Privacy Policy
Version of 22 October 2026 · Notice provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003.
1. Data controller and contacts
FISIT S.r.l., registered office Via Renato Molinari 2, 64100 Teramo (TE) — VAT no. IT02602500221 · REA TE-201604 · Share capital 50.000 € fully paid up.
Email: [email protected] · Certified email (PEC): [email protected].
Cryterio is a service provided by FISIT S.r.l.. No data protection officer has been appointed; any matter concerning personal data is handled at the addresses above.
2. What data we process and where it comes from
We process only the data needed to run the service. We receive it from you, or it is generated technically while you use the service.
- Browsing data (all visitors): IP address, date and time of the request, page requested, browser and device type. It ends up in the technical logs of the server and of the traffic-protection provider (Cloudflare).
- Account data (registered users): email address, password — stored exclusively as a cryptographic hash, never in clear text —, interface language, registration date.
- Billing data (subscribers or bank-transfer payers): name or company name, VAT number or tax code, SDI recipient code or PEC for electronic invoicing, address, phone, news outlet if provided.
- Payment data: plan and subscription status, technical identifiers of the order and subscription at Revolut, date and amount of charges. Card data neither passes through nor is stored by our systems: the payment page belongs to Revolut.
- Requests and reports (contact forms, invite requests, reporting an event or an error): what you write in the form, the email address to reply to, any outlet or organisation.
- API keys (Verdict API customers): key identifier and request counts, to enforce quotas.
Broadcast content. The live events we verify are public broadcasts: parliamentary sittings, press conferences, debates. Transcripts and extracted statements concern declarations made publicly by people exercising public functions or political activity. They are not personal data of the service's users; insofar as they contain third-party data, we process it for information and public-interest purposes (Art. 6(1)(f) and Art. 85 GDPR; Articles 136 et seq. of Legislative Decree 196/2003). Verdicts always assess the data cited, never the person.
3. Purposes, legal bases and retention periods
Every processing activity has a specific purpose, a legal basis and an end date. We do no marketing, we do not profile users and we do not transfer data to third parties for commercial purposes.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Serving the site, live events and public archives; keeping them secure and available | Browsing | Legitimate interest (Art. 6(1)(f)): running and protecting the service | Server logs: automatic size-based rotation, typically a few weeks. Cloudflare logs: per its retention rules. |
| Registration, login and account management | Account | Performance of a contract (Art. 6(1)(b)) | For the life of the account; on closure, deletion or anonymisation, subject to the legal obligations below. |
| Subscriptions, payments and invoicing | Billing, payment | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c): tax law) | Tax documents: 10 years (Art. 2220 Italian Civil Code). Everything else for the duration of the relationship. |
| Answering requests, invites and reports | Requests | Pre-contractual measures (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) | As long as needed to handle the request and document its outcome. |
| Service communications: confirmations, subscription, payment and security notices | Account | Contract (Art. 6(1)(b)) | For the life of the account. |
| Aggregate site-usage statistics | Analytics cookies | Consent (Art. 6(1)(a)), withdrawable at any time | See the Cookie Policy. |
| Backups | All service data | Legitimate interest (Art. 6(1)(f)): continuity and recovery | 7 days; encrypted before any transfer off the server. |
| Diagnosing and fixing technical errors | Technical data about the error (page, browser, error message); for signed-in users, only the numeric account identifier. Never IP addresses, cookies, passwords or form contents. | Legitimate interest (Art. 6.1.f): keeping the service working | 30 days, on a system we operate on servers in the European Union (GlitchTip). |
| Compliance with legal obligations, requests from authorities, defence of legal claims | Whatever is relevant | Legal obligation (Art. 6(1)(c)) / legitimate interest (Art. 6(1)(f)) | For the periods set by law. |
4. Who we share data with
Data is processed by authorised staff of FISIT S.r.l. and, for specific activities, by providers acting as processors under Art. 28 GDPR on the basis of written agreements.
| Provider | Activity | Location | Data involved |
|---|---|---|---|
| IONOS SE | Server and infrastructure hosting | Germany (EU) | All service data |
| Cloudflare, Inc. | Content delivery network, attack protection, DNS | United States, with EU data centres | Browsing data |
| Revolut | Payment collection and recurring subscription management | Lithuania (EU) | Payment and billing data |
| Anthropic, PBC | Language models for extracting and verifying statements | United States | Transcribed text of public broadcasts and, for professional customers, of the field sessions and files they choose to have checked; no account data |
| ActiveCampaign, LLC (Postmark) | Sending service emails | United States | Email address and message content |
| Google (Google Ireland Ltd / Google LLC) | Google Analytics (cookies only with consent; without consent, cookieless measurement: see the Cookie Policy); Google Drive for backups, encrypted before upload | EU / United States | Aggregate statistics; encrypted backups |
| Google (YouTube) | Playback of live events, on public pages and in the reserved area, through the embedded player (youtube-nocookie.com domain) | United States | Browsing data, per Google's privacy policy |
Data may also be disclosed to accounting and legal advisers bound by confidentiality, and to authorities where the law requires it. We do not sell or transfer data to third parties.
5. Transfers outside the European Union
Some providers are based in the United States. Transfers rely on the standard contractual clauses adopted by the European Commission (Art. 46 GDPR) and, for providers that participate in it, on the EU-US Data Privacy Framework, with supplementary measures: encryption in transit and, for backups, encryption before upload. We send language models only transcribed text (public broadcasts and, for professional customers, the sessions and files they choose to have checked): no account or billing data leaves the Union for this purpose.
6. Automated decisions and profiling
Verdicts are produced by an automated system and concern statements made in public: they do not concern the service's users and have no legal effect on them. We do not profile users and take no automated decisions within the meaning of Art. 22 GDPR.
7. Security
Encrypted connections (TLS) across the whole site; passwords stored only as hashes; session cookie with HttpOnly, Secure and SameSite attributes; system access restricted to authorised staff; encrypted off-site backups. In the event of a data breach posing a risk to your rights, we will notify you within the terms of Art. 34 GDPR.
8. Minors
The service is aimed at professionals and adults. The reserved area is not intended for children under 16 and we do not knowingly collect their data.
9. Your rights
At any time you may exercise the rights set out in Articles 15-22 GDPR:
- access to the data concerning you and a copy of it;
- rectification of inaccurate data and completion of incomplete data;
- erasure, in the cases provided for by Art. 17;
- restriction of processing;
- portability of the data you provided, in a structured, machine-readable format;
- objection to processing based on legitimate interest;
- withdrawal of consent, for processing that relies on it, without affecting the lawfulness of processing already carried out.
Write to [email protected] or to the certified address [email protected]. We reply within one month, extendable by two months in complex cases (Art. 12 GDPR); requests are free of charge unless manifestly unfounded or excessive. If you believe the processing infringes the law, you may lodge a complaint with the Garante per la protezione dei dati personali (Italy) or with the supervisory authority of the Member State where you live.
10. Changes to this notice
This notice may be updated to reflect changes in the service or in the law. The version in force is always published at this address with its update date; in the event of substantial changes we will inform registered users by email or with a notice in the reserved area.