This policy explains how Arcano Zero – AI Lab S.r.l. ([registered office address], [VAT / company number]; the “Operator”, “we”) processes personal data when you use AIkademia (the “Service”). It is written to meet Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended. The Operator is the data controller. Contact: [contact email].
1. What the Service does
AIkademia takes a topic you enter, maps competing points of view in the academic literature, retrieves real scholars and their published works from the public OpenAlex index, simulates a debate between AI agents built from those works, and writes a document you can download. Two categories of people are therefore concerned: users of the Service and scholars whose public academic records are used to build the simulated panellists.
2. Data we process about users
- Content you enter: the topic, your questions and interventions during the debate, points of view you add. Do not enter personal data about yourself or third parties unless necessary; the Service is designed for academic subjects.
- Session data: the debate state (points of view, panellists, transcript, generated document) is kept in your browser’s session storage and, when persistence is enabled, in our database so that each debate has a stable address.
- Access cookie: when the instance is password-protected, a strictly necessary, httpOnly cookie named
aik_sessionkeeps you signed in for 30 days. It contains a hash, not the password, and is not used for tracking. - Technical logs: our hosting provider records IP address, user agent, request path and timing for security and operation, with short retention. We do not use analytics or advertising trackers.
3. Data we process about scholars
To build a panellist, the Service queries public scholarly indexes (OpenAlex and, on request, PubMed) and retrieves professional information that is already public: name, institutional affiliation, ORCID where present, and bibliographic records (titles, abstracts, venues, DOIs, citation counts). This information is used to prompt a language model that generates a simulated position for the debate. The Service labels every panellist as an AI simulation, states that the scholar was not involved, and never asserts that the generated text reflects the scholar’s actual opinions. Legal basis: legitimate interest in academic research, education and the freedom of expression (Art. 6(1)(f) GDPR), balanced by the safeguards above. Scholars may object to the processing or request rectification or erasure of a debate that concerns them by writing to [contact email]; we will act within 30 days.
4. Purposes and legal bases
- Providing the Service you request, including generating and storing debates and documents — performance of a contract (Art. 6(1)(b)).
- Security, abuse prevention and the password gate — legitimate interest (Art. 6(1)(f)).
- Processing of public scholarly records — legitimate interest, as described in section 3.
- Compliance with legal obligations — Art. 6(1)(c).
5. Processors and transfers
The Service relies on the following providers, which act as processors or independent services on our behalf:
- Anthropic (language model API, USA) receives the topic, the retrieved bibliographic material and the debate transcript to generate the panellists’ contributions and the document. Anthropic does not use API inputs to train its models. Transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
- Vercel (hosting and edge network, USA/EU) processes technical logs and serves the application.
- Supabase (database hosted in Frankfurt, EU) stores persisted debates.
- OpenAlex (OurResearch, USA) and PubMed (NCBI, U.S. National Library of Medicine) receive search queries derived from your topic or from a researcher’s name you look up; no user identifiers are sent besides the technical request.
6. Retention
- Browser session storage: until you close the tab or start a new debate.
- Persisted debates: until you delete them or ask us to; we may delete debates older than 24 months.
- Access cookie: 30 days.
- Hosting logs: as set by the provider, typically no longer than 30 days.
7. Your rights
You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest, by writing to [contact email]. You may also lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali) or the authority of your habitual residence.
8. Cookies
The only cookie set by the Service is the strictly necessary access cookie described in section 2, which does not require consent under Art. 122 of the Italian Privacy Code. No profiling or third-party cookies are used.
9. Security
Data is transmitted over TLS. Persisted debates are stored in a database that is not publicly readable: the application reaches it only through server-side functions protected by a secret. API keys are stored as encrypted environment variables.
10. Children
The Service is intended for adults and students aged 16 or over. We do not knowingly process data of younger children.
11. Changes
We may update this policy; the date at the top indicates the current version. Material changes will be announced on the Service.