Privacy Policy

Who we are

BuonaFama is an online platform that helps local businesses ask their customers for reviews, reply to reviews and keep their business listings up to date. It is operated from Italy by its founder, Giuseppe A., as an individual business (no company has been formed yet). He is responsible for the personal information described in this policy (the "controller" under the GDPR), except where a business using BuonaFama is in charge of its own customers' information, as explained below. Because we are based in the European Union, the EU General Data Protection Regulation (GDPR) applies to how we handle personal information, wherever you live.

BuonaFama is currently in a free pilot: we don't sell anything and don't charge anyone. Questions about this policy: info@buonafama.it.

The short version

• We collect only what we need to run the service and to answer you.
• We don't sell personal information and we don't share it for advertising.
• Information about a business's customers belongs to that business: we handle it only on its instructions.
• We don't send text messages (SMS) to anyone.
• Website analytics run only if you click "Accept" in the cookie banner.
• You can ask us at any time to see, correct or delete your information.

What we collect and why

1. When you apply for the pilot or contact us

On pages such as "Apply" or "Join the pilot", or when you message us, we collect your name, business name, type of business, city, email, phone number (if you give it), how you prefer to be contacted and any notes you write. We use them only to reply, to evaluate your application and to set up a call. We keep them until you ask us to delete them, and at the latest 24 months after our last contact.

2. When a business uses BuonaFama

To create an account we collect the owner's or manager's name, email and a password (stored in encrypted, hashed form), plus business details such as name, address, phone, website, hours and category. We use them to provide the service, to send service emails (for example "new private message" or "a reply is ready") and for security.

3. Information about a business's customers

When a business uses BuonaFama, it may enter or receive information about its own customers: for example a first name and email address to send a review request, the language of the review page, a private message the customer chooses to send, reviews and ratings the business pastes in or connects from Google or Facebook, and our replies. For this information the business is in charge (under the GDPR it is the "controller", and BuonaFama is its "processor"; under US privacy laws we act as its service provider). We use it only to provide the service to that business, never for our own marketing, and we delete it when the business asks or after the business leaves, as described in our Pilot Terms. Every review request email includes an unsubscribe link: after you use it, that business can no longer email you review requests through BuonaFama.

If you are a customer of a business that uses BuonaFama and you have a question about your information, please contact that business first. You can also write to us and we will pass your request on.

4. Google and Facebook connections

If a business connects its Google Business Profile or Facebook Page, we read the reviews of that profile or Page and publish the replies the business approves (or, only if the business turns it on, replies to positive reviews automatically). We use this data only for these features, we don't sell it or use it for ads, and we delete it from BuonaFama when the business disconnects. Access can be revoked at any time from the Google or Facebook account settings. BuonaFama's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. AI features

To draft replies, the text of a review (including any name written in it), its rating and the business's reply settings (name, signature, tone) are sent to an AI provider (Anthropic) through its business API. For the AI visibility check, we send only the business's name, category and city to AI services (OpenAI, Google, Anthropic, Perplexity, xAI) to see whether and how they mention the business; no customer information is sent. AI drafts may contain mistakes: businesses review them before publishing, unless they choose automatic replies for positive reviews.

6. Website visits, cookies and analytics

We use cookies that are necessary for the site to work: keeping you signed in, remembering your language and remembering your cookie choice (kept for 6 months). Only if you click "Accept" in the cookie banner, on our public pages (not inside the app, and not on the page a business's customers use to leave a review), we use Google Analytics 4 to understand, in aggregate, how many people visit, which pages they view and where they come from. Google Analytics sets the cookies _ga and _ga_* (up to 2 years). Advertising features, remarketing, Google Signals and ad personalization are turned off. If you click "Decline" or close the banner, Google Analytics is not loaded. You can change your choice at any time through "Cookie preferences" at the bottom of the page.

Our servers also record technical information such as IP address, browser type and the pages requested, for security and to prevent abuse (for example, to limit the free AI check to a few uses per day). For the free AI check we keep the business name, city and IP address for 30 days.

7. Bookings

If you book a video call, the booking is handled by Cal.com, which receives the details you enter (name, email, business name and any notes) and adds the meeting to our calendar.

We don't sell or share personal information

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are used in US state privacy laws. We don't use customer information to build advertising profiles, and we don't let third parties use it for their own purposes.

Service providers we use

We rely on a small number of providers, who process information only to provide their service to us:

When information is transferred outside the EU, we rely on the safeguards allowed by the GDPR, such as the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses offered by the provider.

Your rights and choices

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct it;
• delete it;
• stop using it for a particular purpose, or limit how we use it.

Write to info@buonafama.it. We will answer within 30 days, and we may ask you to confirm your identity. We won't treat you differently for exercising these rights. If you are in the EU, you also have the right to complain to a data protection authority (in Italy, the Garante per la protezione dei dati personali).

California residents. You can review and request changes to your information as described above. Our site does not respond to browser "Do Not Track" signals, but Google Analytics runs only if you accept it in the cookie banner.

Security

We use encrypted connections (HTTPS), store passwords only in hashed form, encrypt access tokens for Google connections, and limit access to the data to the people who need it to run the service. No system is perfectly secure: if a breach affects your information, we will tell you and the affected businesses as required by law.

Children

BuonaFama is a service for businesses and is not directed to children. We don't knowingly collect personal information from children under 16. If you believe a child has given us information, please contact us and we will delete it.

Changes to this policy

If we change this policy, we will update the "Last updated" date at the top. If the change is significant, we will also tell account holders by email before it takes effect.

Contact

BuonaFama · Giuseppe A. · Italy · info@buonafama.it

The Italian version of our privacy information is available at buonafama.it/privacy.