Privacy Policy

Version 1.3 — September 2026

1. Data controller

The controller of personal data is Luigi Casini, an individual, domiciled at Località Tregozzano 45, 52100 Arezzo (AR), Italy. For anything relating to privacy: privacy@delfi-memory.com.

2. What data we collect

Delfi collects and processes the following personal data:

Access data — email address (for sign-in by link or code), the public part of a passkey if you register one, IP address (in security logs).
User profile — the name you want to be called, language, the country you live in (used to work out the time of your reminders and, for those using the features dedicated to the markets, to show instruments that can be bought from their country), the tone you prefer to be accompanied with, investor profile if filled in.
Content entered by the user — projects, notes, documents and uploaded files and, for those with the features dedicated to the markets enabled, portfolios, positions, sentinels and predictions. They are entered voluntarily by the user.
Conversations with Pizia — messages exchanged with the AI assistant, including text content and any attachments.
API keys — if you configure your own keys with the model providers, we store them encrypted and use them only for your requests.
Notification channels — if you connect Telegram, the identifier of the chat to send messages to; if you turn on browser notifications, the subscription address your browser gives us.
What you tell us about yourself — Delfi is not only about money: you can talk about how you are, about work, about the people around you, about a life choice. What you write may therefore include information the Regulation calls special categories (Art. 9 GDPR): for example your health, including mental health, your relationships, or your beliefs. We do not ask for this and you do not need it to use Delfi: it ends up here only if you choose to tell us, and we process it on the basis of your explicit consent (see section 3).
Usage data — anonymous browsing statistics collected through Umami (cookie-less analytics, no personally identifiable data).
Invitation requests — if you ask to be invited before having an account, we keep the email address you leave us, any message you write and your browser language, so we can reply. This is the only data we process about people who are not yet registered.

3. Purposes and legal basis

Data is processed for the following purposes:

Providing the service (legal basis: performance of a contract, Art. 6.1.b GDPR) — authentication, operation of the AI assistant, keeping conversations, projects, notes and documents, the notifications you chose to receive.
The service's automatic features (legal basis: performance of a contract, Art. 6.1.b GDPR) — besides answering when you write, Delfi carries out automatic processing on your content to run the features you use, such as reminders, alerts and Pizia's memory. This processing too may go through a model provider.
Coaching (legal basis: performance of a contract, Art. 6.1.b GDPR, and for special categories the explicit consent of the next point) — Delfi automatically analyses your messages to adapt the way Pizia stands beside you. The analysis does not, on its own, produce decisions about you.
Quality control of the answers (legal basis: legitimate interest, Art. 6.1.f GDPR) — Pizia's answers may be reviewed automatically, in a form that does not directly identify you, to check that they stay within the limits of the service and in particular that they do not become personalised recommendations on financial instruments. The review may take place at a provider based outside the European Union. You can object to this processing by writing to privacy@delfi-memory.com.
Improving the service (legal basis: legitimate interest, Art. 6.1.f GDPR) — aggregated, anonymous analysis of platform usage.
Handling invitation requests (legal basis: pre-contractual measures at the request of the data subject, Art. 6.1.b GDPR) — assessing the request and sending the invitation. The request starts with you: if you don't send it, we know nothing about you.
Notice when the beta opens (legal basis: consent, Art. 6.1.a GDPR) — if you ask for it by ticking the box, we write to you when the beta opens, and for nothing else. You can withdraw your consent at any time by writing to info@delfi-memory.com: your address is deleted.
Standing beside you on personal matters (legal basis: explicit consent, Art. 9.2.a GDPR) — when you talk to Pizia about yourself, about how you are or about your life choices, what you tell her is processed in order to answer you and to remember it in later conversations, which is the reason Delfi exists. You give this consent by accepting the Terms on first access; it is optional and you may withdraw it at any time: you are never required to share anything personal, and you can erase Pizia's memory or your whole account as described in section 7. Withdrawal does not affect processing carried out before it.

