In short. You do not need to register to read the site. The site shows no advertising and loads no Meta, TikTok or other pixels. Google Analytics statistics start only if you accept them in the consent panel; in the United States you can opt out at any time. If you join the waitlist or request a demo, it only counts once you confirm it from the link we email you, and we record proof of your consent. We do not sell or pass on your data.
Data controller
The data controller is Redbit S.r.l.s. con socio unico (a single-member Italian limited company), Viale della Grande Muraglia 494, 00144 Rome, Italy, VAT number IT15237911001. Markmatix is a Redbit project.
For any request about your data, write to [email protected]. We have not appointed a data protection officer.
This notice is given under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, the "Italian Privacy Code").
What we process, why, and on what basis
| Processing | Data | Purpose | Legal basis |
|---|---|---|---|
| Browsing and server logs | IP address, date and time, page requested, referring page, browser | Serving the pages, protecting the site, diagnosing faults | Legitimate interests (Art. 6(1)(f) GDPR) |
| Consent panel (InMobi Choice) | IP address and the country InMobi derives from it, technical browser data, your choices, when the panel is shown | Asking for consent where the law requires it, respecting the choice and being able to prove it | Legal obligation (Art. 6(1)(c) and Art. 7(1) GDPR; Art. 122 Italian Privacy Code) and legitimate interests (Art. 6(1)(f)) |
| Statistics with Google Analytics 4 | _ga cookie identifiers, pages viewed, referrer, device and browser, approximate area |
Understanding which pages are read and improving them | Outside the United States: consent (Art. 6(1)(a) GDPR and Art. 122 Italian Privacy Code). In the United States: legitimate interests, with the right to opt out at any time |
| Waitlist | Email; name and website, if you give them | Sending you news about the Markmatix launch and the early access invitation | Consent (Art. 6(1)(a) GDPR and Art. 130 Italian Privacy Code) |
| Demo request | Name, email, publisher or company; website, phone, leads per month, industries and message, if you give them | Answering the request and setting up the presentation. Launch news only if you tick the second box | Steps taken at your request before a contract (Art. 6(1)(b) GDPR). For launch news: consent (Art. 6(1)(a) and Art. 130 Italian Privacy Code) |
| Proof of consent | The record lines described below: event, date and time, email, purposes granted or refused with the version and fingerprint of the exact text, IP address, browser | Proving that consent was given, on which text and when, and that a withdrawal was respected | Obligation to demonstrate consent (Art. 7(1) and Art. 6(1)(c) GDPR) and legitimate interests in defending ourselves against claims (Art. 6(1)(f)) |
| Protecting the forms from abuse | Hidden field, time the form was opened, keyed fingerprints of the IP address and email | Stopping automated and repeated submissions | Legitimate interests (Art. 6(1)(f) GDPR) |
| Emails you send us | Email address, message and any data you give us | Replying and, if you exercise a right, handling the request | Steps taken at your request (Art. 6(1)(b)) and legal obligation for rights requests (Art. 6(1)(c)) |
Only Redbit staff authorised to work on Markmatix handle this data. We do not use it to profile you and we do not match it against other databases.
Waitlist and demo request
The forms
The waitlist form asks only for your email; name and website are optional. The same form, cut down to the email field, appears at the bottom of many pages on the site. The demo request form asks for your name, email and publisher or company; website, phone, leads per month, industries and message are optional.
Next to each consent box there is a fixed text, with one version per language. That text, exactly as you see it in the form, is what we record. If it ever changes, a new version is created: sign-ups already made stay linked to the text you had in front of you.
Email confirmation (double opt-in)
After you submit, we email you a personal link that is valid for 7 days. The link opens a page with an "I confirm" button: your sign-up or request only counts once you press it. Opening the link is not enough, so spam filters that open links automatically cannot confirm on your behalf.
Without confirmation we will not write to you again. Once you confirm, you receive a second email with the link to unsubscribe. At that point the Markmatix team receives an email alert with your address and the request details, so we can reply.
The consent record
Every step becomes a new line in a record. Lines are never edited.
- On submission we record: event type, date and time, form, request ID, language, email; for each purpose whether you granted or refused it, with the version and SHA-256 fingerprint of the exact text shown; the version and fingerprint of the form's short notice and the address of this privacy notice; the address of the form page, your IP address and your browser (the user agent).
- On confirmation and on withdrawal a line is added with date and time, request ID, email, page, IP address and browser. The withdrawal line marks every purpose as refused.
- Each line contains the fingerprint of the line before it. If a line were removed or altered, the chain would break and we would notice.
