Privacy policy
Last updated: 5 October 2026
Who we are
The controller of personal data collected through this website is Chimera Agency S.r.l. — To Be All Group, registered office at Via Valtellina 12, 20159 Milan, Italy, VAT number 13089060969, share capital € 10,000 fully paid up.
For anything concerning your data, write to chimeragency@legalmail.it.
What we collect
When you browse the site we collect only aggregated usage data: how many times a page is opened and which page it was reached from. We don't know who you are, we don't recognise you from one visit to the next, and we build no profile of you.
We use no third-party analytics, we don't share data with advertising companies, and we don't load content from other websites: everything you see comes from our own servers.
To avoid counting the same visit more than once in a day we use a temporary technical reference, which resets every night. Your network address is not retained.
When you write to us. If you fill in the contact form we collect what you give us: name, company, email address and the text of your message, along with the talent the request refers to. We use them to reply and to handle the request: nothing else, and we pass them to no one.
When you talk to our assistant. We keep the text of the conversation, to improve our answers and to reconstruct what happened if something goes wrong. If you type personal data into the chat, it stays in the conversation: that's why we ask you not to enter more than necessary.
We also read conversations as a whole, to understand what kind of needs are brought to us: which skills are asked for most often, which registers and which formats. It helps us grow the roster in the right direction. This is a reading of the whole, not of the individual: we build no profile of the people who write to us, we do not link conversations to a company in order to assess it, and the content of your request is neither shared with other clients nor used for them. If you would rather your conversation stayed out of this too, write to us and we will exclude it.
Data from our talent's social profiles
Talent we represent may connect their own Instagram professional account to our internal platform, authorising us to read their data directly.
What we read: username, account type, profile picture, follower and media counts; reach and profile views over the last thirty days; aggregated audience data — age ranges, gender, top cities and countries; recently published content with its metrics.
Why: to keep the talent's internal profile up to date and to build the proposals we send to brands, without asking them to send us the same figures manually every time.
On what basis: on the representation agreement between us and the talent, and on the authorisation the talent grants by connecting their own account. The connection is made by the talent, not by us: we never know or ask for their password.
Audience data is aggregated. We receive percentages and totals — how many followers fall in an age range, how many in a city — never the identity of the individual people who follow the talent. We do not profile or contact our talent's audience.
For how long: as long as the connection remains active. We also keep a monthly snapshot of the figures, to show trends over time, for a maximum of twenty-four months.
How it ends: the talent can revoke the authorisation at any time, from their own Instagram settings or by writing to us. From that moment we stop reading any data. They can also ask us to delete everything we have read from their account, and we will.
Why we use it
Contact form data is used to answer your enquiry and to explore a possible collaboration: it is necessary to act on what you asked us.
Conversations with the assistant are used to provide the service you requested by using it, and to improve how it works, on the basis of our legitimate interest in offering a useful tool.
Reading conversations as a whole, described above, guides how we grow our roster: it rests on our legitimate interest in understanding what the market is asking for. You may object at any time by writing to us, without losing the use of the assistant.
The temporary technical reference protects the form and the assistant from abuse, on the basis of our legitimate interest in keeping them working.
If a business relationship follows, the data needed to manage it is processed to perform the contract and to comply with related legal obligations, in particular tax obligations.
Aggregated usage data helps us understand which pages are opened, on the basis of our legitimate interest in doing our job well. It is never used to advertise to you, never combined with other data, and never about you as an individual.
The assistant does not make decisions on our behalf. It gives you information and suggestions about our talent: every assessment concerning a collaboration is made by the agency's people.
How long we keep it
Contact requests are automatically deleted 24 months after they are closed.
Conversations with the assistant are automatically deleted after 12 months.
The technical reference that protects the form and the assistant from automated submissions is deleted after 30 days.
Usage data is automatically deleted after 14 months. Only daily totals remain, and those are about nobody in particular.
Data linked to an active business relationship is kept for the period required by law, in particular tax law.
You can ask us to delete your data earlier at any time, and we will, unless a legal obligation requires us to keep it.
Who we share it with
We do not sell or transfer your data to anyone.
To run the website we rely on technical providers which process data on our behalf, as processors:
- a provider hosting the site, the database and file storage;
- the providers of the artificial intelligence models that process the messages exchanged with the assistant.
An up-to-date list of our processors is available on request, by writing to chimeragency@legalmail.it.
Audience data of talent who authorise it is shown to brands within the proposals and media kits we prepare, in aggregated form and always with the consent of the talent concerned.
Where it is processed
The database and files are stored on servers located in the European Union, in Ireland.
The messages you exchange with the assistant are also processed in the United States. The infrastructure that routes them is located in the European Union, but processing takes place at United States providers. This transfer is covered by the Standard Contractual Clauses approved by the European Commission, which our provider has entered into with its own providers and which give you directly enforceable rights.
Conversation content is not used to train artificial intelligence models.
If you would rather your messages did not leave the European Union, do not use the assistant and write to us through the contact form: that data stays in Ireland.
The site is protected and delivered by Cloudflare's global network: the request your browser sends passes through the node closest to you, which may be outside the European Union. In that step Cloudflare processes on our behalf only the technical data of the connection, and the transfer is covered by the Standard Contractual Clauses approved by the European Commission.
Cookies and browser storage
This site uses no profiling or analytics cookies, and stores no identifier in your browser that would follow you from one visit to the next. That is why you see no consent banner: there is nothing to consent to.
There is one technical cookie, and it is only fair to say so: it is set by Cloudflare, the network that protects the site, to tell people apart from automated programs. It lasts thirty minutes, cannot be read by the site's pages, and is not used to recognise or profile you. It is strictly necessary for security and by law requires no consent.
In your browser's storage the site keeps only what it needs to work: the language you chose and, if you are talking to our assistant, the text of the ongoing conversation, so it isn't lost when the page reloads. For as long as the tab stays open it also keeps which page you arrived from — this feeds the visit counts — and how far down the page you had read. None of this leaves your device for other companies, and none of it identifies you.
Agency staff accessing the private area have their login session data stored, which is necessary to stay authenticated.
Your rights
You can ask us at any time to access your data, correct it, delete it, restrict its use, receive it in a readable format, or object to its processing.
Write to chimeragency@legalmail.it: we reply within thirty days.
If you believe your data is being handled improperly, you can contact the Italian Data Protection Authority, www.garanteprivacy.it.
Changes
If we change this policy we will update the date at the top of the page. Previous versions remain available on request.