Delfi does not train its own artificial intelligence models, does not sell user data, and does not pass it to third parties for marketing or commercial profiling. On what the language model providers do with it, see section 4.

4. Recipients of the data

Users' personal data is not passed to advertisers, financial intermediaries, issuers or anyone who would process it for commercial purposes. It is received only by the parties needed to run the service, in the following categories:

Language model providers, and the services that route requests to them — they receive the content each piece of processing needs: for an answer, the conversation and the context needed to answer; for the automatic processing of point 3, the content it concerns (see below).
Web search services — when Pizia looks something up outside Delfi, they receive the text of the search, not your profile or the conversation.
Market data providers — they receive only the symbols of the instruments requested, with no data that identifies you.
Email service — it receives your email address and the text of the messages we send you (sign-in links and codes, confirmations of irreversible actions, service communications).
Telegram, if you connect it — it receives the messages you chose to receive, in order to deliver them.
Telegram, for alerts to the operator — when you report a problem to Pizia, or when one of your questions triggers a security check on the memory, the operator of the service receives an alert on his Telegram with your username and the sentence concerned: it is how he can answer you and promptly correct a check that got it wrong. Telegram stores the data of European users in the Netherlands.
Browser notification services, if you turn on notifications — the content travels encrypted and the service cannot read it.
Whoever receives a link you shared — if you create a public link to a conversation, whoever opens it reads it in full. You decide, and you can switch it off whenever you like.
Infrastructure providers on which the service runs and through which email passes, processing data on our behalf.

The providers we use change over time — some are added, some are dropped. That is why we do not list them on this page, where a list would go stale without you noticing: the up-to-date list of the providers your data may be sent to is available at any time, by writing to privacy@delfi-memory.com from your account's address. We reply with the names.

When you configure your own API keys, data goes to the provider you chose. In no case does a provider receive the whole archive of your data.

Use of content by providers. The terms that apply depend on the provider and on the plan under which each answer is served. Several providers reserve the right to use the content they receive — prompts and responses — to develop and improve their own models and services, and in some cases provide that such content may be reviewed by their staff. These terms are set by each provider, can change over time, and Delfi is not in a position to guarantee or alter them. The paid plans of most providers exclude the use of content for training: by configuring your own API keys you choose the provider and the plan, and therefore the terms that apply to your content.

Beyond the categories listed above, no third party has access to users' personal data.

5. International transfers

Some providers are based outside the European Union — in the United States and in other third countries. Where the European Commission has adopted an adequacy decision, the transfer takes place on that basis; otherwise we rely on the standard contractual clauses adopted by the European Commission and on the safeguards offered by each provider.

We would rather tell you than stay quiet: some of those countries have no adequacy decision from the European Commission, and for them contractual clauses have recognised limits — no private contract can bind the authorities of a foreign state.

For this reason at first sign-in we ask for your explicit consent, naming the transfer, before you tick the box: this is the condition set out in Art. 49(1)(a) GDPR, and your acceptance is recorded with the date and the version of the documents you read. You can withdraw that consent at any time by writing to privacy@delfi-memory.com from your account's address. Withdrawal cannot undo transfers that already happened; from the moment we record it — and we confirm it by email — none of your content is sent to a model provider any more: the conversation with Pizia stops, on the site and from external connectors, and so does all the automatic processing described in point 3. The rest of Delfi — portfolios, notes, projects, watchtowers — keeps working, and you can restore the consent whenever you like, at the same address.

Finally, there is a route that does not go through us at all: by configuring your own API keys and choosing a provider based in the Union, your conversations follow the path you chose.

