Privacy policy

Privacy policy

The rest of this page is the full notice required by Articles 13 and 14 of the GDPR. This policy covers the mobile apps, the web app at app.movitaly.ai and the website. If you are a professional offering services on the platform, also read the privacy notice for professionals.

1. Who is responsible

The controller is Lodato Solutions LLC, a company registered in Delaware, USA, with its registered address at To be confirmed. It operates the service "MovItaly".

Because we are outside the EU but offer the service to people in the EU, we have named a representative in the EU under Article 27 GDPR: To be confirmed, To be confirmed, To be confirmed. You can contact the representative as well as us, and so can the authorities.

Data protection officer: To be confirmed.

For every privacy request, use To be confirmed. For security problems see our security page.

2. What data we collect, and where it comes from

Most data comes from you. Some is created by using the service, and a little comes from other sources, which we name.

• Account: email, password hash, sign-in provider (Google or Apple if you use them), language, optional two-factor secret, date of birth (to apply the age rules), and for 14 to 17 year olds a guardian's email.
• Profile and journey answers: name, nationality, country of origin, your plans in Italy and your answers to guided journeys.
• Goals, checklists and reminders: the goals you pick, your tasks, notes and dates, the reminder settings you choose, and your notification preferences.
• Documents: files you upload to your vault (for example a passport or a permit) and the text read from them by OCR.
• Messages: chat with professionals, forum posts, reports you send, and your questions to Movito.
• Movito: your conversations, the optional memory facts you allow, and, if you use voice, a short audio clip that is turned into text and then discarded.
• Bookings, purchases and points: which professional, date and status; subscriptions, single guides and assistant day passes; your points ledger. We never see or store your card number. Payment status and receipts come from Stripe, Apple or Google.
• Device and technical data: app version, device type, language, IP address in server logs, push token, error reports. No advertising identifier is read.
• Support mail: what you send us and our replies.
• From other sources: payment status from Stripe, Apple, Google and RevenueCat; and publicly available web pages and official sources that we read to prepare immigration news and guides. These pages are about rules and events, not about you.

3. Why we use your data, and on what legal basis

Where we say consent, you give it separately from the Terms of Use, it is never pre-ticked, and you can withdraw it at any time. Withdrawing does not make earlier processing unlawful.

