Privacy Policy.

1. Joint controllers and scope

Nicolò Barone, Riccardo Marabeti, and Christian Vigliarolo jointly determine the purposes and means of processing personal data through this website under the Aureon Law brand and are its joint controllers. Nicolò Barone is the website operator. These roles do not identify ownership of a company or the provider under a future service agreement. Aureon Law is a product brand; the planned U.S. LLC has not yet been formed.

Aureon is currently a precommercial presentation managed from Italy. This notice covers browsing, general business correspondence, the optional business inquiry form, synthetic demonstrations and the optional website AI assistant. It does not govern a separately contracted medical-record processing service. This website provides no customer account, payment, file-upload or patient-record submission endpoint.

The controllers jointly decide the purposes, essential means and retention criteria for website processing. Nicolò Barone coordinates privacy requests, with the other controllers’ cooperation. You may exercise your privacy rights against any of them using the email and correspondence address below, without selecting a particular controller. Information about their allocation of responsibilities is available through the same contact channel.

2. Browsing and synthetic demonstrations

Vercel Inc. hosts and delivers this site. The current hosting account is reported as Vercel Pro. Requests can involve your IP address, browser and device details, requested URL, timestamp and technical or security events. These data support delivery, troubleshooting and abuse prevention. Do not put personal or confidential information in a page URL.

Fonts and demonstration assets are served from this website. The Product workspace uses fictional records and guided illustrative responses. No real patient records are currently submitted to or processed by this website or its demonstrations. Search terms, review changes and sample interactions stay in temporary page memory and reset on reload; this application does not save them to an Aureon database. Website examples do not concern real patients and do not determine anyone’s legal or medical outcome.

The authored site has no advertising tracker or analytics integration. Its Cookie Policy explains browser state and platform security technologies.

3. Email inquiries and the business form

Contact links open a Gmail compose window addressed to admin@aureoncorporation.com with a relevant subject filled in. Opening the link contacts Google, but does not send a message or forward an AI conversation. You review and send the message in Gmail; signing in may be required. The optional business inquiry form sends the first name, last name, work email, law firm, optional role and estimated medical chronologies per month that you enter to our business mailbox. It has no free-text message, file upload or medical-record field. We use these details to respond to the business inquiry and manage the resulting correspondence.

Provide only the professional contact details needed for your inquiry. Do not enter medical records, patient details, passwords, identity documents or confidential case material. Form submissions are validated and forwarded as email; this website does not maintain an Aureon inquiry database or marketing list. The business mailbox uses Google Workspace Business Starter, as confirmed by the operator. Google processes mailbox content and technical information under the applicable Workspace service and data-processing terms. The account-specific retention configuration, individual access and transfer safeguards still require verification; contact the joint controllers for those details before sending personal information beyond what is necessary for a general inquiry. A business inquiry does not enroll you in unrelated marketing.

4. Optional website AI assistant

“Ask Aureon” is an AI product guide, not a person. It generates answers using a snapshot of Aureon Law’s public website information. It is separate from the deterministic guided demonstration inside the Product workspace. It has no access to private project files, customer accounts, medical records, internal repositories or company conversations. It cannot browse an arbitrary URL or perform an action for you.

When you send a question or choose a suggested question, your text, a limited amount of recent conversation and public website context are sent to this website’s server, through Vercel AI Gateway, and to OpenAI for an answer. Opening the panel alone does not submit text to the AI provider. The hosting platform also handles technical request information. Use general product questions or fictional examples only.

The conversation remains in browser memory across client navigation and is removed from that memory by reload or “Clear conversation.” This application does not store chat transcripts in an Aureon database or deliberately include message content in its application logs. Rate limits use temporary pseudonymous IP-derived keys in server memory. Obvious credential patterns and certain sensitive identifiers are rejected before model processing, but this filter cannot identify all confidential or personal information.

Requests restrict the model provider to OpenAI, request no prompt training through AI Gateway, and set OpenAI response storage to false. These settings do not establish zero retention across all systems. Provider security, abuse-prevention and operational records are separate from browser chat state. Clearing the conversation does not request deletion of provider records.

Vercel describes its gateway’s prompt handling in its AI Gateway data policies. OpenAI describes API processing and possible abuse-monitoring retention in its API data controls. No site-wide zero-retention, U.S.-only processing or HIPAA assurance is made. Provider policy is not a substitute for verification of the arrangements applicable to this account.

