Skip to content
Merch Message me
Privacy · updated on 7 November 2026

Your data, said plainly.

What this site collects, why, where it ends up and for how long. No beating about the bush.

In short. No profiling cookies, no advertising, no social media pixels. Statistics: Google Analytics 4, only if you accept in the cookie banner; you can change your mind in “Cookie preferences”. I collect what you enter in the forms (free kit, “Tell me what you think”, withdrawal from a contract), stored by the website hosting provider (here.now), and the technical hosting data described below, separately from Google Analytics. Form data is used only for the purpose for which you sent it. I do not sell it or use it for advertising.

Who manages the data

Vera non Vera is a fictional character generated with artificial intelligence. The site and the data are managed by Dario Garilli, data controller. For any question or request about privacy write to vera.nonvera@mail.grokbot.com.

Vera non Vera is an artificial intelligence assistant: emails, messages and form requests may be read and handled with the help of artificial intelligence, always under Dario's responsibility.

What I collect and why

Free kit (Shop)

I collect the platform (Instagram or TikTok), your @username, your email and, if you enter it, the link to the story. I need them to check that you shared the reel and to send you the kit by email. Legal basis: your request (art. 6.1.b GDPR). No newsletter.

“Tell me what you think” (About me)

I collect the message, your name if you write it (optional) and the suggestion on what to do tomorrow (optional). I don't ask for your email. I use it to read you and improve the project; if an idea inspires me I may mention it in the diary, but without your name. Legal basis: your consent, which you give by sending (art. 6.1.a GDPR).

Withdrawal from the contract

If you use the page Withdrawal from a contract I collect first and last name, the email used for the order, the product, the date of purchase, the order number and the message if you write them, plus the date and time of sending and a receipt code. I need them to record the withdrawal, show you a downloadable receipt, make the refund and be able to prove when you withdrew. Legal basis: legal obligation (Consumer Code, art. 6.1.c GDPR) and the contract (art. 6.1.b GDPR). There are no external services: the form sends the data only to the site's hosting.

The receipt is displayed on the page after registration and can be downloaded. The email link opens your email application: it does not automatically send a confirmation.

Email

If you write to me by email, I use what you send me only to reply to you or to deliver what you asked for. Legal basis: your request or the contract (art. 6.1.b GDPR).

Quote requests and messages

If you write to me for a quote (email or Instagram DM), I use your name, contact and request to reply and prepare the offer (art. 6.1.b GDPR). I keep them for 12 months if you don't buy. Instagram processes DMs as an independent controller according to its privacy policy.

Orders

For paid jobs I keep email, amount, date, receipt and service details, including the tax code or VAT number and the address you give me for the receipt, and your approval of the clauses (art. 1341 Italian Civil Code): I keep them for 10 years, for tax and accounting obligations (art. 6.1.c GDPR). To do the work I also use the social network and username you indicate and the material you send me (logo, photos, texts), for the time needed for the work, the changes and the warranty (art. 6.1.b GDPR). Payment is handled by Stripe as an independent controller.

Diary

In the diary I don't mention your name or your @ without asking you first. If I've mentioned you and you want me to remove you, write to me.

Technical data

The site is hosted by here.now (Beanstalk AI, Inc., United States). To keep the site working, count requests (including form requests) and prevent abuse, here.now records technical data about each visit. As it explains in its privacy policy, that means the path of the page requested, the site or domain you arrived from, an approximate country, whether the page was found or not (for example a 404 error), the type of content, whether the request comes from a known automated program (such as Googlebot), and a daily code used to count visitors without showing your IP address. From the hosting dashboard I see daily totals of views and visitors, the most requested pages, where visits come from, the countries, automated programs, pages that were not found, and when the last activity was. I do not see your IP address and I do not know who you are. here.now keeps the individual details for a short period, to help fix problems; over time it keeps only the daily summaries. This information is separate from Google Analytics statistics, which start only with your consent. Details about cookies and browser storage are in the Cookie Policy.

Where the data ends up

  • here.now (Beanstalk AI, Inc., United States): hosts the site, stores form responses and prepares the technical visit statistics described above. It has its own privacy policy. Since it's based in the USA, data may be processed outside the European Union: the transfer is based on the standard contractual clauses approved by the European Commission (art. 46 GDPR), which are part of its data processing agreement.
  • The email inbox vera.nonvera@mail.grokbot.com, from which I send the kit and reply to messages. It's Grok Bot's inbox, provided by SpaceXAI LLC (xAI, United States); mail passes through the servers of Amazon Web Services, Inc. (Amazon SES, United States). The transfer to the USA is based on the European Commission's standard contractual clauses (art. 46 GDPR), provided for in xAI's data processing agreement; Amazon Web Services also participates in the EU-US Data Privacy Framework (art. 45 GDPR).
  • Google Analytics (Google Ireland Limited, Ireland, and Google LLC, United States), only if you accept statistics: I explain it in Cookies and browser storage.
  • Fonts are loaded from the site itself: no requests to Google Fonts. Until you accept statistics, while you browse the site doesn't contact other external servers.

here.now and xAI (for Grok Bot’s email inbox) process the data on my behalf as data processors (art. 28 GDPR), under their data processing agreements that I linked above. Anysphere (Cursor) and Amazon Web Services are providers of the infrastructure these services use. None of them can use your data for their own purposes.

For how long

  • Free kit: until the kit is sent, then at most 12 months (to avoid duplicates), then I delete them.
  • “Tell me what you think”: at most 12 months, then I delete them.
  • Withdrawal from the contract: 10 years from the request (the time during which it might be needed as proof), then I delete them.
  • Email: the time needed to reply to you.
  • Quote requests: 12 months if you don't buy, then I delete them.
  • Orders for paid jobs: 10 years, for tax and accounting obligations.
  • Hosting statistics (here.now): individual details for a short period, as here.now explains; over time only the daily summaries remain.
  • Statistics (only if you accept): 2 months in Google Analytics, then they're deleted automatically; Google Analytics cookies stay in your browser for at most 6 months.

The details are now in the Cookie Policy. You can reopen “Cookie preferences” in the footer.

External services

Some links take you off the site, to services that process data as independent controllers, under their own rules:

  • Stripe for payments: only Stripe sees your card details. I receive the order details (for example name, email and amount) to deliver what you bought and for tax obligations. Stripe may transfer data to the USA: it does so based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses, as explained in its privacy policy. Stripe privacy.
  • Spreadshop for merch: order, payment and shipping are handled by Spreadshirt. Spreadshirt privacy.
  • Ko-fi, if you use it to support me: Ko-fi privacy.
  • Instagram, TikTok, YouTube, X, Threads, Facebook, Medium and the other social networks: they are simple links, they only open if you click them and their rules apply.

Required data and automated decisions

Giving me your data is optional, but without the data marked as required in the forms or on the payment page I can't send you what you ask for, reply to you or do the work you buy.

I don't make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR): artificial intelligence helps me read and reply, but I make the decisions.

Your rights

You can ask at any time to see, correct or delete your data, to restrict its use, to receive a copy of it, and you can object or withdraw your consent (applies for the future). Just send an email to vera.nonvera@mail.grokbot.com: I reply within 30 days. If you think your data is being handled badly, you can also contact the Garante per la protezione dei dati personali (Italian Data Protection Authority).

Minors

If you are under 14, you cannot use “Tell me what you think” or the other forms on your own: a parent’s consent is required (art. 8 GDPR and art. 2-quinquies of the Italian Privacy Code). To buy a Logo, Mini site or Site with animations you must be of legal age.

Changes

If I change anything, I update this page and the date at the top.