Legal

Privacy Policy

What data we handle, whose, what for and for how long: that of visitors to the site, of our clients and of the people the agent writes to.

Last updated 2026-11-02

The essentials

What	In short
Who	Ismael Eduardo Gomez (MDS Digital), in Italy: contact@teory.ai.
Two roles	Controller of what is ours and processor of what is each client’s (clause 2).
What, why and how long	What the service needs, and how long it lasts (clauses 3 and 4).
Where	In the European Union, except the AI and other providers (clause 7).
Your rights	Access, correction, erasure, restriction, objection and portability (clause 9).
Where to complain	The Italian Garante or your own country’s authority.

WhoIn short: Ismael Eduardo Gomez (MDS Digital), in Italy: contact@teory.ai.

Two rolesIn short: Controller of what is ours and processor of what is each client’s (clause 2).

What, why and how longIn short: What the service needs, and how long it lasts (clauses 3 and 4).

WhereIn short: In the European Union, except the AI and other providers (clause 7).

Your rightsIn short: Access, correction, erasure, restriction, objection and portability (clause 9).

Where to complainIn short: The Italian Garante or your own country’s authority.

1. Who handles your data

The controller is Ismael Eduardo Gomez (MDS Digital), registered at Salita Foti, 5, 98060 Basicò (ME), Italia, VAT number IT03873120830. We handle data under the GDPR and the Codice in materia di protezione dei dati personali (Legislative Decree 196/2003). Write to contact@teory.ai and a person answers. We have not appointed a data protection officer.

2. Two roles

We are the controller of the data of whoever visits teory.ai or books a meeting, of our clients and whoever they invite, and of the people we write to in order to sell Teory or another business of ours: there we decide.
We are a processor of what we handle on each client’s behalf — the people their agent writes to and the conversations of their accounts —: the client decides, and we handle it under the Data Processing Agreement, the annex to the Terms.

3. What we handle, what for and for how long

What we handle as controller:

What	What for	Basis
What you leave when asking for or booking a meeting, on Calendly or in our own form	Scheduling and preparing it, or answering you	Your consent and our legitimate interest
The front-page chat — what you write is not stored — and its counters, with your IP	Showing the product within a limit	Legitimate interest
Visit measurement and the captcha (clause 6)	Knowing what is read and stopping bots	Legitimate interest
Your account — name, email, password, Google identity, second factor and language — and the email of whoever you invite	Giving you the service, and them access	The contract and your workspace’s legitimate interest
Each LinkedIn account you connect — its profile, plan, session and technical identity — and, when you connect it, your approximate location, which is not kept	Acting with it from an IP in the country agreed for it when you contracted the service, if one was; otherwise, in a country near you within the region you choose	The contract and your declaration (Terms, clause 4)
Your workspace: businesses, offer, instructions, files and what you discuss with Teory AI	Having the agent do what you ask	The contract
Use: campaigns, actions, states, receipts and the AI’s spending	Making it work and explaining what did not go out	The contract and legitimate interest
The proof of what you accept and declare	Being able to prove it	Legitimate interest: defending ourselves against a claim
Support, «Feedback» and operational alerts, by email	Answering, running and improving	Legitimate interest
Invoicing	Complying with the law	Legal obligation
What clause 4 lists, about whoever gets a message from us	Selling Teory or another business of ours	Legitimate interest

What you leave when asking for or booking a meeting, on Calendly or in our own formWhat for: Scheduling and preparing it, or answering youBasis: Your consent and our legitimate interest

The front-page chat — what you write is not stored — and its counters, with your IPWhat for: Showing the product within a limitBasis: Legitimate interest

Visit measurement and the captcha (clause 6)What for: Knowing what is read and stopping botsBasis: Legitimate interest

Your account — name, email, password, Google identity, second factor and language — and the email of whoever you inviteWhat for: Giving you the service, and them accessBasis: The contract and your workspace’s legitimate interest

Each LinkedIn account you connect — its profile, plan, session and technical identity — and, when you connect it, your approximate location, which is not keptWhat for: Acting with it from an IP in the country agreed for it when you contracted the service, if one was; otherwise, in a country near you within the region you chooseBasis: The contract and your declaration (Terms, clause 4)

