Privacy Policy
This Privacy Policy describes how the website msworks.it handles the personal data of the people who visit it. It is also provided pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR).
Data controller
Controller
Antonio Cirino Murabito
Certified email (PEC)
antonio.murabito@pec.it
Tax code and VAT number
MRBNNC06A05L407Y · 07344720821
Contact email
antonio.murabito@msworks.itCategories of data collected
A. Data you provide voluntarily
Sending an email to the addresses published on this site, or filling in one of its forms, is optional, explicit and voluntary, and results in us receiving the personal data you provide.
Contact form
Full name, email address and message. Needed to reply to your enquiry and manage the correspondence with you.
Newsletter
Your email address, needed to provide the service. The subscription only takes effect once you confirm by clicking the link we send: until then the address enters no list. We also keep the moment of consent and the exact wording of the box you ticked, as proof of what you agreed to.
Free analysis tools
The address of the site you ask us to analyse and the outcome of the checks. If you request the full report, your email address too. We also record a non-reversible hash of your IP address, used only to enforce the daily cap on analyses.
Blog comments
Name, email address and the text of the comment, plus a non-reversible hash of the IP address for anti-abuse purposes. Comments are subject to automated moderation: see section 05.
Buying services
Full name or company name, Italian tax code or VAT number, SdI recipient code or certified email if you give them, address and email; the service you bought, the version of the terms you accepted and the text of the boxes you ticked, with date and time. For a service on quote, also what you write to us by email or on WhatsApp to prepare it. If you buy for your business, also your approval of the clauses with the code we email you: the approved text, date and time, a hash of your IP address and the browser used. You enter your card details on Stripe's page, and they never pass through us.
Activating and checking the Effetto licence, up to version 1.0.10
Versions of Effetto up to 1.0.10 ask for a key. When you activate them, and then at every check, at least every 14 days, the program sends our server the key, a code derived with a hash function from the addresses of the computer's network cards, the computer name, the Windows and Effetto versions and the version of the Licence Agreement you accepted. The network card addresses do not reach us in clear, but that code identifies the computer and is personal data. Of your IP address we keep only a hash computed with a secret key, to stop brute-force attempts. From version 1.0.11 Effetto is free and sends us nothing: outside your office, it only checks for updates, reading the latest release notes from GitHub.
Effetto connected to your CRM
If you connect Effetto to your CRM or another system of yours, the data you choose goes from your computer to your system, not to us: we do not receive it, and you remain its controller.
Effetto with the office archive
If you choose the office archive, the plans and the details of your debtors travel between the PCs on your network that you have connected, encrypted, and are kept on the PC that holds the archive. They do not go through us: we do not receive them, and you remain their controller.
Remote support
During a screen-sharing session we may see the data on your screen, including other people's, such as your debtors'. We see it only for the length of the session and on your behalf, and we do not copy it. Where possible we work with sample data.
Withdrawal
If you use the page to withdraw from a purchase: name, order number or purchase email, the email for the receipt, any message, date and time, a hash of your IP address and the browser used.
About third-party sites. If you analyse a site that isn't yours, the report contains information about that site. Where the business is a sole trader or a professional, that information may be another person's personal data. That's why the report goes only to the address you typed and never to an address found on the analysed site, results are neither public nor indexable, and they are deleted after 90 days.
B. Browsing data and analytics
In the course of their normal operation, the computer systems and software procedures that run this website acquire certain personal data whose transmission is implicit in the use of internet communication protocols. This site uses Vercel Analytics, a web analytics service provided by Vercel Inc. It collects aggregate statistics about how the site is used, such as pages visited, time on page, approximate geographic origin and device type, in order to improve performance and the user experience.
Note. Vercel Analytics does not set cookies: it recognises a visit through a hash of the request, which is discarded after 24 hours. The data collected is aggregate and does not allow individual users to be identified or re-identified.
C. Cookies
The site uses technical and essential cookies only. No profiling cookies and no third-party advertising trackers are used. For details, see the Cookie Policy.
Purposes of processing and legal basis
Personal data is processed for the purposes below. Next to each one, the legal basis that permits it.
Running the website
To ensure the site can be browsed correctly and its services used.
Performance of a contract or pre-contractual steps
Contact form
To reply to enquiries sent through the form and manage the correspondence with users, subject to explicit acceptance of this privacy policy.
Consent and legitimate interest
Sending the newsletter
To periodically send informational emails, updates or promotional material about M's Works, subject to explicit consent.
Consent
Blog comments
To publish the comment under the article, moderate its content and be able to contact its author, subject to explicit acceptance of this notice.
Consent and legitimate interest in moderation
Free analysis tools
To run the analysis you requested and send you the report at the address you gave. Sending the report does not depend on marketing consent: they are two separate things, and the first happens regardless.
Pre-contractual measures at your request
Buying services
To prepare a quote, collect the payment, issue the Italian e-invoice, book and deliver the service, screen sharing included, and handle a withdrawal. The invoice details are needed to conclude the contract: without them we cannot deliver the service.
Performance of a contract and legal obligation
Licence checks, up to Effetto 1.0.10
To recognise the computer the licence is active on, prevent the same key from running on more computers than intended, and free the activation when you change computer. This only concerns Effetto versions up to 1.0.10.
Performance of a contract
Analytics and optimisation
To analyse site traffic in aggregate form through Vercel Analytics in order to improve performance.
Legitimate interest
Security and defence
To prevent or detect fraudulent activity or abuse that could harm the site.
