Privacy Policy

Last update: 5 July 2026.

This Policy explains how personal data collected through the èOLI Essence website (the "Site") is processed under Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003.

1. Data Controller

Storai Katy — Via Pistoiese 100 ang. Via Don Tazzoli 1, 59100 Prato (PO), Italy — VAT 02387070978.
Privacy contact: eoliessence@gmail.com.

2. Data we collect

2.1 Data you provide

Contact form: name, email, optional phone, subject and message.
Become a Partner form: contact name, business name, city and address, business type, proposal, business email, phone, website/social. These entries also feed our internal B2B lead register.
Support tickets: name, email and content of the request.
Testimonials: if you send us a review to be published, we process your name, optional role/city, text, rating and external link (e.g. Trustpilot). Publication only occurs after your explicit consent.

2.2 Data collected automatically

Accessibility preferences: stored locally in your browser (localStorage) and, for authenticated admin users, in the database.
Security and audit logs (admin activity, IP, user-agent) to prevent abuse.
Technical cookies: see the Cookie Policy.

3. Purposes and legal bases

Reply to inquiries submitted through the forms — Art. 6.1.b GDPR (pre-contractual measures) and 6.1.a (consent).
Manage B2B partner applications — Art. 6.1.b GDPR.
Publish testimonials — Art. 6.1.a GDPR (consent), revocable at any time.
Site security, abuse prevention, admin logs — Art. 6.1.f GDPR (legitimate interest).
Tax and legal obligations — Art. 6.1.c GDPR.

4. Recipients and sub-processors

We do not sell or trade your data. We rely on the following technical providers appointed as data processors:

Lovable Cloud / Supabase — database hosting, authentication and file storage. Servers in the European Union.
Resend — transactional email delivery (confirmations, internal notifications). Extra-EU transfers covered by Standard Contractual Clauses.
Lovable AI Gateway — used on the admin side for automatic translation of editorial texts; does not process end-user data.
Trustpilot — independent third-party platform. The "Leave a review" button redirects you to Trustpilot; from that point their privacy policy applies.

5. Retention

Contact and Partner form messages: up to 24 months after the last useful contact.
Published testimonials: until consent is revoked or removal is requested.
Closed support tickets: 24 months.
Admin audit logs: 12 months.
Encrypted database backups: up to 90 days.

6. Your rights

You may exercise at any time the rights under Art. 15–22 GDPR: access, rectification, erasure, restriction, portability, objection and consent withdrawal. You may also lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
To exercise your rights, write to eoliessence@gmail.com.

7. Security

We adopt appropriate technical and organisational measures: TLS encryption in transit, role-based access control, database Row Level Security policies, logging of sensitive operations and encrypted periodic backups.

8. Children

The Site is not addressed to children under 16 and we do not knowingly collect data relating to minors.

9. Changes

This policy may be updated. Changes will be published on this page with the new update date.