Your workspace: businesses, offer, instructions, files and what you discuss with Teory AIWhat for: Having the agent do what you askBasis: The contract

Use: campaigns, actions, states, receipts and the AI’s spendingWhat for: Making it work and explaining what did not go outBasis: The contract and legitimate interest

The proof of what you accept and declareWhat for: Being able to prove itBasis: Legitimate interest: defending ourselves against a claim

Support, «Feedback» and operational alerts, by emailWhat for: Answering, running and improvingBasis: Legitimate interest

InvoicingWhat for: Complying with the lawBasis: Legal obligation

What clause 4 lists, about whoever gets a message from usWhat for: Selling Teory or another business of oursBasis: Legitimate interest

And how long it is kept, each client’s included:

What	How long it is kept
What you leave when you ask for or book a meeting with us	While we talk and, if nothing comes of it, 12 months more; sooner, if you ask us to delete it
The demo chat’s counters, with your IP address	90 days
What the AI decides and, when it could not answer, the contact’s question, clipped	90 days
The text read from a business’s website or document	90 days, except the last good one and the one its profile stands on, which last as long as the business
The bookings in a client’s Calendly that belong to none of their contacts	30 days
Your user and your personal data	While you have the account. If you ask to delete it, within 14 days at most we release your LinkedIn accounts and delete their cookies, and 30 days after you asked the rest is deleted
The workspace: campaigns, lists, contacts and conversations, with their translations, transcripts and bookings	While the contract lasts; it does not go with your user. At the end it is deleted or returned to you, as you choose, within the following 30 days: today, by hand.
What you delete inside the product — campaigns, chats, lists, businesses, files — and the trace of a member you remove	It stops showing and is kept with the workspace
Each account’s LinkedIn session: its cookies, encrypted, and the remote browser’s profile	While the account is connected; when you disconnect it or remove it from the workspace, they are deleted at once
Each contact’s history — what was done, when and in which campaign —, which keeps them from being written to again in the months of clause 4	While the workspace exists
The posts the engine reads from each account’s feed	While the workspace exists
What the engine records of each job — including the email and phone LinkedIn shows of whoever said yes — and what never went out	While the workspace exists; what never went out, until you remove its account
What the AI spends on each call, by campaign, account and contact, without the text	While the workspace exists, and after that without saying whose it was
What you send from «Feedback»: your message, the screen and, if you gave one, the thumb	While the workspace exists
The proof of what you accepted or declared — who, when, which version and which act —, while a claim can be brought (article 2946 of the Italian Civil Code)	10 years from the end of the contract; if you delete your user before, a fingerprint of your email remains, not the email
Invoicing, which Italian law requires us to keep (article 2220 of the Italian Civil Code)	10 years
The servers’ technical logs	Whatever each provider keeps, under its plan

What you leave when you ask for or book a meeting with usHow long it is kept: While we talk and, if nothing comes of it, 12 months more; sooner, if you ask us to delete it

The demo chat’s counters, with your IP addressHow long it is kept: 90 days

What the AI decides and, when it could not answer, the contact’s question, clippedHow long it is kept: 90 days

The text read from a business’s website or documentHow long it is kept: 90 days, except the last good one and the one its profile stands on, which last as long as the business

The bookings in a client’s Calendly that belong to none of their contactsHow long it is kept: 30 days

Your user and your personal dataHow long it is kept: While you have the account. If you ask to delete it, within 14 days at most we release your LinkedIn accounts and delete their cookies, and 30 days after you asked the rest is deleted

The workspace: campaigns, lists, contacts and conversations, with their translations, transcripts and bookingsHow long it is kept: While the contract lasts; it does not go with your user. At the end it is deleted or returned to you, as you choose, within the following 30 days: today, by hand.

