Muvia Free and your data

The data controller is Superduck S.r.l., the company that makes Muvia, with registered office at Piazza Maestri del Lavoro 7, 20063 Cernusco sul Naviglio (MI), VAT number IT13202240969, REA MI-2708766, share capital € 20.000,00 i.v.

For any question about your data, or to exercise your rights, write to the certified email (PEC) [email protected].

When you ask for Muvia Free:

• your business email, which you confirm through a link, and its domain;
• the consents you give: to this notice and, if you choose to, to product news by email;
• the language of the page you sign up from, which we write to you in;
• a code derived from your IP address with a hash function and a secret value: the IP address itself is not stored.

When you activate it:

• your first and last name and the name of your company;
• the password you choose, which we keep only in a form it cannot be recovered from.

While you use it:

• the data the node reads from your machine and sends to Muvia, with the node's technical information, such as its status and configuration;
• the dashboards, analyses and other content you create;
• the questions you ask Athena, Muvia's AI assistant, and the answers you get;
• usage events, such as sign-ins, the date of your last sign-in and the features you use.

Your email, the consent to this notice, your first and last name and your company's name are needed to activate Muvia Free: without them we cannot activate it. The consent to product news is optional.

PurposeProviding Muvia Free: confirming your email, creating your space with one node, 50 variables and 30 days of data, letting you sign in and writing to you about the service, such as activation and inactivity notices.

Legal basisPerformance of the contract you request by signing up (Art. 6(1)(b) GDPR).

PurposeKeeping only the spaces in use: noticing when nobody signs in and no data arrives from the node, so that we can warn you, make the space read-only and then delete it, as described below.

Legal basisPerformance of the contract (Art. 6(1)(b) GDPR) and legitimate interest in not keeping data nobody uses (Art. 6(1)(f) GDPR).

PurposeSecurity and abuse prevention: protecting the service, limiting repeated or automated requests, including with Google reCAPTCHA, and accepting business addresses only. We do not accept addresses of free or disposable email services, nor an address whose domain another company has verified for its own company sign-in (single sign-on), so that this sign-in cannot be bypassed.

Legal basisLegitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR).

PurposeSales contact: our sales team is notified when you activate Muvia Free, with your email, name and company, and sees sign-ups grouped by email domain, with their dates, latest activity and how many nodes and variables you use. This lets it know when several people from the same company use Muvia, and write to you to suggest a suitable plan.

Legal basisLegitimate interest in following up with Muvia Free users (Art. 6(1)(f) GDPR). You can object at any time, by replying to one of our messages or by writing to the PEC address.

PurposeProduct news and marketing communications, only if you accepted them in the form.

Legal basisConsent (Art. 6(1)(a) GDPR), optional and revocable at any time. Without it, Muvia Free works just the same.

The sign-up form uses Google reCAPTCHA, a Google service that receives technical data from your browser, including the IP address, to tell a person from an automated program. Google processes them under its own privacy policy.

• The confirmation link is valid for 24 hours. A sign-up you do not confirm is deleted 7 days after its link expires.
• Muvia Free stays active as long as you use it: every sign-in and every piece of data arriving from the node counts as activity. Of your machine data, the latest 30 days are kept: older data is deleted as it ages.
• After 60 days without activity we write to you. After 90 days the space becomes read-only and we write to you again. If activity does not resume, we delete it 30 days later, permanently: the node, the project with all the data that came from your machines, the dashboards, the analyses, the questions asked to Athena and your account. A single sign-in before the deletion brings everything back as it was.
• Backups follow their own rotation cycle: deleted data leaves them as the older copies are replaced.
• The service's security and usage logs (sign-ins, actions taken, use of the AI assistant) are not deleted with the space: they are kept for as long as the security of the service and checking its use require, then deleted.
• The sign-up record, meaning the email, domain, language, consents, the code derived from the IP and the dates, is kept for 12 months after the space is deleted, as the record of the sign-up. It is then anonymised: the email is replaced by a code derived with a hash function and a secret value, and only the dates and the consents remain. You can ask us to delete it sooner by writing to the PEC address.
• If you move to a paid plan, the space and its data stay, under the terms of the new contract.
• If you withdraw your marketing consent or object to the sales contact, we stop using the data for that purpose straight away.

The data are processed by Superduck staff authorised to do so and by providers acting as processors (Art. 28 GDPR), bound by a contract. By category, they are:

• cloud hosting providers, with servers in the European Union;
• email delivery providers, for messages such as the address confirmation and the inactivity notices;
• AI service providers, which process the questions you ask Athena and the data needed to answer them;
• Google, for reCAPTCHA, as described above.

We do not sell the data, nor share it with third parties for their own marketing.

We host the data in the European Union. Where a provider processes them outside the Union, as may happen with AI services and with Google reCAPTCHA, the transfer takes place under the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR).

Muvia Free is meant for machine and plant data, not for personal data of other people, such as customers, employees or contacts: if a variable contains any, it is best not to connect it.

Each person has a space of their own: a colleague with an email of the same domain gets a separate one, and neither sees the other's data.

If you create a public link to a dashboard or an analysis, anyone with the link sees that data, with the «Made with Muvia» mark. You can delete the link whenever you like.

At any time you can ask to access your data, correct it, erase it, restrict its processing, receive it in a machine-readable format and object to processing based on legitimate interest (Articles 15 to 22 GDPR). We take no decision about you based solely on automated processing: read-only mode and deletion after inactivity follow the deadlines described above, and we warn you before each step.

You can withdraw your marketing consent whenever you like, from the link in every message or by writing to the PEC address. Withdrawal does not affect processing carried out before it, nor Muvia Free.

To exercise your rights, write to the PEC address [email protected].

If you believe the processing of your data breaches the GDPR, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali.

This notice covers Muvia Free only. For the muviabi.com website, the demo booking form and cookies, the site's privacy policy applies, together with its cookie policy.