Privacy Policy

The data controller is Digital Logistics S.r.l., VAT no. IT03031930351, with registered office at Via Fratelli Cervi 80, 42124 Reggio Emilia (RE), Italy — the company that provides the SamBooks service. For any request relating to personal data you may write to info@sambooks.ai.

SamBooks collects the following categories of data:

• Registration data: first name, last name, email, company name, VAT number.
• Accounting and tax data: invoices, bank transactions, day book — entered by the user or imported from the Italian Revenue Agency/SDI and banks (PSD2).
• Usage data: access logs, actions performed within the application, interactions with the AI assistant “Sam”.
• Technical cookies and, subject to consent, analytics cookies (see the Cookie Policy).

Some uploaded documents may incidentally contain special category data (e.g. healthcare invoices): these are processed as ordinary data for accounting purposes, without profiling on special categories.

• Provision of the SamBooks service (basis: performance of the contract, Art. 6(1)(b) GDPR).
• Tax and legal compliance obligations (basis: legal obligation, Art. 6(1)(c) GDPR).
• Security and fraud prevention (basis: legitimate interest, Art. 6(1)(f) GDPR).
• Service communications and regulatory updates (basis: legitimate interest or consent).
• Direct marketing and analytics cookies: only with explicit consent (Art. 6(1)(a) GDPR).

Accounting and tax data are retained for the period required by Italian tax legislation (minimum 10 years from the last entry, Art. 2220 of the Italian Civil Code and Presidential Decree 600/73). Usage data and conversations with Sam are retained for 24 months; analytics telemetry for 12 months. Upon account deletion, the data may be exported and are deleted within 90 days of the request, save for legal obligations.

The data are not disclosed to third parties for commercial purposes. To provide the Service, SamBooks relies on suppliers acting as data processors (sub-processors), selected with priority given to data residency within the European Union. The main ones are:

• Infrastructure: Hetzner (hosting and database, Germany), Amazon Web Services EMEA (transactional email, storage and Bedrock EU, Ireland/EU), Vercel (website hosting, EU/USA with SCC clauses).
• Artificial intelligence: Mistral AI (assistant and OCR, France/Sweden, EU), Anthropic via Amazon Bedrock EU (Claude channel, EU regions only), conditionally OpenAI via Azure OpenAI EU; Langfuse (observability, EU) and Linkup (the assistant’s web search, generic queries only without customer data, EU).
• Invoicing and banking: Invoicetronic (transmission to the Exchange System, Italy), Enable Banking (account access via PSD2, Finland/EU), OpenAPI S.p.A. (VAT registry data, Italy).
• Analytics and monitoring: aggregate first-party traffic measurement, with no cookies and without storing the IP address (legal basis: legitimate interest, no consent required); PostHog (product analytics, funnels and session replay with field masking, EU — only subject to consent); Sentry (error monitoring, without identifying data, USA with SCC/DPF).
• Mandatory compliance: Italian Revenue Agency / SDI for electronic filing obligations.

Tax and banking data do not leave the European Union. The up-to-date list of sub-processors is maintained by SamBooks and communicated in the event of material changes.

Tax and banking data are processed exclusively within the European Union. Any transfers outside the EU concern only ancillary infrastructure (e.g. website hosting, error monitoring without identifying data) and take place with adequate safeguards (Standard Contractual Clauses and/or the Data Privacy Framework).

SamBooks uses an AI assistant (“Sam”) for operational support, categorisation and suggestions. In accordance with Art. 50 of the AI Act, every interaction and every output generated by the AI within the application is clearly indicated. No operation with tax or banking effect is carried out automatically: explicit user confirmation is always required (human oversight — therefore this does not constitute automated decision-making within the meaning of Art. 22 GDPR). The system does not fall among those classified as “high-risk” under the AI Act.

You have the right to: access, rectification, erasure, restriction, portability and objection to processing (Arts. 15-22 GDPR). The data you enter can be modified from the reserved area; the history of consents can be viewed in SamBooks → Profile → Consents. The right to portability (Art. 20) is guaranteed through the export of data in standard, machine-readable formats (FatturaPA XML, CSV, JSON); on request, an aggregated export of all personal data in a single package (ZIP) is also available. To exercise your rights you may also write to info@sambooks.ai. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

With the Posta module you can voluntarily connect your Outlook (Microsoft) or Gmail (Google) mailbox via OAuth authorisation, in order to read and send email and bring email documents into your accounting. SamBooks accesses the mailbox only after your explicit consent: it caches metadata only (sender, subject, date), while the body and attachments are fetched on demand and not retained beyond the session. The Sam assistant does not read your mailbox on its own initiative — it only sees what you share — and email content is never used to train artificial-intelligence models. When you disconnect the mailbox, metadata and access tokens are deleted. Data protection: the mailbox access credentials (OAuth tokens) are encrypted at rest using field-level encryption (Fernet) and all data is exchanged over encrypted connections (TLS); each company’s data is isolated at the database level through Row-Level Security, and access is restricted to the minimum necessary to provide the service. Google Limited Use: SamBooks’ use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This information notice may be updated. Material changes will be notified by email to registered users with at least 15 days’ notice.