Privacy policy

KOMUNICATOR is a service by Consorzio Intermedia (Consorzio Intermedia, Via Prealpi 8, 20833 Giussano (MB), VAT 14785740961). This policy covers the komunicator.com website, the KOMUNICATOR apps for iPhone, Android, watch, desktop and web, the web app at web.komunicator.com and the admin portal at admin.komunicator.com.

KOMUNICATOR is sold only to companies and professionals. Each company has a separate environment, with a separate database, and decides which people to admit and which features to turn on.

Each party’s role depends on who you are and which data we are talking about.

If you use KOMUNICATOR because your company gave it to you

The controller is your company. It created your account and chooses the active features, the AI providers and the retention periods that are up to it. For this data Consorzio Intermedia is a processor (Art. 28 GDPR): it processes the data only to provide the service, under the data processing agreement that is part of the contract with the company, and does not use it for its own purposes.

To exercise your rights or ask how your data is used, contact your company first. If you write to us, we forward the request to the company and help it reply.

If you visit the website, activate the service or administer an environment

For data collected on the website, for activating and billing the subscription, for administrator accounts as contacts for the contract, and for the security of the platform, the controller is Consorzio Intermedia.

If you are a guest in a conversation

Whoever invites you with a link belongs to a client company: that company is the controller for the data you leave as a guest, and we are its processor.

On the company's server we keep the data needed to run the account:

Profile

name, email address, job title, language, photo if you upload one, day and month of birth if you enter them, administrator role. The password is stored only as a hash (Argon2id).

Devices

model, operating system, app version, device name and the codes used for notifications. Never IMEI or serial number.

Sessions

IP address and browser or app type of each sign-in, for account security.

Presence

minutes of activity per day, with first and last access, which the administrator sees in the portal. Deleted after 90 days.

Call log

who called whom, when and with what outcome.

Admin log

actions taken by administrators in the portal, with date and IP address.

To limit leaks of confidential documents, the administrator can decide that screenshots of the app on phones are either blocked or detected. If they are detected, a watermarked copy of the screenshot is kept for the administrator, normally for 90 days (the company can choose 7 to 365). The app tells you about this rule.

Messages, photos, videos, documents, voice messages, shared locations and calls between colleagues are end-to-end encrypted with the Matrix protocol: they are encrypted on the sender’s device and decrypted only on the devices of the people in the conversation. The server stores and relays them without being able to read them.

What the server still sees

• who is in which conversation, who sent each message and when;
• each person’s devices and the last access of each one;
• the name of whoever writes to you or calls you, which travels in the notification (see Notifications).

The company's backup copy of the keys

KOMUNICATOR is a company tool: history must follow the person to every device and the company must be able to recover it. That is why each person's keys have a backup copy on the server, sealed with the company key. That key is created in the administrator's browser and protected by the administrator's password: the server cannot open it on its own. With it the company's administrator can recover the history of one of the company's people, media included. Every recovery is written to a log that cannot be altered and, unless the company decides otherwise, the person is notified.

You can add a personal code of your own, which opens a second sealed copy of your keys.

When end-to-end encryption does not apply

• Calls with the automatic interpreter: so that the service can translate the audio, the call key is generated by the server. A notice says so during the call.
• Calls to phone numbers (landlines and mobiles) and calls the assistant makes on your behalf: they go through the phone network and the server.
• Conversations the assistant is in: the assistant is a participant and reads the messages of the conversations it is in.
• External contacts book, calendar, meeting transcripts and minutes, the assistant's memories: they are kept on the company's server, protected by access control but not end-to-end encrypted.

On your devices, messages already decrypted stay in the app’s storage so they can be shown and searched. They are erased when you sign out.

The assistant (Francesca) and the AI services (transcription, translation, summaries, minutes, search in documents) run on the providers chosen by the company, with the company's own access keys: OpenAI, Anthropic, OpenRouter and ElevenLabs. Consorzio Intermedia does not use keys of its own and does not send your data to providers the company has not chosen. Keys are stored encrypted (AES-256-GCM).

The provider receives only what the request needs, when you make it or when the company has turned the service on:

Text

what you write to the assistant and the messages of the conversation needed to reply.

Voice

the audio when you speak with the assistant, in a voice chat, in the car or from the watch, and the synthetic voice that answers. If the assistant's voice is a cloned voice, the sample was recorded with the consent of the person who gave it and only its identifier is kept.

Voice messages and meetings

voice messages to transcribe or translate, meeting transcripts from which the minutes are written.

Documents

documents the administrator uploads to the company knowledge base. To search them, the text is split into parts and turned into vectors: parts and vectors stay on the company's server, the original file is stored encrypted.

Business cards

the photo you take is read by the provider and then discarded; the contact details you save remain.

Email

the text of the emails you ask the assistant to read or summarise (see Company email).

Web search

questions that need information from the internet are searched by the AI provider itself, with its own search tool. Searches about people remain in the company's log.

The provider's processing follows the terms of the contract between the company and that provider. The history of your conversations with the assistant stays in the chat, encrypted like the others. The assistant can keep up to 300 memories per person (preferences, useful facts), which you can see and delete. The server keeps usage counts (how many requests, how many minutes), not content.

In calls between people with different languages, the automatic interpreter translates speech in real time. The audio goes from our call server to OpenAI's voice translation service (for Albanian: transcription, text translation and speech synthesis) with the company's keys. The audio is neither recorded nor kept; only the minutes of use remain.

If the company turns it on, you can ask the assistant to track a flight. The flight code and date are looked up with Flightradar24 using the company's key; none of your personal data is sent. On the server we keep the tracked flight, the airports and the latest status, to tell you about delays and landing. Each flight's data is deleted 30 days after the flight ends, as Flightradar24's terms require.