The request details (name, company, website, phone, leads per month, industries, message) are kept in a separate file. The record and the requests are stored on the server outside the site's public folder: they cannot be reached from the web.
Protection against abuse
To stop automated submissions we use a hidden field that only programs fill in, and a signed token holding the time you opened the form: a submission sent less than 3 seconds or more than 2 hours after that is rejected. We accept no more than 5 submissions every 10 minutes from the same connection and 3 a day for the same email address.
To count submissions we store neither the IP address nor the email in clear, only a fingerprint computed with a secret server key (HMAC): without the key the data cannot be traced back. Once a counting file is more than a day old, the next submission deletes it.
The emails we send you
Our emails go out from Redbit's mail server (mail.redbitapp.com), from [email protected] under the name "Markmatix". They are plain text: no images, no tracking pixels, no links that count clicks. We do not know whether you open our emails.
Every email we send after you confirm contains the link to unsubscribe. The link does not expire: it opens a page with an "Unsubscribe me" button, and pressing it withdraws your consent. For a demo request, the same button withdraws the request and your consents. You can also write to [email protected].
When contacts move into Markmatix
From phase 1 of the product we plan to move these contacts into the Markmatix platform. Redbit will remain the controller and the servers will be in the European Union. When that happens we will announce it by updating this notice.
How long we keep data
| Data | How long |
|---|---|
| Server logs | A new log file starts when the previous one reaches 10 MB; we keep no more than 10 compressed files and the oldest are deleted |
| Request never confirmed | The link expires after 7 days. After 30 days we anonymise the request: we remove the email, IP address, browser data and the other form data |
| Confirmed waitlist sign-up | Until you withdraw consent, and in any case no longer than 24 months from sign-up |
| Confirmed demo request | 24 months from the request |
| Proof of consent after a withdrawal | We delete the request data (name, company, website, phone, message) straight away. We keep the proof of consent and of withdrawal (email, date, purposes, text, IP and browser) for 24 months, then anonymise it |
| Email alert to the team | The same period as the request it relates to |
| Anti-abuse counts | No more than a day, then the file is deleted at the next submission |
| Choices in the consent panel | 13 months in your browser. Data received by InMobi: as set out in its privacy policy |
| Statistics (Google Analytics 4) | Cookies up to 2 years; event data 2 months; user-level data up to 14 months |
| Emails you send us | As long as we need to reply and, for rights requests, to show how we handled them |
When these periods end, the data is deleted or anonymised.
Browsing, cookies and statistics
Server and Cloudflare
The site runs on an IONOS SE server in the European Union and reaches you through Cloudflare, which acts as a content delivery network (CDN), protects against attacks and handles the encrypted connection (TLS). The server accepts only connections that come from Cloudflare, checked with a two-way certificate (mutual TLS). To do this, Cloudflare sees your IP address and the request data, including what you send through the forms.
The server logs the requests it receives to spot attacks and faults, not to find out who reads what.
The consent panel (InMobi Choice)
Cookie consent is collected by InMobi Choice, a consent management platform run by InMobi Technology Services Pte. Ltd. (Singapore) and registered with IAB Europe for version 2.4 of the Transparency & Consent Framework (TCF). Outside the United States the panel asks for your consent. In the United States InMobi works on an opt-out basis instead: it shows the "Do Not Process My Personal Information" panel and honours the Global Privacy Control signal.
The panel is downloaded from InMobi's servers, so your browser sends InMobi your IP address (from which InMobi derives your country to apply the right rules), technical browser data and your choices. For this data InMobi acts as an independent controller, as set out in its CMP data protection agreement, and handles it under its own privacy policy.
The panel lists the vendors registered in the TCF, more than a thousand, because that is the standard shared by every site that uses it. This site loads code from none of them: after consent, only Google Analytics starts.
Google Analytics 4
- Outside the United States, Google's script is not loaded until you accept. It needs TCF purpose 1, one of the measurement purposes (8 or 9), the Google vendor and Google's consent for statistics. If you refuse or do not choose, statistics stay off.
- In the United States, statistics start on the first visit. You can opt out in the panel at any time; with the Global Privacy Control signal they stay off without you doing anything.
- Google Signals is off and ad personalisation is disabled. Google Analytics 4 does not log or store IP addresses.
- Event data is kept for 2 months and user-level data for up to 14 months. In the reports we see only aggregated data.
You can change your choice at any time with the "Cookie settings" button at the bottom of the page. Cookie names and lifetimes are in the cookie policy.
