Privacy Policy

1. Who the controller is

The data controller is Gregorio Ciurleo, who runs Multiverbe. For any question about your data, and to exercise your rights, write to privacy@multiverbe.com.

We don't publish a postal address yet: we'll add it here once the business has its registered seat. Until then, email is the official channel.

We haven't appointed a data protection officer: for a business of our size, and for the data we handle, the law doesn't require one.

2. What this covers

This notice covers the multiverbe.com and multiverbe.ch website in every language: the pages, the «Let's talk» form, the calendar that opens after you send it, the site's cookies and other tools, and the emails you send to info@multiverbe.com or privacy@multiverbe.com.

It doesn't cover the Multiverbe app, which has its own notice, nor the websites we build for our clients: there, the client is the controller.

3. When you write to us through the «Let's talk» form

We ask for your first and last name, your email and how you'd like us to get back to you. Your phone number only if you choose a call or a meeting.

Everything else is optional: your business and your trade, whether you already have a website and its address, the address for a meeting, what weighs on you most, when you'd like to start, how you see the cost, how you heard about us and a free message.

Together with the request we record the language of the page, the page you're writing from and your browser and system type (the so-called user agent). We don't store your IP address: we only use it to limit submissions to three every ten minutes and stop automated programs, and it stays in the server's temporary memory without being written anywhere.

From your optional answers we calculate a priority that helps us decide in which order to call back. It excludes no one and decides nothing about you: a person always reads the request.

The request is saved in our database, on Supabase in Frankfurt, and from there it goes into Multiverbe's client manager, that is our own app, where we read it. We don't use it to send you newsletters.

If you've given «Marketing» consent, when you send the form the site may also pass your email and phone to Google as a hash, as explained in section 7.

4. If you book an appointment

If you chose a phone call, a video call or a meeting, after you send the form the page shows you the calendar to pick a time. The calendar belongs to our app, at multiverbe.app.

So you don't have to type it all again, the page passes it your name, email, phone, business, website, trade, what weighs on you most, your message, the way you want to be contacted, the page's language and your device's time zone, plus the campaign labels in the page address (utm_source and the like: they say which channel you came from, not who you are).

When you confirm, the app records the appointment and sends you the confirmation by email through Brevo.

5. Cookies and your choice

On your first visit the banner asks what you accept. There are two optional categories: «Analytics», for Google Analytics, Microsoft Clarity and Multiverbe's visit counter, and «Marketing», to measure our ads. You can accept them all, refuse them all, or pick them one by one with «Customise».

Until you give «Analytics» consent, the site doesn't connect to Google or to Microsoft, nor to our app's counter: none of their programs, none of their cookies, no signal sent. With «Marketing» alone, the site keeps the ad code in your browser, as explained in section 7, and loads no Google or Microsoft tool until we run campaigns. The necessary cookies always remain, without which the site doesn't work.

With «Analytics» consent the site loads Google Tag Manager, the Google program that starts Google Analytics and Microsoft Clarity, and Multiverbe's counter. When we run campaigns, with «Marketing» consent Google Tag Manager will also start the ad tools, and only with that consent.

We remember your choice in your browser, with the date and the version of this notice. Google and Microsoft only receive the state of your choice, yes or no per category, which their tools need to know what they're allowed to do.

You can change your mind whenever you like with the «Manage cookies» button, at the bottom of the site's pages and below: withdrawing consent is as easy as giving it. If you withdraw a consent you had given, the page reloads without the tools you refused and we delete their cookies from our domain.

6. Analytics: Google Analytics, Microsoft Clarity and Multiverbe's counter

Google Analytics 4 counts visits and measures how the site is used: pages viewed, where you came from, how far you scroll, clicks on links to other sites, when you start and when you send a form (not what you write), your country, approximate city and the type of device and browser.

Microsoft Clarity shows where people click, how far they scroll and where they get stuck, and can rebuild a visit like a screen recording. The «Let's talk» form is excluded: what you type there only appears in recordings as asterisks. We don't pass Microsoft the identifier Google Analytics recognises you by, and we don't allow Clarity to use advertising cookies: the link between the two tools and that permission are closed in the site's code.

The visit counter is the one from our own Multiverbe app, the same one we offer our clients: the mvb.js script, loaded from multiverbe.app. It counts page views (address, title and origin), records clicks as points on a map of the page, measures how fast the page loads and notes that a form was sent, without its content. It uses no cookies: it keeps a visit identifier in the tab's storage, which disappears when you close it. The data goes to our app, hosted by Vercel and Supabase, and the IP address isn't saved with it.

The site sends these tools some events that don't contain your name, email or phone: which step of the form you reached, that a request arrived with the trade and contact mode you chose, that you booked an appointment, that you tapped the WhatsApp button or the phone number. They stay tied to the cookie's identifier.

The two providers' privacy policies are at policies.google.com/privacy (Google) and privacy.microsoft.com (Microsoft).

Data about individual visits stays in Google Analytics for at most 14 months. Clarity keeps recordings for 30 days and aggregated data for up to 13 months, under Microsoft's rules. Events from Multiverbe's counter stay in our app for 25 months, then they are deleted.

