Privacy Policy of Lares App
Last updated: 2026-06-10 - Version: 1.1
Data Controller
The data controller for personal data collected through the Lares app is Paolo Tanzi (VAT no. IT 02611230349), with registered office at Strada Gossella 16, 43029 Traversetolo (Parma), Italy.
For any enquiry: privacy@lightweb.it
Data Collected and Purposes
The Lares app collects personal data in the categories described below, strictly necessary for the operation of the service.
Location Data (GPS)
GPS access is optional and disabled by default. When you enable proximity features, the app uses the device's geographic location for two distinct purposes:
(a) Proximity to known sites: the distance between your position and the cultural sites already configured in the app is calculated locally on your device; these coordinates are not transmitted to our servers.
(b) Discovery of nearby points of interest: to suggest cultural points of interest around you, your coordinates are sent to our server, which forwards them to a third-party maps provider. The provider used is OpenStreetMap (via the Overpass API, servers within the EU) by default, or, where so configured, the Google Places API operated by Google LLC (USA). Your coordinates are used solely to perform the lookup and are not stored on our servers.
Location data is never used to track you over time and is not stored in persistent, identifiable form.
Legal basis: consent of the data subject (Art. 6.1.a GDPR), expressed when location access is first enabled. Consent may be withdrawn at any time by turning off the proximity switch in the app or through your device settings, which will disable all location functionality.
Conversation Data
The text of questions addressed to the guide character is sent to an external AI service to generate a response. When voice input is used, the audio recording is transmitted to an external speech-to-text service for transcription.
The current AI language model provider is Anthropic, Inc. (USA). Voice transcription (speech-to-text) is performed by OpenAI, Inc. (USA). The text-to-speech (TTS) provider is ElevenLabs, Inc. (USA). These transfers are made to third countries outside the EU/EEA on the basis of Standard Contractual Clauses approved by the European Commission (Art. 46.2.c GDPR).
Conversations are not linked to the user's identity and are not retained on our servers after the session ends.
Anthropic and ElevenLabs act as data processors and, under their API terms, do not use the data transmitted to them to train their models.
Anthropic retains API inputs and outputs for a limited period for abuse-prevention and security purposes (approximately 30 days under the Anthropic DPA), after which they are deleted. ElevenLabs receives only the AI-generated text of the response — which may incidentally contain personal data entered by the user — and does not retain it beyond the voice synthesis.
We recommend that you do not share sensitive personal data (such as health information, identification numbers or precise contact details) with the AI guide.
Legal basis: performance of the service contract (Art. 6.1.b GDPR).
Account and Credits
Both the free demo and the full service require signing in with an email address via a magic link; no permanent account with a password is created (a password may optionally be set after a purchase). We collect: email address, credit purchase history, remaining credit balance.
Payment data is processed entirely by Stripe, Inc. (USA), which may offer various payment methods (card, PayPal and others). Stripe does not transmit or store payment card data on our systems. Stripe privacy policy: stripe.com/privacy
Legal basis: performance of the contract (Art. 6.1.b GDPR).
Retention: account data is retained for the duration of the relationship and for 24 months following account deactivation, unless otherwise required by law.
Usage Data
We collect data on app usage (sessions started, languages used, sites visited) and per-turn event records used for billing and analytics. Some of these records are linked to your account for billing purposes and are therefore pseudonymous rather than fully anonymous; the aggregated analytics derived from them do not identify individual users.
Legal basis: legitimate interest of the controller (Art. 6.1.f GDPR).
Third-Party Providers and International Transfers
The app relies on the following third-party providers to deliver its service. The mechanism for each transfer to a third country is indicated per provider:
— Anthropic, Inc. (USA): processing of conversation text via language model. Transfer based on Standard Contractual Clauses, Module 2 (controller to processor), under the Anthropic DPA effective 24 February 2025. Privacy policy: anthropic.com/privacy
— OpenAI, Inc. (USA): transcription of voice input (speech-to-text). Transfer based on Standard Contractual Clauses. Privacy policy: openai.com/policies/privacy-policy
— ElevenLabs, Inc. (USA): voice synthesis of response text. Receives only the AI-generated output, which may incidentally contain personal data entered by the user. Transfer based on Standard Contractual Clauses under the ElevenLabs DPA (elevenlabs.io/dpa). Privacy policy: elevenlabs.io/privacy
— Stripe (Stripe Technology Company Ltd, Ireland, and Stripe, Inc., USA): payment processing (including methods such as PayPal where offered). Transfers covered by the EU-US Data Privacy Framework and Standard Contractual Clauses under the Stripe DPA (stripe.com/legal/dpa). Privacy policy: stripe.com/privacy
— OpenStreetMap Foundation — Overpass API (servers within the EU): discovery of nearby points of interest from your coordinates (default maps provider). Map data © OpenStreetMap contributors. Copyright and terms: openstreetmap.org/copyright
— Google LLC (USA): discovery of nearby points of interest via the Google Places API, where configured in place of OpenStreetMap. Transfer covered by Google's standard Google Cloud Data Processing Addendum; Google participates in the EU-US Data Privacy Framework. Privacy policy: policies.google.com/privacy
Anthropic and ElevenLabs act as data processors and do not use the transmitted data to train their models. Each transfer to a third country relies on the specific mechanism indicated above (Standard Contractual Clauses pursuant to Art. 46.2.c GDPR and/or the EU-US Data Privacy Framework).
Minors
The minimum age to use the app and to provide personal data on one's own is 14 years (Art. 8 GDPR; Art. 2-quinquies of the Italian Privacy Code).
Children under 14 may use the app only with the consent and under the supervision of a holder of parental responsibility, who provides the consent on their behalf.
Location (GPS) features rely on consent: this consent cannot be validly given by a minor under 14 and, for such users, requires the consent of a holder of parental responsibility.
Where the app is used at a kiosk or fixed installation in a cultural venue, minors should use it under adult supervision; the hosting operator is required to post an appropriate notice.
Data Retention
Session data (conversations) is not retained after the session ends.
Account data is retained for the duration of the contractual relationship and for 24 months following account closure, unless otherwise required by law.
Usage and event data (including per-turn records used for billing and analytics) is retained for a maximum of 24 months.
Location data is not stored in persistent form.
Cookies and Local Storage
The app does not use profiling or tracking cookies. It stores the following strictly necessary or functional items in your browser's local storage:
— Authentication token (JWT): strictly necessary to keep you signed in; retained for the duration of the session.
— Proximity preference flag: functional; records whether you enabled location features and persists until you clear it or disable the feature.
No data stored locally is used for advertising or profiling.
Your Rights
You have the right to access your personal data, request its rectification or erasure, object to processing, request restriction of processing, and request data portability, to the extent provided by Regulation (EU) 2016/679 (GDPR).
You may withdraw consent to location data processing at any time through your device settings.
To exercise your rights, write to privacy@lightweb.it. We will respond within 30 days.
You have the right to lodge a complaint with the competent supervisory authority. In Italy: Garante per la protezione dei dati personali (www.garanteprivacy.it).
Changes to This Policy
The controller reserves the right to update this privacy policy at any time. Registered users will be notified by email of any material changes. The current version is always available on this page.