What you delete inside the product — campaigns, chats, lists, businesses, files — and the trace of a member you removeHow long it is kept: It stops showing and is kept with the workspace

Each account’s LinkedIn session: its cookies, encrypted, and the remote browser’s profileHow long it is kept: While the account is connected; when you disconnect it or remove it from the workspace, they are deleted at once

Each contact’s history — what was done, when and in which campaign —, which keeps them from being written to again in the months of clause 4How long it is kept: While the workspace exists

The posts the engine reads from each account’s feedHow long it is kept: While the workspace exists

What the engine records of each job — including the email and phone LinkedIn shows of whoever said yes — and what never went outHow long it is kept: While the workspace exists; what never went out, until you remove its account

What the AI spends on each call, by campaign, account and contact, without the textHow long it is kept: While the workspace exists, and after that without saying whose it was

What you send from «Feedback»: your message, the screen and, if you gave one, the thumbHow long it is kept: While the workspace exists

The proof of what you accepted or declared — who, when, which version and which act —, while a claim can be brought (article 2946 of the Italian Civil Code)How long it is kept: 10 years from the end of the contract; if you delete your user before, a fingerprint of your email remains, not the email

Invoicing, which Italian law requires us to keep (article 2220 of the Italian Civil Code)How long it is kept: 10 years

The servers’ technical logsHow long it is kept: Whatever each provider keeps, under its plan

4. If an account using Teory wrote to you

The controller is the client who holds that account; on their behalf we handle:

Your public profile, what you post and whether you are connected.
What is sent to you and what you answer, with files, voice notes, transcripts and translations; and the rest of that account’s inbox, even if you are in no campaign.
The email you give to receive something, and the emails sent to you, which are kept with the conversation.
If you say yes and the client has a CRM, your email, phone and company website as LinkedIn shows them, and your record there; and your bookings in their Calendly.
The judgement of whether you fit and whether you have said yes, and what the agent decided at each step.

To stop being written to, to be erased or to learn where your data came from, tell the client or say it in the conversation: the agent stops writing to you and hands it to a person; if you ask not to be written to again, you go on that client’s do-not-contact list and none of its campaigns writes to you again until it takes you off it, and if you only say you are not interested, none writes to you again for the following 6 months; the rest the client decides. If you write to us at contact@teory.ai, we pass your request on within 5 days and tell you so.

If we wrote to you to sell Teory or another business of ours, we are the controller: write to us at contact@teory.ai.

5. Artificial intelligence

The artificial intelligence providers in clause 7 write all the text — messages, notes, comments, emails, translations, Teory AI and the front-page chat —, judge who fits and who has said yes, and turn voice notes into text. To write to someone we send them only what they need: what the client and their business say, the person’s public profile, their posts and the thread.

A conversation’s translation is kept next to the message, shown only to whoever chooses to read it that way, and changes neither what is sent nor what the AI reads. The text of a voice note is kept next to the message too.

None of them trains on what we send: their business terms apply to us. By default Anthropic does not keep what we send it, except for 30 days with some models and up to two years for whatever its safety systems flag as abuse. OpenAI does not keep what we send it.

None of this is an automated decision under article 22 GDPR: a «does not fit» only means nobody writes to them. If someone asks whether they are talking to an AI, the agent answers that it is the account’s holder and that they use AI services to automate part of the work.

6. Cookies and what your browser keeps

There are no advertising or tracking cookies, and so there is no banner. The ones we set are our own:

The session cookie, which keeps you signed in to the product.
«teory_demo», on the site: it counts your messages in the front-page chat; it is opaque and lasts 24 hours.
«teory_locale», in the product: the language you chose; it lasts 365 days.
«teory_tz», in the product: your browser’s time zone, to give you every time in yours; your browser writes it, and it lasts 365 days.

Your theme and other preferences stay in your browser, where you clear them.

The captcha on sign-in and on the chat leaves no cookie: it handles your IP, your user-agent and your browser’s TLS fingerprint to stop bots. Visits are counted without cookies, by a hash of the request discarded after 24 hours, and without following you from site to site.

