1. Controller and scope
ONMAKE S.r.l., Piazza Giuliano della Rovere 8, 00121 Rome (RM), Italy, VAT IT17261401008, email info@onmake.it, certified email onmake@pec.onmake.it, is controller of the processing relating to xMath account, subscription, security and support management. For privacy requests use info@onmake.it stating "Privacy xMath". This address is not presented as the contact of an appointed DPO.
This notice covers xMath and its connection to the shared ONMAKE account; it supplements the general account notice for the specific processing described here and does not authorise new uses of other applications' data. Reading this notice does not mean consenting to all processing.
2. Roles concerning calculation content
Expressions, equations, results and the app's notebook stay in the user's browser: in normal use ONMAKE does not receive or process them, either as controller or as processor. When the user uses optional functions that send text or images to a chosen provider (section 5), that provider acts under its own terms and ONMAKE is not party to the relationship. ONMAKE is controller of account, subscription, security, support and billing data.
3. Data processed and sources
Processed data includes email address, account identifier, credentials and authentication or recovery information, security settings, language and, if enabled, membership of an organisation. Purchasing requires billing data, address, and any tax code, VAT number, certified email and recipient code; from Stripe ONMAKE receives transaction references and status, not the full card number.
When an xMath page is opened, the shared sign-in script checks on the ONMAKE database the account's permissions, subscription and any block or suspension, and records use: user, app, page-session identifier, start time and time of last activity, updated every two minutes while the tab is in the foreground. IP address, date and time, browser and device information needed for compatibility and security, authentication outcomes and error logs are also processed.
Calculation content is not sent to ONMAKE in normal use. Support requests may contain data the user provides voluntarily: it should be minimised before sending.
4. Purposes and lawful bases
Account creation, authentication, plan activation, requested processing, service communications and necessary support rely on contract performance or requested pre-contractual steps (article 6(1)(b)). For organisational users not personally party to the contract, contact and entitlement management relies on the legitimate interest in securely providing the organisational relationship (point (f)), subject to proportionality assessment.
Invoicing, statutory tax retention, responses to authorities and mandatory compliance rely on legal obligations (point (c)). Fraud and abuse prevention, security, proportionate evidential records and legal claims rely on legitimate interests (point (f)), unless a specific legal obligation applies. The interest is to protect users, the service and rights; it does not authorise indiscriminate examination of document content.
xMath subscription does not activate marketing, commercial profiling or non-essential tracking. Any introduction requires relevant information and separate, withdrawable consent where required (point (a)). Service activation and terms acceptance are not consent for these purposes. For content processed as a processor, ONMAKE does not substitute its own lawful basis for the customer's, but follows lawful instructions under article 28.
5. Local processing and optional third-party services
Calculations run in the browser. The theme, the app's notebook (requests not understood, rephrasings and solutions found by the engine, up to two hundred entries) and the AI assistant settings are kept in the browser's local storage (document 04). Any API key the user enters is kept in local storage in clear text: on shared devices it should be removed afterwards.
External AI assistant (optional). When the user sends a question from the AI Assistant tab, the browser sends it directly to the selected provider: Pollinations (a free public service, no key, selected by default), Google Gemini, Groq, Mistral or OpenRouter (with the user's API key), together with the app's instructions and the conversation history. Alternatively the user may choose a model run in the browser (WebLLM): the library is loaded from esm.run and first use downloads a model. Requests do not pass through ONMAKE servers.
Reading an equation from an image or PDF (optional). The chosen image, or the first page of the PDF rendered in the browser with the pdf.js library loaded from esm.run, is sent as an image to the text.pollinations.ai service without a key.
The chosen providers receive at least the content sent, the IP address and technical connection data and process them under their own terms and notices, including outside the European Union. The app's internal assistant (the first panel of the AI Assistant tab) answers with the browser's calculation engine and contacts no service.
The location declared by ONMAKE is: application server on Microsoft Azure, Italy North region; account data in the Supabase project in the EU Frankfurt region; website and service email on Aruba in Italy.
6. Recipients and access
Authorised ONMAKE staff bound by confidentiality and necessary hosting, database, email, payment, invoicing and support providers have access to data: Microsoft Azure and Supabase support infrastructure and authentication; Aruba supports the website and email; Openapi S.p.A. supports invoice transmission; the Italian Revenue Agency receives tax flows. Stripe acts in the roles relevant to each activity, including independently for its own legal obligations and payment security.
The providers of the optional functions in section 5 (Pollinations, Google, Groq, Mistral, OpenRouter and the esm.run distribution service) receive data only if the user uses those functions; they are not providers chosen by ONMAKE for the basic service. Authorities and advisers bound by confidentiality may receive data only where necessary and with applicable safeguards.
7. International transfers
European server locations do not automatically exclude access or processing outside the EEA by provider groups. ONMAKE permits a transfer only on a GDPR Chapter V basis: an applicable adequacy decision verified for the recipient, or appropriate safeguards such as relevant standard contractual clauses, transfer assessment and supplementary measures where necessary. General acceptance of terms is not used as derogation consent for routine transfers.
Customers and individuals may request recipient identities, countries, applicable safeguards and copies of relevant information from info@onmake.it, with only unnecessary confidential details redacted. A new transfer of entrusted content must also comply with the DPA and customer instructions. The Italy/EU commercial scope does not remove these European obligations.
8. Retention
Data in the browser persists until the user clears it, the browser removes it or an app function intervenes; remote deletion of copies on unreachable devices is not promised. Cookies and lifetimes are described in document 04. Retention at the providers of the optional functions is set by each provider.
Invoices and tax records are kept for ten years or any longer legally required period; deleting the account does not delete them. Shared-account data remains while the account is needed for other requested services; ending xMath alone does not delete it. Use and security logs and support data are kept for the time needed for the purposes described; contract data and strictly necessary evidence are kept for the relationship and, to the extent needed for obligations and defence, for the applicable limitation period.
9. Security, automation and AI
ONMAKE adopts measures proportionate to risk, including account authentication, permission and subscription checks, channel protection, updates and incident handling. No certifications or absolute absence of vulnerabilities are claimed.
ONMAKE does not supply AI models of its own: the optional AI assistant uses third-party providers chosen by the user (document 07). The internal assistant is not a language model. Internal use of AI tools by ONMAKE staff is distinct and does not involve sending customer content. Automatic controls on permissions, payment and security may refuse or limit access; they are not commercial profiling. Users may request human review of a block at info@onmake.it.
10. Rights, required information and changes
Where applicable, individuals may request access, rectification, erasure, restriction and portability, object to legitimate-interest processing and withdraw consents actually given without affecting earlier lawfulness. ONMAKE responds without undue delay and normally within one month, extendable only in the circumstances and with the notice required by the GDPR. Requests are normally free; exceptions must be justified under law.
For data in documents processed on behalf of a customer, ONMAKE forwards the request to the competent party and assists. GDPR portability concerns the data and conditions in article 20 and does not replace broader contractual document return. Individuals may complain to the Italian Garante or the authority in their habitual residence, workplace or place of the alleged infringement, and seek judicial remedies.
Email and information necessary for performance or tax obligations are required for the corresponding service; optional profile information and promotional consent are not. Refusing unnecessary information does not prevent the basic service. Material notice changes are communicated appropriately before new processing; an update cannot legitimise incompatible processing or replace required consent.