The assistant can be wrong or incomplete. Check its source links. It does not provide individualized legal or medical advice, make binding offers, accept orders, book meetings, send emails or forward your conversation to the team. You may use the public pages and contact details without using AI.

5. Purposes and legal bases

Where the GDPR applies, our legitimate interests under Article 6(1)(f) are delivering and securing the website, answering professional inquiries and providing the optional product explanation you request. These interests do not authorize unrelated advertising or patient-data processing. Where you personally request steps before a contract, Article 6(1)(b) may instead apply to those steps. Compliance with a specific legal duty relies on Article 6(1)(c).

Sending a question is your choice to request that response; it is not consent to every future use of your data. You may stop using the assistant or object to processing based on legitimate interests. Optional tracking or marketing that requires consent will need a separate choice before it begins.

6. Recipients and international processing

Recipients can include the joint controllers and people authorized to handle inquiries, Vercel for hosting, security and AI Gateway, OpenAI for submitted AI questions, Google Workspace for our business mailbox, your own email provider, and authorities where a disclosure is required by law. A link to Google Maps or Instagram opens that service only when you follow it; those services apply their own policies.

Hosting and AI processing can involve the United States and other countries outside the EEA. This site does not offer a European-only or U.S.-only location guarantee. Vercel publishes a Data Processing Addendum describing provider obligations and transfer mechanisms for covered accounts. Applicable processor agreements, account eligibility, subprocessors and any required transfer assessment must be verified for the actual service; publication of a provider’s terms alone does not prove that every arrangement is in place. Contact the joint controllers for the safeguards applicable to your information and how to obtain a copy.

7. Retention and deletion

Browser demonstration and chat state lasts until reload, clearing or closure of the page. Inquiry form fields remain in browser memory until navigation or reset and are sent only after you submit. Pseudonymous anti-abuse rate-limit entries expire after fifteen minutes and are cleaned on subsequent requests or server shutdown; an idle or suspended instance may keep expired entries until then. They are not a persistent visitor history. This application does not maintain a chat-transcript or inquiry database.

Email correspondence, including a form submission delivered to the business mailbox, is retained according to whether the inquiry is still active, whether a resulting business relationship requires the correspondence, and whether a specific legal obligation or dispute requires preservation. Unneeded information should be removed rather than retained indefinitely. Hosting and AI provider records follow the applicable service settings and contractual security or abuse-prevention requirements; this notice does not assert an account-specific deletion period that has not been verified. Contact the joint controllers for the schedule applicable to your inquiry or a deletion request. Backups, legal holds and provider records may have different deletion timing.

8. Your rights and how to use them

Where applicable, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting prior lawful processing. Legal conditions and exceptions apply. This site does not make decisions producing legal or similarly significant effects about you through automated processing.

Send a request to the contact below, describing the relevant interaction and right. Do not send an identity document by ordinary email; if proportionate verification is needed, an appropriate method must be arranged. Under the GDPR, requests are generally answered without undue delay and within one month, subject to lawful extensions explained within that period. A request is normally free; lawful exceptions apply to manifestly unfounded or excessive requests.

You may complain to your competent supervisory authority, including the Italian Garante per la protezione dei dati personali, and exercise other remedies available under applicable law. Nothing here limits mandatory privacy rights.

9. Providing information and changes

You do not have to send an email or use AI to browse the public information. Technical request data are necessary for site delivery; without the question text, the assistant cannot generate the requested answer. The service is intended for professional evaluation, not for children or patient submissions.

We review this notice when actual processing, providers or features change. The revision date above identifies this version. New forms, tracking, sensitive-record processing or commercial services require their own appropriate disclosures, controls and agreements before activation.

Contact

For website inquiries, contact Nicolò Barone. For privacy requests, contact any of the joint controllers identified in the Privacy Policy. Both use admin@aureoncorporation.com (opens Gmail in a new tab) and the correspondence address: Piazza San Carlo 206, Turin, Italy (opens Google Maps in a new tab). Do not send medical records, patient information, identity documents, or confidential case details through this general contact channel. To report a security concern, describe the affected page and issue without including credentials or other people’s data. This is a reporting channel, not authorization to test systems.