Privacy Policy | Running Dolphins

This policy explains how Running Dolphins handles personal data collected through runningdolphins.com, including the free AI Audit tool. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR) and of the Italian Privacy Code. Cookies and similar technologies are described in detail in our Cookie Policy.

1. Who is responsible for your data

The data controller is Running Dolphins S.r.l., Viale Regina Margherita 30, 20122 Milan, Italy, VAT number IT14405110967. For any question about this policy or to exercise your rights, write to info@runningdolphins.com. We have not appointed a Data Protection Officer, as we are not required to.

2. What we collect

2.1 Analytics and campaign attribution (only with your consent)

If you accept statistics cookies, we use Google Analytics 4 to understand how the site is used. It sets cookies in your browser and collects pages viewed, approximate location, device and browser type, referring website, and interactions we explicitly track (for example, clicking a call-to-action or starting the AI Audit). If you arrive from a link that carries campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), we also store them in a first-party cookie named rd_utm for 90 days and attach them to those events. The cookie contains no identifier of you, only the campaign labels from the link you clicked.

Until you accept, none of this happens: Google Analytics is not loaded, no statistics cookie is written and no analytics event is sent. If you refuse, the site works the same and we collect no analytics data about you. We do not use advertising or remarketing cookies, and we do not sell this data. The full list of cookies, with duration and provider, is in the Cookie Policy.

2.2 Server logs and abuse prevention

When you visit the site or use the AI Audit, our servers, hosted on Google Cloud, process your IP address and standard request data (time, page requested, browser identifier) in technical logs. The AI Audit endpoints also count requests per IP address to limit abuse (a short rate limit, kept in the server's memory), and we store your IP address with each AI Audit session. We use this only for security, to prevent abuse of an open endpoint that costs us money, and to monitor that cost.

2.3 The free AI Audit tool

The AI Audit is a short guided conversation. When you use it, we process and store:

Everything you type into the conversation, and the model's replies. What ends up in there is up to you: most people describe their company, their processes and the software they use. If you choose to paste in confidential information or personal data about colleagues or customers, that content is stored too, so please share only what you are comfortable sharing.
Voice answers, if you use the microphone: your browser asks for permission only when you click the microphone button. The recording is sent to our server, which forwards it to OpenAI to be turned into text. We do not save the audio file: only the text you then choose to send becomes part of the conversation.
The contact details you enter to see your result: email address (required), and name and company if you provide them.
The result generated for you: readiness score, fit percentage, suggested automations and any preliminary steps.
Technical data: your IP address and a count of messages and AI tokens used (see 2.2).

When you complete an audit, we receive a summary by email at info@runningdolphins.com with your details, the result and the conversation, so that a person can follow up.

2.4 Enquiries

If you contact us, by email or through the site, we store your name, email address, company (if given) and the content of your message, so that we can reply and keep track of the conversation.

We do not collect special categories of data (health, political opinions, and so on), and the site is not intended for anyone under 18.

3. Why we process it, and on what legal basis

Analytics and campaign attribution (Google Analytics 4 and the rd_utm cookie): your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code), asked through the cookie banner and withdrawable at any time.
To run the AI Audit and reply to you: performance of a service you asked for, and our legitimate interest in following up on a business enquiry (Art. 6(1)(b) and 6(1)(f) GDPR).
Server logs, rate limiting and protection of the AI Audit from abuse: legitimate interest in the security and cost control of the site and of a public endpoint (Art. 6(1)(f) GDPR).
To send you information about our services, if you asked us to: consent (Art. 6(1)(a) GDPR), withdrawable at any time.

4. Who processes data on our behalf

OpenAI (United States): the AI Audit conversation is sent to OpenAI's API to generate the questions and the result, and, when you name a specific tool, to look up how it integrates. Voice answers are sent to OpenAI's transcription service. We use the API, whose terms state that data submitted through it is not used to train OpenAI's models.
Google (Ireland / United States): Google Cloud for hosting the site, server logs and the Firestore database (European Union region) where AI Audit sessions and enquiries are stored; Google Workspace for our email; and Google Analytics 4 for site measurement, only if you consent.
Resend: the email service that delivers the summary of a completed AI Audit to us.

These providers act as processors under contract. We do not sell personal data and we do not share it with anyone else, except where we are legally required to, or in connection with a merger or sale of the business (with notice to you).

5. International transfers

Some of these providers process data in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the provider's certification under the EU–US Data Privacy Framework, together with the technical measures those providers apply. You can ask us for details of the safeguards in place.

6. How long we keep it

AI Audit sessions (transcript, contact details, result, IP address): 24 months from the date of the session, then deleted or anonymised.
Enquiries: for as long as the commercial relationship or conversation is live, and up to 24 months after the last contact.
Server logs: for a limited period, as set in the logging configuration of our hosting provider, and no longer than needed for security.
Analytics data: according to the retention set in Google Analytics 4 (14 months at most for user-level data).
Cookies and your cookie choice: as listed in the Cookie Policy (rd_utm 90 days; your choice is remembered for 6 months).

We keep data longer only where a legal obligation (for example accounting or a legal claim) requires it.

7. Automated decision-making

The AI Audit produces a readiness score and suggestions automatically. This is informational only: it produces no legal effect and no similarly significant effect on you, it does not decide whether we will work with you, and a human reads every result that leads anywhere. You are welcome to disagree with it: write to us and tell us why.

8. Your rights, and how to withdraw consent

Under the GDPR you can ask us to:

Access the personal data we hold about you, and get a copy of it.
Rectify data that is wrong or incomplete.
Erase your data, including deleting an AI Audit session and its transcript.
Restrict or object to processing based on our legitimate interest.
Port your data to another provider in a structured, machine-readable format.
Withdraw consent at any time, where processing is based on it. This does not affect processing done before you withdrew it.

You can withdraw your cookie consent as easily as you gave it: (the link is also in the footer of every page).

Write to info@runningdolphins.com and we will respond within one month. If you are not satisfied, you can lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali, garanteprivacy.it) or with the authority where you live.

9. Security

The site is served over HTTPS. Data is stored in managed cloud infrastructure with access restricted to authorised people who need it, and encrypted in transit and at rest. No system is perfect: if a breach ever affects your data, we will notify you and the supervisory authority as the GDPR requires.

10. Changes to this policy

We update this policy when what we do changes. The date at the top always reflects the current version; material changes will be announced on this page.

11. Contact

Running Dolphins S.r.l., Viale Regina Margherita 30, 20122 Milan, Italy, VAT IT14405110967, info@runningdolphins.com.