Advertising
The site shows no ads, does not use Google AdSense and loads no advertising pixels from Meta, TikTok or anyone else. The TCF panel also describes advertising purposes because it is a shared standard, but none of them is in use here.
Where the data comes from and whether you must give it
The data comes from your browser and from what you type into the forms. The only data obtained from others is your country, which InMobi derives from your IP address. We do not buy data.
Statistics are optional. Without your email and the tick we cannot add you to the waitlist; without your name, email, company and the contact tick we cannot set up the demo. All other fields are optional.
Recipients, providers and transfers
We do not sell or pass on personal data. We use technical providers who process it on our behalf, and we disclose data to authorities only when the law requires it. The exception is InMobi, an independent controller for the consent panel data.
| Provider | Service | Data | Where | Safeguards for transfers |
|---|---|---|---|---|
| IONOS SE | Site server; Redbit's mail server | Logs, consent record, requests, emails | European Union | No transfer outside the European Union |
| Cloudflare, Inc. | CDN, attack protection, encrypted connection | IP address and request data in transit | United States and global network | Data processing agreement; EU-US Data Privacy Framework; standard contractual clauses |
| Google Ireland Limited and Google LLC | Statistics (Google Analytics 4), only when on | The statistics data described above | Ireland and United States | Google's data processing terms; EU-US Data Privacy Framework; standard contractual clauses |
| InMobi Technology Services Pte. Ltd. (independent controller) | Consent panel | IP address, technical browser data, choices, panel views | Singapore and other countries outside the European Union | Standard contractual clauses (Decision (EU) 2021/914), provided for in its CMP agreement |
The standard contractual clauses are approved by the European Commission (Art. 46 GDPR). The EU-US Data Privacy Framework rests on the Commission's adequacy decision of 10 July 2023.
Your rights
Articles 15 to 22 of the GDPR give you the right to:
- access your data and get a copy;
- rectify inaccurate or incomplete data;
- have your data erased when it is no longer needed or the processing is unlawful;
- restrict processing in the cases provided for;
- receive your data in a structured format (portability), for processing based on consent or on your request;
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting processing already carried out: for emails, use the "Unsubscribe me" link; for statistics, the "Cookie settings" button.
Write to [email protected]. We reply within one month; for complex requests this can be extended by two further months, and we will tell you so within the first (Art. 12 GDPR).
Complaints
If you believe the processing breaks the law, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the supervisory authority of the EU country where you live or work. If you live in the United Kingdom, you can also contact the Information Commissioner's Office.
Automated decisions
We make no automated decisions about you and we do no profiling (Art. 22 GDPR).
Children
The site is aimed at publishers and businesses. We do not knowingly collect data from children under 14. If you think a child has left their details with us, write to us and we will delete them.
Security
Pages are served only over HTTPS: an unencrypted request is redirected. The server accepts connections only from Cloudflare. The record and the requests are kept outside the site's public folder, and the fingerprint chain makes any change to the record visible. In the event of a data breach we will follow Articles 33 and 34 of the GDPR.
Visitors from the United States
This section applies to residents of California, where the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) applies, and of other states with similar laws. We extend these rights to every visitor from the United States, even where the thresholds of these laws do not apply to us.
What we collect. Identifiers (IP address, _ga cookie identifiers, email, and name and phone if you give them), professional information (company, website, leads per month, industries), internet activity (pages viewed, referrer, browser) and an approximate area derived from the IP address. Purposes and retention periods are those described above. We do not ask for sensitive personal information.
We do not sell or share. We do not sell personal information and we do not share it for cross-context behavioral advertising. We treat the Global Privacy Control signal as a valid opt-out request: if your browser sends it, statistics stay off. You can do the same from the "Do Not Process My Personal Information" panel, which opens on your first visit and reopens with the "Cookie settings" button.
Your rights. You can find out what data we hold about you and get a copy, ask us to correct or delete it, opt out of sale or sharing (which we do not do), and not be discriminated against for exercising these rights. Write to [email protected] with the subject "US privacy request"; an agent you have authorised in writing can do this too. We verify your identity by matching the details you give us with those we hold, and we reply within 45 days, extendable by a further 45 days with a reasoned notice. If we turn the request down, you can appeal with the subject "Appeal": we reply in writing within 45 days. If you are not satisfied with the outcome, you can contact your state's Attorney General or, in California, the California Privacy Protection Agency.
Changes to this notice
The date of the last update is at the bottom of the page. We update the text when the way we handle data changes. Each sign-up records the version of the short notice you saw in the form.
Updated 3 November 2026