Privacy Policy

The data controller is OSIAX S.R.L., Viale Villa Gavotti 81/2, 16155 Genoa (GE), Italy, VAT and tax code 03095520999, REA GE-532713 (“OSIAX”, “we”, “us”).

You can contact us at info@hellodelia.com or by PEC at osiax.srl@buffettipec.it. No Data Protection Officer (DPO) has been appointed: every privacy request goes to these addresses.

The user connects their own LinkedIn, X and Instagram accounts through the Delia Chrome extension, which runs in the user’s own browser. Delia finds prospects that match the user’s offer, reads their public profiles and posts, likes, follows and comments, sends messages and replies on the user’s behalf, and books meetings through Calendly or Cal.com links. The user approves the plan and can take over any conversation at any time.

Delia never asks for social network passwords. It works through the sessions the user is already signed in to in Chrome, and uses the related data only to carry out the actions the user has authorized.

• Account data: name, email address, password (stored only as a hash), billing data handled through Stripe, language and timezone.
• Business information: the user’s website, offer and target customers, and the chat between the user and Delia.
• Prospect data: public profile data (name, username, headline or bio, location, company, public posts), messages exchanged, engagement actions (likes, follows, comments) and the AI assessment of how well the prospect fits the user’s offer.
• Connected-account data: the data from the user’s LinkedIn, X and Instagram accounts that is needed to run the actions the user authorizes.
• Technical data: logs, IP address, device and browser information. For cookies, see our Cookie Policy.

Account data is required to create an account and use the Service; without it we cannot provide the Service.

We process personal data on the following legal bases (Article 6 GDPR):

• Contract (Art. 6(1)(b)): creating and managing the account, providing the Service, running the actions the user approves, processing payments and sending service emails.
• Legitimate interest (Art. 6(1)(f)): security of the Service, fraud and abuse prevention, improvement of the Service, and business-to-business communications.
• Consent (Art. 6(1)(a)): analytics and advertising cookies and marketing emails. Consent can be withdrawn at any time, without affecting processing carried out before withdrawal.
• Legal obligation (Art. 6(1)(c)): tax and accounting obligations.

When a user runs outreach with Delia, the user is the data controller for that outreach and OSIAX acts as data processor, processing prospect data on the user’s behalf and on the user’s instructions. The user is responsible for having a lawful basis for contacting prospects (typically legitimate interest in business-to-business outreach) and for honouring objections.

Prospect data comes from public profiles and posts on LinkedIn, X and Instagram and from the conversations the prospect has with the user. The AI fit assessment is used to choose which prospects to contact and how; the user approves the plan, and the assessment does not produce legal effects on the prospect.

OSIAX may also use aggregated, de-identified data to improve the Service.

If you have been contacted through Delia and want to object or have your data deleted, write to info@hellodelia.com. Delia stops contacting anyone who asks.

To write messages, analyse profiles and conversations, and answer the user in chat, the relevant data is sent to AI models provided by OpenAI and Anthropic. Their API terms state that data sent through the API is not used to train their models.

We do not sell personal data. We share it only with the providers below, each limited to what it needs to perform its function:

• Hetzner Online GmbH: hosting, with servers in the EU (Germany and Finland).
• OpenAI, Anthropic: AI models used to generate messages, analyses and answers.
• Stripe: payment processing. Card details are handled by Stripe and are not stored on our servers.
• Resend: transactional email.
• Google: Google Analytics and Google Ads, only with consent.
• LinkedIn: LinkedIn Insight Tag, only with consent.
• Calendly, Cal.com: meeting booking, only if the user connects them.

Actions on LinkedIn, X and Instagram are carried out through the user’s own accounts, and those platforms process data under their own privacy policies. We may also disclose data where required by law or by a valid request from a public authority, and, in the event of a merger, acquisition or sale of assets, as part of that transaction.

Some providers are based in the United States. These transfers rely on the EU-US Data Privacy Framework where the provider is certified and/or on the Standard Contractual Clauses approved by the European Commission.

• Account data: for the life of the account and up to 30 days after it is deleted; backups are kept for up to 30 days.
• Billing records: 10 years, as required by Italian law.
• Prospect data and conversations: while the account is active, or until the user deletes them or disconnects the related account.
• Logs: up to 12 months.

Data is transmitted over encrypted HTTPS connections, passwords are stored as hashes, session data from social platforms is protected and used only to run authorized actions, and access to data is limited to authorized personnel. No transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security.

Under Articles 15 to 22 GDPR you have the right to:

• access your personal data and receive a copy;
• have inaccurate or incomplete data rectified;
• have your data erased;
• restrict processing;
• receive your data in a portable format (portability);
• object to processing based on legitimate interest, including business-to-business outreach;
• withdraw consent at any time, where processing is based on consent.

To exercise these rights, write to info@hellodelia.com or by PEC at osiax.srl@buffettipec.it. Prospects whose data is processed on behalf of a user may also contact that user directly. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Analytics and advertising cookies are used only with consent. Details and the option to change your choice are in our Cookie Policy.

The Service is intended for business and professional use by people aged 18 or over. We do not knowingly collect data from minors; if you believe this has happened, contact us and we will delete the data.

We may update this policy. The current version is always on this page with its “Last updated” date, and we will inform users of significant changes by email or in the app. Use of the Service is also governed by our Terms of Service.

• Email: info@hellodelia.com
• PEC: osiax.srl@buffettipec.it
• Registered office: OSIAX S.R.L., Viale Villa Gavotti 81/2, 16155 Genoa (GE), Italy