Privacy Policy
Last updated: 12 June 2026
How Foresave processes your personal data, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Data controller
The data controller is Michele Cerruto, an Italian self-employed professional (libero professionista), Via Variante SS115 n. 1/A, 97015 Modica (RG), Italy, VAT no. IT01773340888. For any request regarding your data, write to foresave@m2clead.com.
2. Data we collect
Through the waitlist form we collect the first name and email address you provide. When you create an account we process your account credentials and your partita IVA tax-regime details. When you use the service we process the financial data you import or connect — bank statements, account balances, and transactions — together with your VAT number (partita IVA) and the tax data needed to estimate your set-aside. We also collect anonymous, cookie-free usage data through PostHog; if you accept cookies, this is extended to full analytics and advertising measurement through PostHog and Meta Pixel (see section 8).
3. Purposes of processing
Your data is used to manage your waitlist registration and account, to provide the service — cash-flow projections, tax set-aside estimates, and the AI advisor — to send you service updates, the launch announcement and other communications about Foresave, and to measure advertising campaigns and analyze how the site is used.
4. AI processing
To generate projections, tax estimates and advisor answers, Foresave sends the minimum data each feature needs to third-party large-language-model providers (Anthropic, OpenAI and, where applicable, DeepSeek) acting as our processors. Before any data leaves our servers we minimise it to the fields the feature requires and redact direct identifiers — we do not send your name, full IBAN or full VAT number to a model. Account numbers are masked. Our providers are contractually bound not to train their models on your data and to apply zero- or limited-retention terms. DeepSeek processes data outside the EU/EEA; it is not used for flows containing personal or financial data unless a Standard Contractual Clauses transfer mechanism and a documented risk assessment are in place.
5. Legal basis
Processing your financial and tax data to provide the service is necessary for the performance of our contract with you (Article 6(1)(b) GDPR). For the waitlist data and for cookie-based tracking the legal basis is your consent — given when you submit the form and, for cookies, through the cookie banner (Article 6(1)(a) GDPR); you can withdraw it at any time. The anonymous, cookie-free analytics rely on our legitimate interest in understanding site traffic (Article 6(1)(f) GDPR). Where we are required to keep accounting and invoicing records, the legal basis is our legal obligation under Italian law (Article 6(1)(c) GDPR).
6. Data security
Financial and tax data and any API keys you provide are encrypted at rest, and all data in transit is protected with TLS. Access to your data is restricted at the database level so that one user can never read another user's data. We never send raw financial identifiers to our AI providers (see section 4).
7. Data retention
Waitlist data is kept for a maximum of 12 months from your signup, or until you withdraw your consent, whichever comes first. Raw uploaded statements are purged 30 days after they are processed. AI interaction logs are kept for 90 days. Account data, including your financial and tax data, is deleted when you delete your account. Invoicing and accounting records are retained for the period required by Italian tax law and then deleted. After each period the data is erased or anonymised.
8. Recipients and sub-processors
Your data is processed by selected providers acting as data processors (sub-processors): Supabase (EU-region database and authentication), Vercel Inc. (application hosting), Resend Inc. (email delivery), Upstash (rate-limiting), Stripe (payments and invoicing), Anthropic, OpenAI and DeepSeek (AI processing — see section 4), Google Ireland Ltd. (contact storage in Google Sheets and email inbox), Meta Platforms Ireland Ltd. (Meta Pixel) and PostHog Inc. (analytics, EU region). Some of these providers are based outside the European Union; in that case the transfer is governed by the safeguards required by the GDPR, such as the Standard Contractual Clauses. The current sub-processor register is maintained in our Data Processing Addendum.
9. Cookies and tracking
The site uses PostHog for analytics in two modes. Before and unless you give consent, PostHog runs in cookieless mode: it stores nothing on your device and counts visitors using a privacy-preserving identifier, so no consent is required. If you accept through the cookie banner, PostHog switches to full analytics and Meta Pixel is enabled to measure advertising conversions; both then set cookies and similar identifiers on your device. Meta Pixel never runs without your consent. You can change or withdraw your choice at any time through the "Cookie preferences" link in the footer.
10. Your rights
You have the right to access your data, to obtain its rectification or erasure, to restrict or object to processing, to data portability, and to withdraw consent at any time. You can erase your account and all associated data at any time from your account settings, or by writing to us. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali). To exercise your rights, write to foresave@m2clead.com.
11. Minors
Foresave is not intended for minors under 18. If you are under 18, please do not submit your data through this site.
12. Updates
This policy may be updated. Any changes will be published on this page, with a revised date.