7. Who else sees the data

We do not sell data, hand it to advertisers or train models on it. These work for us:

Category	Who	Where	If the data leaves the EEA
Hosting and database	Supabase	Singapore; the data, in Ireland, in the EU.	The 2021 standard contractual clauses.
Hosting and database	Vercel	US; the product runs in Dublin, in the EU.	The 2021 standard contractual clauses.
Hosting and database	Fly.io	US, with the machines in Frankfurt, in the EU.	The EU-US Data Privacy Framework.
Artificial intelligence	Anthropic	US: it offers no storage in the EU.	The 2021 standard contractual clauses.
Artificial intelligence	OpenAI	US and Ireland.	The 2021 standard contractual clauses.
Email	Resend	US, where it keeps its records.	The 2021 standard contractual clauses.
Protection against bots	Cloudflare	US.	The 2021 standard contractual clauses.
Meeting bookings	Calendly	US.	The EU-US Data Privacy Framework; should it fall, the standard clauses in its agreement.
IP addresses	IPRoyal	United Arab Emirates.	The 2021 standard clauses in its processing agreement.

Hosting and databaseWho: SupabaseWhere: Singapore; the data, in Ireland, in the EU.If the data leaves the EEA: The 2021 standard contractual clauses.

Hosting and databaseWho: VercelWhere: US; the product runs in Dublin, in the EU.If the data leaves the EEA: The 2021 standard contractual clauses.

Hosting and databaseWho: Fly.ioWhere: US, with the machines in Frankfurt, in the EU.If the data leaves the EEA: The EU-US Data Privacy Framework.

Artificial intelligenceWho: AnthropicWhere: US: it offers no storage in the EU.If the data leaves the EEA: The 2021 standard contractual clauses.

Artificial intelligenceWho: OpenAIWhere: US and Ireland.If the data leaves the EEA: The 2021 standard contractual clauses.

EmailWho: ResendWhere: US, where it keeps its records.If the data leaves the EEA: The 2021 standard contractual clauses.

Protection against botsWho: CloudflareWhere: US.If the data leaves the EEA: The 2021 standard contractual clauses.

Meeting bookingsWho: CalendlyWhere: US.If the data leaves the EEA: The EU-US Data Privacy Framework; should it fall, the standard clauses in its agreement.

IP addressesWho: IPRoyalWhere: United Arab Emirates.If the data leaves the EEA: The 2021 standard clauses in its processing agreement.

What leaves the EEA carries the safeguard in its row, and we give you a copy if you ask. A law may oblige us to give data to an authority or a court; our advisers see it under a duty of confidence.

8. How it is protected

LinkedIn cookies, proxy credentials and the email, CRM and Calendly keys live in an encrypted secrets store, never in a column, a log or a response; and the LinkedIn session also lives on the engine’s encrypted disk.
Everything travels encrypted, and the database is encrypted at rest.
Each LinkedIn account has its own IP, shared with no other, and its own browser fingerprint.
Each client sees only their own, and a member only what belongs to their accounts: the database enforces it, row by row.
The LinkedIn password is neither collected nor stored, and what is typed when signing in is not logged.
There are backups: the database’s, under its provider’s plan, and a daily snapshot of the engine’s disk, kept for five days.
Whoever runs the service has access to production, also through artificial intelligence tools.

If a breach affects personal data, from when we learn of it we notify the authority without undue delay and, where feasible, within 72 hours (article 33 GDPR); the people affected, if they face a high risk, without undue delay (article 34); and our clients, within 48 hours.

9. Your rights

You can ask us for access to what is yours, to correct it, erase it, restrict it, object to its processing and take it with you, and to withdraw a consent without that affecting what was done before.

Deleting your account is asked for from Settings → Account or at contact@teory.ai, and the table in clause 3 says how long it takes; until then you can call it off there. Anything else, and closing the workspace, which does not go with your account, you ask for at contact@teory.ai: it is free, and we answer within a month of receiving the request; if it is complex or there are many, within two further months, and we tell you so, with the reason, within the first (article 12(3) GDPR).

If you think we have got it wrong, you can complain to the Garante per la protezione dei dati personali (garanteprivacy.it, Piazza Venezia 11, 00187 Roma) or to the supervisory authority of your country of residence.

10. Minors and changes

Teory is not for under-18s: we do not knowingly open accounts for them, and the Terms prohibit using it with minors’ data. If we learn of any, we delete it.

If this policy changes, its date does; and if the change affects our clients — a new provider or purpose —, we tell them by email that day.