Rilievo privacy notice

Version 4, 19 October 2026. Information about data processing in Rilievo and the services selected by its user.

1 Provider and contacts

Rilievo is a RAVENG app provided by CE4U S.r.l., a single-member company, Via G. Rossini 29/2, 37012 Bussolengo (VR), Italy; tax/VAT number 04731920239, business register REA VR-444364. Contacts: info@raveng.it; privacy@raveng.it; certified email posta@pec.ce4u.it.

CE4U is the controller of information it receives for support, its own contractual relationships and obligations. Survey records remain on the user's iPhone; ordinary collection in the app does not automatically send them to CE4U. The organisation or professional determining a survey's purposes and means must establish its own controller/processor role, customer instructions, lawful basis and information to data subjects. Supplying software alone does not authorise CE4U to use customer material.

2 Data and routes

The app introduces no advertising or behavioural analytics SDKs. Apple's system diagnostics follow iOS choices. Website processing and logs follow the general RAVENG privacy notice. Rilievo pages introduce no new trackers, profiling cookies or third party embedded content.

Optional timestamps and verification. Timestamping is initially off and is enabled in settings after the related disclosure. Sectigo and freeTSA receive SHA-256 fingerprints and a random number, rather than files: for the manifest, reports and exported packages; also for individual evidence items if you enable the additional option. When OpenTimestamps is enabled, calendars at opentimestamps.org, eternitywall.com and catallaxy.com receive a root calculated from fingerprints combined with random numbers, rather than the original fingerprints. Submissions, retries and proof updates may continue automatically; switching timestamping off prevents new queue entries, while existing entries are completed. When a timestamp arrives, iOS may contact OCSP/CRL services to check TSA certificates, sending identifiers of the service certificate rather than your documents. Only the “Check the block” command queries blockstream.info or mempool.space with the Bitcoin block number and hash, without sending files or evidence fingerprints. These connections expose your IP address, request time and technical metadata to the recipients; TSA and calendar requests also include the app name and version. Fingerprints are not a guarantee of anonymity. The in-app disclosure explains the options and limitations of the proofs.

AI usage exchange rate. With the automatic exchange rate, when the ledger is initialised and on subsequent updates the app downloads the public euro/dollar exchange-rate file from ecb.europa.eu. This request contains no survey records, photographs, documents, AI usage ledger data or API keys; the server still receives your IP address and technical connection metadata. This lookup does not transmit the ledger or custom prices. Setting a manual exchange rate prevents subsequent automatic updates until you restore the ECB reference; a request already started may complete.

3 Activating Codex Cloud

The app presents a disclosure and requires explicit activation before sending material. Data is uploaded to your repository and made available to the connected Codex service. Photographs, notes, documents and customer information are not automatically anonymised. Private visibility limits public access, but authorised collaborators, administrators and integrations may still access a repository.

Activation records your choice of technical route. It is not data subjects' consent, customer authorisation, a GDPR Article 28 agreement or assurance that a transfer is lawful. Check your contracts, account settings and agreements with GitHub and OpenAI. Do not upload confidential or personal material without appropriate authorisation and a lawful basis. Health information and other special categories require their specific applicable conditions; avoid collecting them where unnecessary.

You can disable cloud and revoke activation in the app settings. This prevents new submissions according to the setting; it does not automatically delete already submitted data or stop jobs already running with providers. Read the current disclosure before reactivation.

AI via token: direct transfer to the selected provider

This route is separate from Codex Cloud: API access alone does not require a GitHub repository or a ChatGPT subscription, but an API account/service usable under the selected provider’s contract. The app requires the disclosure to be read and explicitly activated. Job material is sent directly to the configured APIs, without passing through a CE4U processing service. Text-only models do not receive photographs but may receive notes, details and text excerpts. Resizing images or selecting excerpts does not anonymise information.

Recipients may include OpenAI, Anthropic, Google, DeepSeek, Mistral, xAI, OpenRouter and a compatible service specified by the user. OpenRouter may route requests to the provider executing the model, including alternative destinations under its settings; check these recipients and their terms too. Enabling web research may involve provider search tools; downloading manuals/PDFs also contacts their source websites, which receive normal requests and network metadata. Do not assume that searches and retrieved content are complete or correct.

The API key is held in the device Keychain and used to authenticate requests to the configured recipient. Storage does not mean the key is never transmitted to the service. For a custom address, verify the operator, authorisations and connection security before entering credentials or customer material. Changing provider/model may change recipients, capabilities, terms and costs. Withdraw activation and delete/revoke the key to stop new use; submitted requests and provider-held copies require separate management. Selecting a technical route does not replace a lawful basis, customer authorisation, notices, processing agreements or transfer assessment.

