data you have provided to us in a structured and machine-readable format, for processing based on a contract or on consent (Art. 20);
- objection to processing based on legitimate interest, on grounds relating to your particular situation, and in any case to direct marketing (Art. 21);
- withdrawal of consent, without affecting processing already carried out (Art. 7).
You can update much of your data directly from your online profile. For everything else, write to policy@incomedia.eu with "Privacy" in the subject line. We reply within one month, which may be extended by two further months for complex requests; we may ask you for information to verify your identity.
If you believe that the processing infringes data protection law, you can lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work, or where the alleged infringement took place. The list of supervisory authorities in the European Economic Area is available on the website of the European Data Protection Board (www.edpb.europa.eu).
↑ Back to contents10. Other information
Children. Incomedia's services are not intended for children under 14. If the law of your country sets a higher age for consenting to online services (for example 16 in Germany), that age applies. If we find out that we have collected a child's data without the necessary consent, we delete it.
Security. We adopt technical and organisational measures appropriate to the risk, including password encryption, secure connections, access to data restricted to authorised staff and data protection agreements with our providers. No system is 100% secure: in the event of a personal data breach that poses a risk to you, we will inform you as required by law.
Users outside the EU. This notice applies to all users, wherever they are. If the law of your country grants you additional rights, you can exercise them in the same way as described in section 9.
Changes. We may update this notice when our services or the law change. The version in force is always published on this page with the date of the last update. In the event of significant changes, for example new purposes or new types of providers, we will inform you in advance by email or in the software; if a new purpose requires consent, we will ask for it.
Languages. This notice is drafted in Italian and translated into other languages. All versions have the same content; if in doubt, you can contact us.
↑ Back to contents