6. Data retention

Account data is kept until you delete it.
On account deletion, the data that identifies you — username, email, display name — is removed immediately, and your username becomes available again. A technical record remains for 30 days which no longer contains data capable of identifying you, and which exists so that a deletion made by mistake can be undone; after that term, it too is erased.
Of your conversations we keep the 100 most recent for each user: older ones are removed automatically and permanently deleted after 30 days, together with their messages.
Files you move to the bin stay there for 30 days, during which you can recover them; then they are permanently deleted. Files you delete permanently are gone at once.
Notes, memories, dreams, portfolios and positions, projects with their materials, watchlist items, the sources you follow and the chats you have stopped sharing: when you delete them they disappear from your view at once, and are permanently deleted after 30 days.
Predictions and watchtowers are the exception: once deleted they disappear from your view, but they are kept for the record that measures the reliability of sources and your recurring patterns, until the account is deleted. A source with recorded predictions is kept for the same reason.
Security logs (IP, sign-ins) are kept for a maximum of 90 days.
The technical records of how the assistant works are kept for a maximum of 14 days for the part containing the text of requests, and 90 days for numeric data only (times, durations, outcomes). When the account is deleted, the part containing text is removed at once, and the numeric data that remains is no longer linked to you.
Invitation requests are kept for a maximum of 12 months from when we receive them, then automatically deleted. If you open an account in the meantime, the request data is no longer needed and is deleted sooner.

7. Your rights

Under the GDPR, you have the right to:

Access — to know what data we hold about you. You can ask Pizia "what do you remember about me?" at any time.
Rectification — to correct inaccurate data through Settings or through your conversation with Pizia.
Erasure — to delete Pizia's data (start over) or your entire account, from Settings. As these are irreversible operations, a second confirmation is asked: your password, or a code sent to your email address if you sign in by link.
Portability — to receive a copy of your data in a machine-readable format, to take elsewhere. You request it by writing to privacy@delfi-memory.com from your account's address: we prepare it and send it within thirty days, free of charge. There is not yet a button that generates it by itself, and we would rather tell you than let you find out.
Objection — to object to processing based on legitimate interest.
Complaint — to lodge a complaint with the competent supervisory authority (in Italy, the Garante per la protezione dei dati personali — garanteprivacy.it).

To exercise your rights, write to privacy@delfi-memory.com.

7.1 One single limit on the right to erasure

The rules of use provide for account suspension in the cases described there. While a suspension is in progress, deletion of your data and of your account is temporarily suspended: the data under review is retained as evidence, under Art. 17(3)(e) GDPR, which allows a deletion request not to be acted upon where processing is necessary for the establishment, exercise or defence of legal claims.

This limitation is not open-ended: it operates for a maximum of 30 days from the opening of the review, after which deletion becomes available again even if the review is still in progress. During suspension the rest of the platform keeps working, and the interface tells you the date on which the limitation ends. If you believe the suspension is wrong, you can contest it by writing to privacy@delfi-memory.com; your right to complain to the supervisory authority remains unaffected.

8. Cookies and tracking

Delfi does not use profiling cookies. Authentication uses a JWT stored in the browser (localStorage). Usage statistics are collected through Umami, a self-hosted analytics system that uses no cookies and collects no personally identifiable data.

9. Disclaimer

Delfi does not provide financial advice and is not authorised to provide it. What Pizia returns is for information only and is not investment advice tailored to your situation. The same holds for the other fields you can discuss inside Delfi — legal, tax, insurance, property, pension or health matters: they are not advice and do not replace a qualified professional. You are solely responsible for your own decisions. The full perimeter is in the Legal notice.

10. Market data — sources and attribution

Some market and macroeconomic data shown in the platform comes from external sources whose terms require attribution. We give it here, valid across all of Delfi:

This product uses the FRED® API but is not endorsed or certified by the Federal Reserve Bank of St. Louis.
Powered by CoinGecko — cryptocurrency data.
Source: U.S. Energy Information Administration — energy data.
Source: European Central Bank — euro area yields and exchange rates. The data may be processed further by Delfi.

11. Changes to this policy

This policy may be updated from time to time. The current version will always be available on this page. Where changes are substantial, users will be informed through the platform.