If you connect your company mailbox, the assistant can read, summarise and, after you confirm, send emails. The mailbox password is stored encrypted (AES-256-GCM). The server opens the mailbox only when you ask and makes no copy of it: no email is saved. The text of the emails you ask it to read reaches the AI provider chosen by the company to be processed.

The apps ask for each permission only when it is needed, and you can refuse.

Phone contacts

read on the phone to save a contact card received in a chat and to find the number of someone you ask the assistant to call. They are not uploaded to the server. If a name is ambiguous, only the names of the possible contacts go back to the assistant (for example “Mario Rossi, mobile”), never the numbers. If you pick a number to invite a guest, that number is used for the invitation (see Guests).

Location

used only when you choose to share it in a chat, including live for the time you decide. It travels as an end-to-end encrypted message: the server does not see it. KOMUNICATOR does not collect your location at any other time.

Camera and microphone

for calls, video calls, voice and video messages, scanning documents, business cards and QR codes.

Photos

the app can only add images to your library, not read it.

Face ID and fingerprint

biometric unlock is handled by the phone’s system: the app never receives biometric data.

The apps contain no third-party analytics, tracking or advertising tools.

To tell you about messages and calls we use the notification services of Apple (iPhone, watch, CarPlay), Google (Android) and your browser (web app). The notification contains the name of whoever writes or calls, the group name and technical codes for the conversation: the text of the message never travels in the notification, the app decrypts it on the phone.

Company number

if the company turns on calls to phones, they go through the VoIP operator chosen by the company (currently VivaVox). The operator credentials are stored encrypted. These calls are not end-to-end encrypted.

Calls made by the assistant

when you ask the assistant to phone someone for you, the conversation is handled by the company's real-time voice provider. Afterwards you get a summary and the transcript in the chat.

Guests

an external person is invited with a link; the conversation key is in the part of the link that never reaches the server. Of the invitation code we keep only a hash. The guest's name and, if the invitation is sent by SMS from your phone, their number stay in the company's guest log for 12 months.

Service emails

activation, sign-in and notices are sent from noreply@komunicator.com and never contain the text of messages. The sending queue is deleted after 30 days.

The komunicator.com website uses no cookies, no analytics or advertising tools and loads no third-party resources: even the fonts are served by our server. The web server logs the requests it receives (IP address, page, time) for security and troubleshooting.

To activate the service we ask for the company name, the chosen address and a contact email. Subscription payments are handled by Stripe: Stripe receives the card details, we do not. We keep the subscription, the transactions and Stripe's references.

The web app stores in the browser only what it needs to work: the session, the device encryption keys, the message search index, drafts and preferences. These are strictly necessary technical tools, not profiling cookies, and are shared with no one. In the settings you can keep the search index in memory only.

For the data of a company's people, the legal basis is set by the company as controller: usually the performance of the employment or working relationship and its legitimate interest in organising internal communication.

For the processing Consorzio Intermedia controls:

Contract

activation, subscription management, support for administrators (Art. 6(1)(b) GDPR).

Legal obligation

keeping tax and accounting records (Art. 6(1)(c)).

Legitimate interest

platform security, abuse prevention, technical logs (Art. 6(1)(f)).

The service, databases, encrypted messages, calls and backups are hosted on IONOS servers in the European Union.

The platform is developed and operated on our behalf by AGLA SRLS (Piazza Alcyone 23, 65129 Pescara, P.IVA 02294230681), which processes data only for this purpose as our processor (Art. 28 GDPR).

Some providers are based in, or process data in, the United States:

Artificial intelligence

OpenAI, Anthropic, OpenRouter, ElevenLabs, chosen and turned on by the company.

Notifications

Apple and Google.

Payments

Stripe.

These transfers rely on the EU-US adequacy decision (Data Privacy Framework) for certified providers and, otherwise, on the standard contractual clauses approved by the European Commission, with the supplementary measures needed. The client company, which chooses the AI providers, assesses their adequacy in its own contract with them. Flightradar24 is based in Sweden.

Messages remain as long as the conversation or the account exists, unless deleted. Other periods:

When the administrator deletes a person, their account and linked data are deleted and the messaging account is closed with a request to erase its data. When a company leaves the service, access is closed at once, the administrator receives a readable archive of the history and after 30 days the whole environment, backups included, is destroyed. Only the record of the termination remains.

• a separate environment for each company, with separate databases;
• end-to-end encryption of content, encryption in transit (TLS) on every connection;
• passwords stored only as hashes, third-party credentials encrypted with AES-256-GCM;
• limits on sign-in attempts, a log of administrative actions and key recoveries;
• backups in a folder only the service can access.

You have the right to access your data, rectify it, erase it, restrict its processing, object to processing based on legitimate interest and receive it in a readable format (Arts. 15-22 GDPR).

If you use KOMUNICATOR through your company, contact the company: it is the controller. For the processing Consorzio Intermedia controls, write to intermedia@pec.cloud. We reply within one month.

The data protection officer (DPO) is Luigi Sorrenti, reachable at the same address.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of the country where you live or work.

KOMUNICATOR is a service for companies and is not intended for people under 16. Companies must not create accounts for anyone under 16.

When the service changes we update this page and the date at the top. We notify companies' administrators of significant changes before they take effect.

Publisher

Consorzio Intermedia · Consorzio Intermedia

Registered office

Via Prealpi 8, 20833 Giussano (MB)

VAT number

14785740961

Privacy

intermedia@pec.cloud

Data protection officer

Luigi Sorrenti