Data Protection & Privacy

Privacy Policy

Data Controller: Goowai Edit (VAT ID IT02918700838) • Contact Person: Salvatore Fidacaro • Last Updated: October 5, 2026

✓ GDPR (EU) 2016/679 ✓ AI Act (EU) 2024/1689 ✓ Privacy by Design ✓ Zero Profiling Cookies

This policy explains how Goowai Edit processes personal data in connection with the BrainMix.ai service and the websites www.brainmix.ai and www.goowaiedit.com, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”). It also outlines how artificial intelligence systems are utilized in compliance with Regulation (EU) 2024/1689 (“AI Act”).

1. Data Controller and Contact Details

The Data Controller is Goowai Edit, based in Sant'Agata di Militello (ME), Italy, VAT ID IT02918700838 (hereinafter “Goowai Edit”, “we”, “our”). Contact person: Salvatore Fidacaro.

Contact: Certified Email (PEC) goowai@pec.it, Email help@goowai.info.

A Data Protection Officer (DPO) has not been appointed as the legal prerequisites under the GDPR do not mandate one. For any questions or data requests, please reach out via the provided contact email.

2. Roles: Controller and Data Processor

Goowai Edit acts as an independent data controller for personal data of users accessing BrainMix.ai (account credentials, access records, direct communications) and website browsing information.

For data imported from third-party advertising, e-commerce, and marketing accounts connected to BrainMix.ai by the customer (e.g. Meta Ads, Google Ads, Shopify, Klaviyo), the customer acts as the data controller and Goowai Edit acts as a Data Processor pursuant to Article 28 GDPR, processing data solely to deliver the service in accordance with the customer's instructions under a Data Processing Agreement (DPA) available upon request.

3. Categories of Data Processed

Account Information: username, password (stored exclusively in hashed, encrypted form), assigned role, permissions, project allocations, language preference, timestamps of logins and feature usage (including AI token consumption per user and project).
Technical Data: IP address and connection logs, processed strictly for platform security, fraud prevention, and rate-limiting unauthorized access attempts.
Connected Platform Data: advertising and sales performance metrics (ad spend, clicks, conversions, order count, transaction volume, taxes), web store traffic, product catalog data, active campaigns, ad creatives, audience definitions, and attribution insights. Customer orders are imported stripped of names, physical addresses, personal emails, or telephone numbers of individual consumers.
Lead Feed Inquiries: date, landing page, source channel, and ad click identifiers; customer names, private emails, and phone numbers are not imported.
Public Comments under Ads & Social Posts: we read and analyze strictly the text of the comment. We never store author names, profile links, or identifiers: tagged users are pseudonymized as «@user», and brand account responses are excluded. Comments are never linked to personal identities or customer profiles.
User-Submitted Content: operational instructions (prompts), notes, reference images, screenshots, generated copy, and creative outputs.
Communications: messages, inquiries, and support requests sent to our team.

We do not intentionally collect or process special categories of personal data (Article 9 GDPR) or criminal conviction data. Users are requested not to input such data into BrainMix.ai.

4. Purposes and Legal Bases for Processing

Service Provision & Account Management: contract performance or pre-contractual measures (Article 6(1)(b) GDPR).
Platform Security, Fraud Prevention & Diagnostic Analytics: legitimate interest of Goowai Edit (Article 6(1)(f) GDPR), balanced with the fundamental rights of data subjects.
Legal, Tax, and Regulatory Compliance: legal obligations (Article 6(1)(c) GDPR) and defense of legal claims.
Service Announcements & Direct Communications: explicit consent (Article 6(1)(a) GDPR) or legitimate interest for existing business clients regarding similar software services.

5. Artificial Intelligence (EU AI Act Compliance)

BrainMix.ai uses external third-party artificial intelligence foundation models to process aggregated project data and generate analytical outputs: operational prescriptions, market benchmarking, comment sentiment categorization, ad copy variations, and creative concepts.

