Privacy Notice

The data controller is EMT Aerospace Technologies S.r.l., a company incorporated under the laws of Italy, with registered office at Via Ragazzi del '99, 43 — 25065 Lumezzane (BS), Italy, VAT and tax code 04772590982, registered with the Brescia Register of Companies under REA BS-640314, share capital €10,000.00 fully paid up, certified email emtaerospacetechnologies@pec.it, contactable at emtantares@emtaerospacetechnologies.com or, for formal notices, at emtaerospacetechnologies@pec.it. EMT has not appointed a Data Protection Officer, having assessed that the conditions of Article 37 GDPR are not met; this assessment is reviewed as the service grows.

This notice applies to the web application, the Android and iOS applications, ANTARES Work on your computer and the remote execution service.

• Account and identity data: name, email address, password in hashed form, date of birth, language and preferences, the versions of the legal documents you accepted and when, sessions and paired devices.
• The content you submit: prompts, conversations, uploaded files, technical sources for CAD, code and project descriptions, voice recordings and transcripts when you use Voice, images and video you generate.
• Usage and billing data: models invoked, credits consumed, plan, subscription status and the payment identifiers we receive from our payment providers. We never receive your full card number.
• Technical and security data: IP address, device and browser type, timestamps, security and audit logs, rate-limiting counters and moderation decisions.
• Communications: messages you send to support, and reports or appeals you submit.

We process account, content, usage and billing data to perform the contract between you and us, under Article 6(1)(b) GDPR: without it we cannot create your account, answer your requests, account for your credits or invoice you.

We process technical and security data on the basis of our legitimate interest, under Article 6(1)(f), in keeping the service secure, preventing fraud and abuse, enforcing limits and diagnosing failures; we have assessed that this does not override your rights, and you may object at any time. We process certain data to comply with legal obligations under Article 6(1)(c), in particular accounting and tax records and obligations concerning illegal content.

We rely on your consent, under Article 6(1)(a), for non-essential cookies and similar technologies, for advertising and rewarded advertising on the Free plan, and for any use of your content to improve or train models. Consent is optional, granular and may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. We do not train models on your content unless you have given that specific consent.

To generate a response, ANTARES transmits the content of your request to the artificial intelligence provider that you or the automatic router selected. Those providers process the content to produce the response and, depending on the provider, act as our processors or as independent controllers. The identity of the provider serving a request is shown in the interface wherever we are able to show it.

We also use infrastructure and service providers: cloud hosting and a managed database in the European Union, object storage, transactional email, rate limiting, payment processing and error monitoring. An up-to-date list of sub-processors, with their role and location, is published on the ANTARES website and updated before any material change.

Requests addressed to ANTARES reach our servers through the network of Cloudflare, Inc. (101 Townsend Street, San Francisco, California 94107, United States), which acts as our processor. Cloudflare terminates the TLS connection, so while a request is in transit it sees it in clear: the IP address of your device, the address requested, the headers and the cookies, and the body of the request and of the response, which contain the content you submit and the content generated for you. We use it to filter hostile traffic, to absorb denial-of-service attacks and to serve static resources; under our contract Cloudflare processes those data only to provide that service to us, on our instructions, and not for purposes of its own. Its logs record the metadata of a request — time, address requested, IP address, response code and volume — and not its content, and its own documentation states that they remain retrievable for a period of days, at present between three and seven. Cloudflare operates a worldwide network and terminates the connection at the data centre closest to the person making the request, which may be outside the European Economic Area.

The ANTARES administration console is additionally protected by Cloudflare Access, which verifies the identity of the administrator before a request reaches our servers. That verification concerns the administrator's own email address, IP address and the time and outcome of the sign-in; it does not concern the accounts of users of the service and it gives Cloudflare no access to your data beyond what is described above. Cloudflare retains those authentication events for the period stated in its own documentation.

Some providers process data outside the European Economic Area. In that case the transfer takes place on the basis of an adequacy decision or of the European Commission's standard contractual clauses, accompanied by a transfer impact assessment and, where necessary, supplementary technical measures. Cloudflare, Inc. is established in the United States: it declares that it is certified under the EU-U.S. Data Privacy Framework and that its data processing addendum incorporates the standard contractual clauses in any event, and we rely on the European Commission's adequacy decision of 10 July 2023 for the transfers that certification covers and on those clauses for the remainder. Where a plan or a setting offers processing confined to the European Union, that setting governs which models may be invoked.

Account data is kept for as long as the account exists and, after closure, for the periods required by law, in particular ten years for accounting records. Conversations, files and generated media are kept until you delete them or until the retention period chosen in your settings expires. Security and audit logs are kept for a limited period proportionate to their purpose and in any event no longer than twelve months, save where an investigation requires otherwise. Backups are overwritten on their own cycle and deletion propagates to them within that cycle.

You may request access to your data, its rectification or erasure, the restriction of processing and its portability in a structured, commonly used, machine-readable format; you may object to processing based on legitimate interest; and you may withdraw a consent at any time. Export and deletion are available directly from your account settings, and requests may also be sent to emtantares@emtaerospacetechnologies.com.

We reply without undue delay and within one month, extendable by two further months for complex requests, in which case we tell you. If you believe your rights have been infringed you may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the authority of your country of residence.

ANTARES may be used from the age of 14. Where the law of your country sets a higher age for consent to information society services, registration below that age requires the verifiable consent of a parent or legal guardian; the relevant age is shown during registration. We ask for your date of birth for this purpose only and we do not use it for profiling.

For accounts belonging to users under 18, advertising based on profiling is not served, safety filters are set to their strictest level and content restricted to adults is blocked. A parent or legal guardian may exercise the rights described above on behalf of a minor by contacting emtantares@emtaerospacetechnologies.com and demonstrating their capacity.

We protect data with encryption in transit and at rest, segregation of duties between the application and database accounts, restricted administrative access with multi-factor authentication, logging that excludes the content of prompts and outputs, and periodic review. No measure is absolute: we notify you and the supervisory authority of a personal data breach where the law so requires.

ANTARES applies automated checks to detect content that is unlawful or contrary to the Acceptable Use Policy, and these can result in a request being refused or an account being restricted. You may ask for a human review of such a decision and contest it through the procedure described in the Acceptable Use Policy. Where you interact with an artificial intelligence system ANTARES tells you so, and identifies generated images and video as such. We inform you in advance of material changes to this notice.