Purpose	Data	Legal basis (GDPR Art. 6, Art. 9)
Create and secure your account, keep you signed in	Account data, tokens, IP in logs	Contract (6.1.b); security as legitimate interest (6.1.f)
Guides and journeys for your situation	Profile, journey answers	Contract (6.1.b)
Subscriptions, single guides, assistant day pass	Payment status, platform, order records	Contract (6.1.b)
Setting your subscription price tier, by country (never by nationality or passport)	On the web, your card's issuing country (from Stripe); in the apps, your App Store or Google Play account country (through RevenueCat); the residence you declared in onboarding or your profile, so that anyone living in the EU/EEA pays the EU price. Kept as the price tier on your subscription	Contract (6.1.b)
Receipts, invoices and tax records	Billing and booking data	Legal obligation (6.1.c)
Bookings and payment to professionals	Booking and payment data, messages in the booking	Contract (6.1.b)
Goals, checklists, document vault when they reveal asylum, health, origin or other special categories	Goal answers, documents, OCR text	Your explicit consent (6.1.a and 9.2.a), asked before the first sensitive use
Publishing your success story (name you choose, country, city, goal, your text, optional photo) on our website and/or in the app, only after our review	The story and photo you submit, your choice of where it appears	Your consent (6.1.a), separate from the Terms, never pre-ticked, withdrawable at any time. Adults only. VERIFY with counsel
Movito conversations, including psychological and emotional support	Your messages, recent context	Your explicit consent (6.1.a and 9.2.a), asked at first use
Movito memory (remembering facts between chats)	Up to 50 short facts you allow	Your consent (6.1.a and 9.2.a), off until you turn it on
Voice (speaking to Movito, hearing answers)	Audio clip, discarded after it is turned into text	Your consent (6.1.a), asked before first voice use
Calendar sync	Booking and reminder dates in a private calendar link	Your choice when you create the link (6.1.a); you can switch it off
Sending you a free guide by email, with a confirmation step (no account needed).	Your email address, language, a hashed IP address, the time and version of your consent	Your consent (6.1.a), given by ticking a box and confirming by a link in an email; withdrawable at any time with the unsubscribe link, which erases the address
Monthly live Q&A in the app: your sign-up for a session, the session reminders, and any question you choose to send in advance (read by a moderator, never shown publicly).	Your account, the session you signed up for, the text of your questions	Contract (6.1.b): a feature you ask for
Monthly live Q&A: email reminders before each session, with a confirmation step (no account needed).	Your email address, language, a hashed IP address, the time and version of your consent and a fingerprint of the exact consent text you saw	Your consent (6.1.a), given by ticking a box and confirming by a link in an email; withdrawable at any time with the unsubscribe link in every email, which erases the address
Copilot actions (search, book, set a goal, set a reminder)	The request, the proposed action, an audit record	Contract (6.1.b) for what you ask; every change waits for your confirmation
Professional recommendations and ranking	Your search, chosen language, city, goals if personalisation is on	Contract (6.1.b); personalised ordering on legitimate interest (6.1.f), which you can switch off
Reminders and service messages (receipts, deadlines, security)	Email, push token, dates	Contract (6.1.b); legitimate interest (6.1.f)
Push notifications	Push token, notification choices	The permission you give in your device settings, and your choices in the app
Marketing emails and offers	Email, your marketing choice	Your consent (6.1.a), separate box, never ticked for you
App usage analytics	Fixed list of events, account id for adults	Your consent (6.1.a and Art. 122 Codice Privacy) through the cookie and analytics choice
Website visit counter and page speed	Page path, referrer site, speed figures; nothing stored on your device	Legitimate interest (6.1.f); technical, see section 7
Service metrics (subscriptions, points, funnel counts)	Server-side events, account id	Legitimate interest (6.1.f) in running and improving the service
Points programme and fraud checks	Points ledger, device and referral signals	Contract (6.1.b); fraud prevention as legitimate interest (6.1.f), see section 8
Chat, forum, reports and moderation	Messages, reports, moderation records	Contract (6.1.b); safe use as legitimate interest (6.1.f); legal obligation under the Digital Services Act (6.1.c)
Immigration news	Public web pages and official sources	Legitimate interest (6.1.f); no data about you is used
Internal alerts to our team (Slack)	Technical alerts without personal data	Legitimate interest (6.1.f)
Guardian consent records for 14 to 17 year olds	Consent ledger, guardian email	Legal obligation and proof of consent (6.1.c, 6.1.f)
Defending legal claims	Records needed for the claim	Legitimate interest (6.1.f)

You can object at any time to processing based on legitimate interest (section 12).

4. Special category data and your explicit consent

Some of what you write to Movito, put in a goal or upload can reveal asylum or protection status, origin, health, religion or other sensitive facts. Identity documents are not special category data by themselves, but we treat them with the same care.

We process this data only with your explicit consent (Article 9.2.a). We ask for it in a separate screen the first time it is needed, and again if the purpose changes. You can withdraw it in the app at any time. When you withdraw, we stop that processing and delete the related documents and memory. Without consent you can still use the rest of the service, only without that feature.

Pages about international protection and asylum are free and are not tracked: no analytics events are sent from them. Our document checks are assisted by software and always reviewed by a person before a result is final. The impact assessments are kept in our records.

5. Movito, voice, memory and copilot actions

Movito is an AI. It is not a person and it does not give legal advice. It offers general information and emotional support, not therapy or diagnosis. The AI notice explains this in full.

• Movito runs on language models that we run ourselves on our servers in the EU. There is no third-party AI processor for Movito, and your conversations are not used to train any model.
• Conversations are deleted automatically after 90 days, or sooner if you delete your account or ask us.
• Memory is off until you turn it on. You can see, delete a single fact or delete all of it.
• Voice: the audio is turned into text and spoken answers are generated on our servers. The audio is not stored.
• Copilot: when you ask Movito to do something (search for or book a professional, create a goal, set a reminder), it proposes the action and waits. Nothing is written until you confirm. We keep a record of the proposal and your answer for 12 months, so that you and we can check what happened.

