Privacy Policy

Last updated: 6 October 2026

This Privacy Policy describes how Hidden S.r.l. ("hidden.", "we") processes personal data collected through www.hiddencompany.it, in accordance with Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003.

Data controller

Hidden S.r.l., Via Giovanni Da Procida 23, 20149 Milan, Italy — VAT no. IT14721820968 — info@hiddencompany.it.

Data we collect

• Contact form: first name, last name, work email, company, website or social profile (optional), phone (optional) and the content of your message.
• Technical data: the hosting provider (Cloudflare) may process IP address, browser and access logs for security and delivery of the website. We do not run marketing or profiling trackers.
• Visit statistics: only if you accept it in the cookie banner, Google Analytics 4 (Google Ireland Limited) collects data on how pages are used, such as page views, duration, scrolling, button clicks, whether the contact form is sent (never its content), device and source, linked to a random identifier stored in a cookie. With the same consent, Microsoft Clarity (Microsoft Ireland Operations Limited) anonymously records how the site is used (clicks, mouse movements, scrolling) for heatmaps and recordings of visits; the content of form fields is never recorded. Legal basis: your consent (Art. 6.1.a GDPR), which you can withdraw at any time from “Cookie preferences”. Details in the Cookie Policy.

Purpose and legal basis

• To reply to your enquiry and evaluate a possible collaboration — legal basis: pre-contractual measures taken at your request (Art. 6.1.b GDPR).
• To generate the Growth Map, send you the report and get back to you about the call — legal basis: your consent (Art. 6.1.a GDPR). Details in the dedicated section below.
• To measure visits with Google Analytics — legal basis: the consent you give in the cookie banner (Art. 6.1.a GDPR).
• To ensure security and proper functioning of the website — legal basis: legitimate interest (Art. 6.1.f GDPR).
• To comply with legal obligations and, if necessary, to defend a right in court — legal basis: legal obligation and legitimate interest (Art. 6.1.c and 6.1.f GDPR).

Providing your data

The fields marked as required in the contact form and in the Growth Map are needed to reply to you: without them we cannot handle the request. The other fields are optional. Google Analytics and Microsoft Clarity statistics are active only if you accept them.

Retention

• Enquiries from the contact form and the Growth Map: for the time needed to handle them and at most 24 months after the last contact, unless a contractual relationship starts or you ask for earlier deletion.
• Google Analytics data: for the periods set in the property, currently 2 months for event data and 14 months for data linked to the visitor's random identifier; the _ga cookie lasts up to 2 years unless you withdraw consent.
• Microsoft Clarity data: recordings of visits are kept for 30 days (up to 9 months for those saved as favourites); the _clck cookie lasts 1 year and _clsk 1 day, unless you withdraw consent.
• Technical logs of the hosting provider: for the short periods set by Cloudflare for security and service delivery.

Recipients and providers

Data is processed by authorised staff of Hidden S.r.l. and by the following providers, appointed as processors:

• Cloudflare, Inc. (United States) — website hosting, storage of enquiries and security.
• Google Ireland Limited — business email (Google Workspace), calendar and, only with your consent, Google Analytics.
• Microsoft Ireland Operations Limited — only with your consent, Microsoft Clarity (heatmaps and anonymous recordings of visits).
• Sendinblue SAS (Brevo) (France) — sending the website's emails.
• Cal.com, Inc. (United States) — call bookings.
• Apify Technologies s.r.o. (Czech Republic) — reading public social profile data for the Growth Map, when active.
• Anthropic, PBC (United States) — AI processing of the public content of the analysed website, when the AI engine is active; it never receives your email.

Data is not sold or shared with third parties for marketing purposes.

Transfers outside the European Union

Some providers are based in the United States or may process data outside the European Union. In those cases the transfer relies on the European Commission's adequacy decision on the EU-US Data Privacy Framework, for certified providers, or on the standard contractual clauses approved by the Commission (Art. 45 and 46 GDPR).

Hidden Sherlock AI (Growth Map)

When you request a Growth Map we process the website address you enter, the goal you choose, your email address and, if you provide it, your phone number, to generate the analysis and send you the report — legal basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time by writing to us. The analysis reads only publicly available pages of the website you provide and public performance data from Google PageSpeed Insights, plus the public follower and post counts of the social profiles linked from that website (which may be retrieved through Apify). When the AI engine is enabled, the website content is processed by Anthropic (Claude API) as our AI provider; your email address is never sent to the AI provider. The report is sent through our email provider (Brevo). If you book a call, the booking (name, email, phone, date and time) is handled by Cal.com and added to our Google Calendar, and it is linked to your request so we can prepare the call. We keep the request (email, phone if provided, website, goal, date, booked call) for at most 24 months to follow up on it, unless you ask us to delete it earlier.

Your rights

You may request access, rectification, erasure, restriction, portability or object to processing by writing to info@hiddencompany.it. You can withdraw any consent you have given at any time, without affecting processing carried out before the withdrawal: for Google Analytics, use the “Cookie preferences” link at the bottom of every page. We reply within one month. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.

Automated decisions

The Growth Map is an automated analysis of a company's website, not of the person who requests it. We do not take decisions based solely on automated processing that produce legal effects on you (Art. 22 GDPR).

Changes to this policy

If we change how we process data, we update this page and the date at the top. If the changes concern processing based on consent, we will ask for your consent again.