Transparency (Art. 50 AI Act): AI-generated outputs are clearly designated as such within the interface and generated exports. Users are responsible for labeling generated ad creative and copy as AI-generated where applicable by law or advertising platform policy.
No Automated Decisions with Legal Effects: the AI does not make automated decisions that produce legal or similarly significant effects on individuals (Article 22 GDPR). Outputs serve exclusively as decision-support insights for human marketers.
No Biometric or Social Profiling: no biometric identification, emotion recognition, or social scoring (prohibited practices under Article 5 AI Act) is conducted.
System Classification: BrainMix.ai is an analytical marketing tool and is not classified as a High-Risk AI system under Annex III of the EU AI Act.
AI Literacy (Art. 4 AI Act): Goowai Edit fosters internal AI competence and reminds users to recognize the probabilistic nature, limitations, and potential inaccuracies of AI models.

Zero Model Training on Your Data: Goowai Edit does not use customer proprietary data or ad store metrics to train public machine learning models. Third-party AI providers process data under strict data protection terms prohibiting model training. AI outputs are probabilistic computations and must always undergo human verification.

6. Data Recipients

Personal data is accessible solely to authorized Goowai Edit personnel bound by confidentiality agreements, and may be processed by:

cloud hosting, server infrastructure, and database providers;
enterprise AI API providers (large language and image generation models);
market research and search intelligence providers;
advertising and e-commerce platforms connected directly by the user (Meta, Google, Shopify, Klaviyo);
legal counsel, accountants, and public authorities where required by mandatory law.

We do not sell, rent, or trade personal data to third parties or data brokers.

7. International Data Transfers

Certain technical service providers may process data outside the European Economic Area (EEA), including in the United States. In such instances, data transfers take place in compliance with Chapter V of the GDPR: adequacy decisions (including the EU-US Data Privacy Framework), Standard Contractual Clauses (SCCs), and supplementary technical measures where appropriate.

8. Meta Platform Data & API Disclosures

Data retrieved through Meta APIs and other platform integrations is used exclusively to provide BrainMix.ai software features to the authenticating user, strictly in accordance with Meta Platform Terms. Data is never sold, used for user advertising targeting, or transferred to data brokers.

Data Deletion Instructions: to request complete deletion of data retrieved from Meta or third-party APIs, email help@goowai.info from your registered account mentioning your project ID; we will acknowledge and permanently delete the data within 30 days. You can also revoke access anytime in your platform settings (e.g., Meta Business Settings → System Users & Connected Apps).

9. Data Retention

Account Information: retained for the duration of the subscription, and thereafter for the period required by statutory accounting and limitation periods.
Imported Platform Data & Generated Content: retained for active project life; securely erased or anonymized upon service termination, typically within 90 days.
Technical Security Logs: retained strictly as necessary for security auditing and diagnostic purposes.

10. Security Measures

We implement state-of-the-art technical and organizational measures (Article 32 GDPR) including hashed passwords, expiring tokens, role-based access control, encrypted TLS/HTTPS transport, credential secrecy, and vendor due diligence. In the event of a personal data breach, notices will be filed in accordance with Articles 33 and 34 GDPR.

11. Cookies and Tracking Technologies

BrainMix.ai utilizes strictly necessary technical storage (such as browser localStorage to preserve user session tokens and UI preferences). No third-party advertising or profiling cookies are deployed; hence, no intrusive cookie banner is required under the ePrivacy Directive and GDPR.

12. Your Data Subject Rights

Under Articles 15–22 GDPR, you retain the right to: access your personal data, request rectification or erasure, restrict processing, obtain data portability, object to processing based on legitimate interest, withdraw consent without affecting past processing, and request human intervention regarding automated outputs.

To exercise your rights, email help@goowai.info or our PEC goowai@pec.it. You also hold the right to lodge a complaint with your local EU Data Protection Authority or the Italian Garante (www.garanteprivacy.it).

13. Changes to this Policy

We may amend this Privacy Policy periodically to reflect product updates or legal developments. The current version will always be published on this URL with the updated revision date.

Last Updated: October 5, 2026 Goowai Edit (Data Controller)