6. Recommendations and ranking of professionals

When you search for a professional, results are ordered by how well they fit your search. The main signals are the specialty you need, languages spoken, place, and quality signals such as verified credentials, response time and genuine reviews. If you leave personalisation on, we also use your chosen language, city and active goal to improve the fit. Your search text is read to find these filters and is not stored. We never use nationality, ethnicity, religion, health or similar traits to rank, and users aged 14 to 17 get non-personalised results.

Paid placements are always labelled "Sponsored", never take the first position and never change the organic order. You can switch personalisation off in the results header or in settings. Because you choose whom to contact, this ordering has no legal or similarly significant effect on you, so Article 22 GDPR does not apply. The ranking page explains the logic in more detail.

Impression and click records used to measure quality are pseudonymised after 90 days and deleted after 13 months.

7. Analytics, cookies and similar technologies

We checked our code to say exactly which kind of measurement we use.

• Website visit counter. A small script on the public website sends one page view (page path, referring site name, campaign tag if present) and, when you leave the page, three speed figures (LCP, INP, CLS). It sets no cookie, writes nothing to your device, uses no identifier and is not sent at all if your browser sends Do Not Track or Global Privacy Control. It is not loaded on protection and safety pages. Because it works without storing or reading anything on your device, is first-party and is used only for statistics, we treat it as technical and it runs without a banner choice. Like every web server, ours receives your IP address when the page loads; the event itself does not store it.
• App and web app usage analytics. Events from a fixed list (such as opening a screen or starting a checklist) are sent only after you accept analytics in the banner or settings. They never contain free text, document content, chat content or location. Reject is as easy as accept, and your Global Privacy Control signal counts as a rejection. Users aged 14 to 17 are not tracked for behaviour.
• Server-side business metrics (for example that a subscription started or points were earned) are recorded by our server and are counted without your device taking part.

We use no Google Analytics, Meta pixel, advertising network or advertising identifier, and we share no analytics data with third parties. Raw events are kept for 13 months and then deleted; aggregated figures that cannot identify you may be kept longer. The full list of what is stored on your device is in the cookie policy.

8. Points, single purchases and abuse checks

We keep a ledger of the points you earn and spend, and orders for single unlocks and day passes (item, price, date, payment reference). We use it to run the programme under contract (Art. 6.1.b). To prevent fraud we check for patterns such as many accounts sharing the same device signals and unusually high referral points. This rests on our legitimate interest in fraud prevention (Art. 6.1.f). The check only flags an account; a person decides, and we contact you and allow 14 days to contest before points are removed. Accounts of users under 18 are left out of this check. Fraud-check records are kept 12 months. If you delete your account it is anonymised at once, so your points and unlocks no longer point to you, and we keep orders without your identity for the 10-year accounting period.

9. Who receives your data

We use service providers (processors) under data processing agreements. They act on our instructions. The current list, with what each does and where, is on the sub-processors page. In short: Amazon Web Services and MongoDB Atlas host the service in the EU; Stripe, Apple, Google and RevenueCat handle payments and store purchases; Brevo sends email; Expo, Google and Apple deliver push messages; Cloudflare Turnstile checks that a sign-up comes from a human; Sentry receives error reports.

• Stripe is also an independent controller for payment, fraud and identity-verification checks it runs under its own privacy notice. Apple and Google are independent controllers for store accounts and sign-in.
• Professionals you contact or book see what the contact or booking needs (your name, message, requested date), not your documents or profile.
• Authorities, courts and advisers receive data when the law requires it or to defend a claim, under confidentiality.
• Our internal team alerts in Slack are designed to carry no personal data. Messages you send to our support team may be relayed to an internal support channel.
• We do not sell your data and we do not share it for advertising.

10. Transfers outside the EU

Your data is stored in the EU. Some providers (for example Stripe, RevenueCat, Expo, Slack, Apple and Google) or their staff may reach data from the United States, and our own staff at Lodato Solutions LLC in the US can reach EU data for support and operations. For these transfers we rely on the EU-US Data Privacy Framework where the provider is certified, and on the Standard Contractual Clauses adopted by the European Commission otherwise, with additional measures where needed. [OWNER: confirm the basis for each provider and, if the DPF is relied on for our own transfers, the LLC's certification.] You can ask for a copy of the safeguards at To be confirmed.