Legitimate interest
How we process the data, and who receives it
Processing is carried out using computer and electronic tools, with organisational methods strictly related to the purposes stated. Besides the Controller, in some cases the data may be accessible to other people involved in running this site (administrative, sales, marketing and legal staff, system administrators), or to external parties appointed, where necessary, as Data Processors by the Controller.
The providers, and what they do
Vercel Inc.
USA · Data Privacy Framework
Provider of the hosting infrastructure and of the Analytics service.
Resend
USA · Data Privacy Framework
Platform used to send our email: the newsletter, the enquiries received through the contact form, the subscription confirmation request, the reports from the analysis tools and the purchase emails, that is order confirmation, clause approval code and withdrawal receipt, as well as the licence keys of Effetto versions up to 1.0.10.
Supabase Inc.
Data in the EU (Sweden) · Standard Contractual Clauses
Database where we keep orders, approvals and withdrawal requests, and the licences, activations and checks of Effetto versions up to 1.0.10.
GitHub Inc.
USA · Data Privacy Framework
Hosts Effetto's installer and updates. When you download the program, or when Effetto checks for an update, your IP address reaches their servers.
OpenAI Ireland Ltd.
Ireland · EU
Provider of the artificial intelligence system used for automated moderation of blog comments.
Notion Labs Inc.
USA · Standard Contractual Clauses
Internal tool used to manage comments awaiting moderation.
Stripe Payments Europe Ltd.
Ireland · EU
Handles payment for purchases. It receives your email, the amount and the payment details you enter on its page; your invoice details stay with us.
Agenzia delle Entrate · Sistema di Interscambio
Italy · legal obligation
The Italian tax authority's exchange system receives the e-invoice for every purchase, as the law requires, and makes it available in your cassetto fiscale.
OpenStreetMap Foundation
United Kingdom · Adequacy decision
Supplies the map imagery on the Contact page. Opening that page sends your IP address to their servers, which is technically unavoidable in order to download an image. It sets no cookies and does no profiling.
Blog comments and automated moderation
Blog articles can be commented on. To publish a comment we collect your name, email address and the text of the comment. The name and the text are public; the email address is never published and is only used so we can get back to you. We also record an encrypted, non-reversible hash of your IP address: we do not store the IP address in the clear, and the hash is used solely to limit automated submissions and abuse.
Transparency about our use of AI
Before publication, every comment is analysed by an artificial intelligence system.
The AI does not decide: if it flags a comment, that comment is not deleted but waits for a human review.
Purpose
To detect spam, advertising, insults, hate speech, sexually explicit material, unlawful content or third parties' personal data, so that the comment space stays usable and lawful.
System used
A language model provided by OpenAI (currently gpt-6-luna), queried through an API. The data is not used to train the models.
Data sent to the provider
The text of the comment only. Name, email address and the IP hash are not sent to the artificial intelligence system.
Legal basis
The Controller's legitimate interest (Art. 6(1)(f) GDPR) in preventing abuse and unlawful content on its own pages.
No profiling
The system assesses the individual comment. It is not used to profile, classify or evaluate people, nor for any purpose other than moderation.
Human oversight and the right to a review
The automated assessment does not produce a final decision: if the system approves the comment, it is published immediately; if it flags the comment as unsuitable, or if the assessment is unavailable, the comment is not deleted but waits for a human review by the Controller, who decides whether to publish it. No decision is therefore taken solely on the basis of automated processing within the meaning of Art. 22 GDPR.
If you believe your comment was flagged by mistake, you can ask for it to be reviewed by writing to antonio.murabito@msworks.it, quoting the article and the text you submitted.
This is the only place on the site where an artificial intelligence system is used. Our broader position on the subject is set out on the Transparency about our use of AI page.
Transfers of data outside the EU
The data processed may be transferred to countries outside the EU, for example the United States for services such as Vercel or email marketing providers. Any such transfer takes place on the basis of an adequacy decision of the European Commission, such as the Data Privacy Framework, or on the basis of Standard Contractual Clauses (SCCs).
Retention periods
Data is processed and kept for as long as the purposes for which it was collected require.
Contact form data
Max 2 years
Kept for as long as needed to handle the enquiry and to meet any legal obligations.
Newsletter data
Until withdrawal
Kept until you unsubscribe, which you do from the link at the foot of every email. Subscription requests that are never confirmed are deleted.
Free tool analyses
90 days
The analysed domain, the outcome of the checks and, where applicable, the email the report was sent to.
Blog comments
12 months
The published comment and the author's name stay online for as long as the article is published, or until removal is requested. Email address and IP hash are kept for 12 months. Comments that are not approved are kept for 6 months and then deleted.
Licence checks, up to Effetto 1.0.10
While the licence is active; checks 12 months
For Effetto versions up to 1.0.10. Activations are needed for as long as the licence exists; when a licence is revoked or transferred, the old activations are freed. The log of individual checks, with the IP hash, is deleted after 12 months.
Purchases and invoices
10 years
Order data and the invoice, as required for keeping accounting records (article 2220 of the Italian Civil Code), together with the accepted terms, the approved clauses and any withdrawal requests, which are their evidence.
Browsing data
As long as needed
Kept for the time technically required for statistical analysis, then deleted or anonymised.
Your rights
As a data subject you have the rights set out in Articles 15-22 GDPR, including the right to:
Request access to your personal data
Request its rectification or erasure
Request that processing be restricted
Object to the processing, in particular for the newsletter
Withdraw your consent at any time
Request data portability
Lodge a complaint with the Italian data protection authority, the Garante (garanteprivacy.it)
To exercise your rights, send a request to the Controller's contact details given in this document.
Write to the controller