Privacy policy

The data controller is DEVHOOK S.R.L., with registered office at Via Andrea Dell'Isola 12, 06083 Bastia Umbra (PG), Italy, tax code and VAT number 04018180549.

You can reach us at info@devhook.it, by certified email at devhook@pec.it, or by post at the address above. We have not appointed a Data Protection Officer, as the law does not require one for a company of our size and activity; privacy requests are handled directly by the founders.

This notice covers the website devhook.it and the ways you can contact us through it: browsing, booking a call, writing or calling us, using the AI assistant, and sending a job application. It does not cover the software we build for clients, which is governed by the contract with each client, nor the DevCore product, which will have its own notice when it is released.

The site is hosted on a server rented from Hostinger International Ltd. (Lithuania), located in Frankfurt, Germany. When you visit a page, the hosting infrastructure receives the technical data any web server receives: your IP address, the page requested, date and time, browser and operating system, the referring page. This data is used only to deliver the pages, keep the service secure and diagnose faults.

• Legal basis: our legitimate interest in running a secure, working website (Article 6(1)(f) GDPR).
• Retention: technical logs are kept for the time strictly needed for security and diagnostics and in any case not beyond 30 days, unless an incident requires them to be kept longer.
• Visits are counted by Umami, an open-source counter on our own server in Frankfurt: it sets no cookies, stores no identifier of you and records pages seen, referrer, country and device type in aggregate, which under the Garante's guidelines of 10 June 2021 needs no consent; your choice in the cookie banner is counted the same way, as a number. Only for visitors who chose "Accept all", Google Analytics (Google Ireland Limited) runs as well: it sets its own cookies and records pages seen, referrer, country, device and an anonymised IP address. We use no advertising or profiling tools. See the Cookie policy.

When you book a call through the calendar on the site, we process the data you enter to schedule and hold the call: your name, email address, company, the time you chose, and anything you write in the notes. The call itself takes place on Google Meet, provided by Google Ireland Limited, and is not recorded unless we agree it with you at the start.

• Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• Retention: 24 months from our last exchange, so that we can pick the conversation up where it was left; longer only if a contract follows, for the duration of the contract and the legal retention periods that apply to it.
• The booking is managed through a scheduling service that acts as our processor under a data processing agreement.

If you write to one of our email addresses or call one of the numbers on the site, we process the data you give us and the content of the exchange to answer you and to follow up. Email is handled by our email provider as our processor.

• Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR), or our legitimate interest in answering enquiries (Article 6(1)(f)).
• Retention: 24 months from our last exchange, longer only where a contract follows or the law requires it.

The assistant in the bottom right corner answers questions about Devhook. It is not a person. The messages you type, together with the previous turns of the same conversation, are sent to Anthropic PBC, which generates the reply through its Claude models, acting as our processor under its commercial terms.

We do not ask you for personal data in the assistant and we do not store the conversation on our servers: it lives in your browser tab and is gone when you close it. Anthropic keeps API inputs and outputs only for the limited period and the abuse-prevention purposes set out in its commercial terms, and does not use them to train its models.

Please do not type confidential information, personal data of other people, or special categories of data (health, financial details, and the like) into the assistant. For anything sensitive, write to us or book a call.

• Legal basis: our legitimate interest in offering a first answer on the site (Article 6(1)(f) GDPR); by using the assistant you accept that your messages are processed this way.
• Retention on our side: none. On Anthropic's side: as set out in its commercial terms.

If you apply for a role or send an open application by email, we process the data in your message and any attachment (CV, portfolio, links) to evaluate the application and to contact you about it.

• Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). Any special categories of data you choose to include are processed on the basis of your explicit consent, given by sending them.
• Retention: 12 months from receipt, so that we can consider you for later openings, then deleted. You can ask us to delete your application at any time.

Personal data is handled by the founders and, where needed, by team members bound by confidentiality. It is shared with the service providers we use to run the site and the channels above, each acting as our processor under Article 28 GDPR:

• Hostinger International Ltd. (Lithuania): the server the site runs on, located in Frankfurt, Germany.
• Google Ireland Limited (Ireland): Google Analytics, only after "Accept all" in the cookie banner; data may be transferred to the United States under the EU-U.S. Data Privacy Framework.
• Anthropic PBC (United States): generation of the AI assistant's replies.
• Google Ireland Limited (Ireland): video calls on Google Meet, and email.
• The scheduling service used for the booking calendar.

We do not sell personal data and we do not share it with anyone for their own marketing. Data may be disclosed to authorities where the law requires it.

Some of the providers above are established in the United States. Transfers to them take place on the basis of the provider's certification under the EU-U.S. Data Privacy Framework where it holds one, and otherwise on the basis of the Standard Contractual Clauses adopted by the European Commission, with the supplementary measures those providers apply. You can ask us for details of the safeguards in place for a specific transfer.

Under Articles 15 to 22 GDPR you have the right to obtain access to your personal data, to have it rectified or erased, to obtain the restriction of processing, to receive the data you gave us in a portable format, and to object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of what was done before.

To exercise any of these rights, write to info@devhook.it or to devhook@pec.it. We answer within one month, extendable by two further months in complex cases, as the GDPR allows.

If you believe your data is processed in breach of the law, you have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the Member State where you live or work.

The site and its services are addressed to companies and professionals, not to children. We do not knowingly collect data from anyone under 14. If you believe a child has sent us data, write to us and we will delete it.

We update this notice when the site or the way we handle data changes, for example when the booking calendar or the DevCore product go live. The date at the top tells you when it was last revised. Significant changes are announced on this page.