11. How long we keep data

Data	Retention
Account and profile	Anonymised immediately when you delete the account
Verified documents	730 days after verification, or sooner on your request
Unverified documents	Deleted after 30 days
Movito conversations and copilot runs	Deleted automatically after 90 days
Free guide requests	Unconfirmed requests are deleted after 7 days. Confirmed ones are kept until you unsubscribe, which erases the address; a record of the consent is kept as proof (COUNSEL REVIEW: proof retention period)
Live Q&A email reminders	Unconfirmed sign-ups are deleted after 7 days. Confirmed ones are kept until you unsubscribe, which erases the address; a record of the consent is kept as proof (COUNSEL REVIEW: proof retention period). Session sign-ups and questions sent from the app are deleted with your account (OWNER: approve)
Copilot audit record	12 months
Usage events	13 months, then deleted
Login sessions (refresh tokens)	7 days
Notifications	90 days
Success story and its photo	Until you withdraw consent (deleted at once) or delete your account; a story we reject is deleted after 90 days (VERIFY)
Document and admin audit logs	7 years
Bookings, invoices, store orders	10 years, as Italian tax and accounting rules require; store orders are pseudonymised when you delete your account
Points fraud-check records	12 months
Subscription price tier and the country it was set from	For the life of the subscription
Backups	Daily backups roll off after 35 days, monthly backups after 365 days; deletions are re-applied on any restore

The complete table, including periods still awaiting owner approval, is on the retention page.

12. Your rights, and how to complain

You have the right to access your data, correct it, have it erased, receive it in a portable format, restrict or object to processing, and withdraw consent at any time. You also have the right not to be subject to a decision based solely on automated processing with significant effects; we make none.

• In the app, open Data and privacy: "Export my data" downloads your data as a file, and "Delete account" closes your account. See account deletion.
• By email: write to To be confirmed. We may ask a simple question to confirm it is you. We answer within one month, and we tell you if a complex request needs more time.
• Objection: you can object to processing based on legitimate interest. For marketing, you can object at any time and it stops at once.

You may complain to the Italian data protection authority, the Garante per la protezione dei dati personali (www.gpdp.it), or to the authority where you live or work, without waiting for our answer.

13. Children and young people

You must be at least 14 to use MovItaly. Under 14 is blocked, and we keep no data from a sign-up that is turned away. At 14 to 17 a parent or guardian must agree by an emailed link before the account is active; see parental consent. Young users pay only through a guardian or the app stores, can chat with professionals only inside an approved booking, can read but not post in the forum, get Movito in a safer mode, see no Sponsored results and no personalised ranking, are hidden from presence features and are not tracked for behaviour. A guardian can ask us to delete the account at any time.

For 14 to 17 year olds: the short version

This part is for you. We wrote it in plain words, but the rest of the page applies to you too.

• We only collect what we need to make the app work for you. We do not use your data to show ads or to build a profile of you for advertising.
• Your parent or guardian has to agree when you sign up. If you pay for something, it goes through them or through the app store.
• You can talk to a professional only inside a booking that your guardian has approved. Nobody can see that you are online.
• Movito is an AI, not a person. If you feel unsafe or in danger, it will show you help numbers. In an emergency call 112.
• You can download your data or delete your account in the app. Your guardian can ask us to do it too.
• If something worries you, write to To be confirmed, or to To be confirmed for safety concerns. You are never in trouble for asking.

14. Automated decisions

We make no decision about you with legal or similarly significant effect by automated means. Matching you with professionals, Movito and the copilot give information and suggestions. A person confirms bookings and document results, and you confirm every action the copilot proposes. Our fraud checks on points only flag accounts for a person to review.

15. Security

Data is hosted in the EU and encrypted in transit and at rest. Uploaded documents sit in a private bucket encrypted with a key we manage. Access is limited by role and logged. Passwords are hashed and two-factor sign-in is available. No system is perfectly safe; if a breach puts you at risk we notify you and the authority as the law requires. To report a vulnerability, see the security page.

16. Changes and version history

We may update this policy. For important changes we tell you in the app or by email before they apply, and where the law requires it we ask you again. The version and effective date are at the top of this page. Earlier versions are available on request at To be confirmed. See also our terms and the cookie policy.