7. Marketing: measuring our ads

With «Marketing» consent, if you arrive from an ad the site keeps in your browser the code the platform adds to the address (gclid, gbraid or wbraid for Google, fbclid for Meta), the campaign labels (utm) and the page and day you arrived. It keeps them for 90 days, and deletes them at once if you withdraw consent. If you write to us through the form, they travel with the request: that's how we know which ad brought you here. These codes are also part of the page address: with «Analytics» consent, like any address, Google Analytics, Clarity and Multiverbe's counter receive them too.

Also with «Marketing» consent, once your request has arrived the site may pass your email and phone to Google. Not in clear: your browser first turns them into a code (a SHA-256 hash) that doesn't show the address, but that Google matches against its own users' data to recognise, among the people who saw one of our ads, who then wrote to us. It is therefore still personal data. Google calls these enhanced conversions. The phone number is only sent if you typed it with the international prefix.

When we run campaigns on Google, the site tells Google Ads that a request has arrived, with no data identifying you beyond the hash above, and Google Ads may set its cookies to link the request to the ad. If the request then becomes a contract, we pass Google Ads only the click code, never your name.

Meta's code stays with us: it only tells us you came from an ad on Instagram or Facebook. There are no Meta tools on the site.

Today there are no active campaigns and there is no Google Ads tag on the site. This section already describes how it will work, so your choice also holds once they start.

8. Cookies and browser storage

Here is everything the site writes in your browser. Google and Microsoft cookies, and the Multiverbe counter's identifier, only appear with «Analytics» consent; Google Ads cookies, once we run campaigns, only with «Marketing» consent. Third-party durations are the ones we measured and the providers state; some browsers shorten them.

9. Providers

To run the site we rely on these providers. Vercel, Supabase, Brevo and Register.it process data only on our behalf and under our instructions. Google and Microsoft, besides doing so for us, may also use some data for their own purposes: for the collection of this data from our site we are joint controllers with them, and for what they do with it afterwards, for their own purposes, they are independent controllers, under their privacy policies. If you write to us on WhatsApp, the conversation is with us, through WhatsApp, and we keep it like emails; WhatsApp also processes the data as an independent controller, with your account.

The site is hosted by Vercel, and the functions that receive the form run in Frankfurt. Like any server, Vercel briefly logs the technical data of requests, IP address included, to keep the service secure and working.

10. On what grounds

• Replying to your request and booking the appointment: steps you ask for before a possible contract (Art. 6(1)(b) GDPR).
• Analytics and Marketing, including the email and phone passed to Google as a hash: your consent (Art. 6(1)(a) GDPR and, for what the site writes to or reads from your browser, Art. 122 of the Italian Privacy Code, which implements the ePrivacy Directive). You can withdraw it whenever you like.
• Necessary cookies, site security and the submission limit: our legitimate interest in running the site and protecting it from abuse (Art. 6(1)(f) GDPR). These cookies don't need consent.
• The priority of requests and the campaign labels passed to the calendar: our legitimate interest in organising call-backs and knowing which channel requests come from. You can object by writing to us.

In Switzerland, the Federal Act on Data Protection doesn't require a legal basis for each processing, but the same principles of transparency, proportionality and security: we follow them in the same way. For what the site writes to or reads from your browser, Art. 45c of the Federal Telecommunications Act also applies.

11. Data outside Europe and Switzerland

Google, Microsoft, Vercel and Supabase are companies based in the United States, and their groups can access data even when it is stored in Europe, like our database in Frankfurt. These transfers rely on the EU-US Data Privacy Framework and the Swiss-US one, for the companies that have joined them, and otherwise on the European Commission's standard contractual clauses, also recognised in Switzerland.

Brevo is based in France, Register.it in Italy and WhatsApp, for Europe, in Ireland. You can ask us for a copy of the safeguards for these transfers by writing to privacy@multiverbe.com.

12. How long

• Requests that don't become a contract: 24 months from the last contact, then we delete them, from the client manager too. The same goes for the emails and WhatsApp messages you send us.
• If you become a client, your data moves to the contract: the app's notice and the accounting retention obligations apply.
• The ad code: 90 days in your browser, or less if you withdraw «Marketing» consent.
• Your cookie choice: until you change it or clear the site's data from your browser.
• Currency: 30 days. Language: until you close the browser.
• Google Analytics: data about individual visits for at most 14 months. Clarity: recordings 30 days, aggregated data up to 13 months.
• Multiverbe's counter: 25 months in our app, then deleted.
• Vercel's technical logs: the short period set by the provider.

13. Your rights

You can ask us at any time to see the data we hold about you, to correct it, to delete it, to restrict its use and to receive it in a machine-readable format, and you can object to uses based on our legitimate interest. You withdraw consent whenever you like, without having to explain why, and it applies from that moment on.

Write to privacy@multiverbe.com. We reply within 30 days; if a request is complex and needs more time, we tell you within the same deadline, explaining why.

If you think we handle your data wrongly, you can turn to the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to the authority of the European country where you live or work. In Switzerland you can turn to the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch).

14. What is mandatory

No one obliges you to give us data. Without your name, email and contact preference we can't reply, and without a phone number we can't call you; everything else is optional. Refusing optional cookies takes nothing of the site away from you.

15. Minors

The site is meant for businesses and professionals. If a minor wrote to us without our knowing, write to us and we'll delete the request.