4 Purposes and lawful bases

CE4U processes contacts and support requests to respond and take requested precontractual steps or perform the contract where applicable (GDPR Article 6(1)(b)), or under legitimate interests in handling general requests and security (Article 6(1)(f)). Administrative information is processed for legal obligations (Article 6(1)(c)); information necessary to defend rights under the relevant legitimate interest.

The organisation determining survey processing establishes its appropriate lawful basis, customer instructions and retention period. iOS camera, location and microphone permissions are technical authorisations, not substitutes for that assessment.

You do not need to send CE4U survey photographs or technical files to purchase the app. Initial support requires contact information and a sufficient description of the issue, not customer material or credentials.

5 Recipients and international transfers

Apple handles purchases and system features; GitHub and OpenAI receive data for Codex Cloud; the selected API provider (OpenAI, Anthropic, Google, DeepSeek, Mistral, xAI, OpenRouter or a custom service) and any routed providers receive data for AI via token; Hugging Face receives model download requests. PDF report compilation runs on the device and does not involve an additional transfer to the AI provider. Roles, contracting entities, locations, retention and safeguards depend on the service, plan and agreements applying to your account. Do not assume EU-only hosting, no retention or exclusion from model training without checking the actual applicable conditions.

Services may process data outside the European Economic Area. The competent controller must assess Article 44 onwards of the GDPR, official text, available contractual safeguards and suitability for its case. This notice does not certify a particular transfer mechanism for users' accounts.

Recipients of information supplied directly to CE4U include authorised staff, communication providers, advisers and authorities when necessary. CE4U provider details and safeguards are described in the general website privacy notice and available from privacy@raveng.it.

6 Retention and deletion

Local records remain while you retain them, subject to deletion or device failure. Define assignment retention and export verified copies. Deletion within Rilievo does not remove cloud copies, Git history, PRs, OpenAI chats, shared attachments or backups. Handle these separately under provider procedures and applicable recordkeeping duties.

CE4U retains contact requests that do not lead to a contract for up to 24 months after the last contact, unless required to defend rights. Administrative records subject to legal retention follow statutory periods. Agree on content and channel before sending support attachments; do not send unnecessarily complete archives.

The GitHub token is held in the iPhone Keychain and used to authenticate service requests. Remove it in the app and revoke it on GitHub as needed. Do not send it to support. Removing a token does not delete published data.

PDF reports and LaTeX sources are separate copies of survey material. Deleting one report does not delete the survey, other reports or exported copies; manage the Reports folder, backups and recipients separately. Removing an API key in the app does not automatically revoke it with the provider or delete submitted material.

7 Security and operational duties

Use a device passcode, iOS updates, account access controls, single-repository restricted tokens, private repositories and authorised backup locations. Rilievo does not guarantee anonymisation, additional encryption of export packages or absolute protection. Sharing makes package contents available to the recipient; inspect them first.

Revoke a suspected exposed credential and contact your internal responsible person. For a suspected breach of customer personal information, inform the competent controller and follow the applicable procedure. Contact CE4U about aspects directly concerning its processing.

8 Rights and AI output

For information processed by CE4U, request access, rectification, deletion, restriction, portability where applicable and objection to processing based on legitimate interests. Withdraw any applicable consent without affecting previous lawful processing. Write to privacy@raveng.it or the certified email above. Requests follow GDPR time limits; you may complain to the Italian data protection authority or the competent authority in your EU country.

For survey records, contact the organisation determining processing and the relevant account services. CE4U cannot remotely delete your repository or iPhone archive.

AI may generate errors, omissions and invented information (“hallucinations”), including information about people. Every analysis and report is an UNVALIDATED DRAFT: a competent and experienced professional must check, correct and approve it before use, customer delivery or decisions. CE4U S.r.l. and Carlo Tenca do not automatically approve or sign output. The app is not designed for automated decisions about people with legal or similarly significant effects. Do not use output to assess workers or other people without independently checking the applicable rules. These warnings do not limit data subjects’ rights or the GDPR obligations of those involved. Usage limitations and liability are covered by the Rilievo terms.

9 Updates

Rilievo is intended for professionals and organisations, not collection of children's data. We update this page when functions or processing routes change. The version and date appear above. See the Rilievo terms and guide.

Candidate 1.1.0 descriptive addition: context and reviews

The local work file may also contain the CE assessment purpose and framework, documented dates, sources and justification, modifications, document metadata and verified technical summaries, reviewer name, review date and notes, reviewed assessment and history. A later AI proposal may be retained separately from the professional review. Reports, packages and shared copies may include these items and must be checked before sending.

Jobs may include relevant context and evidence, including previous data or reviews selected by the workflow. Choosing local AI, APIs or Codex Cloud retains the routes described in this notice and does not introduce automatic transfer to CE4U. The reviewer’s name is personal data and does not establish a signature. Minimise information and attachments, authorise routes before sending, and separately manage external-service copies and histories. Deleting data in the app does not delete them.