Xibyl

GDPR overview

There is no mention of the GDPR anywhere on the site. Across the twelve pages collected, the terms GDPR, privacy, informativa, trattamento dei dati, titolare del trattamento and consenso do not appear once. No privacy policy, no terms and conditions and no legal notice are published, and the only quasi-legal page carries an empty body filled by a third-party Cookiebot script whose generic declaration points to a privacy notice that does not exist. The contact form nevertheless collects a name, a company, an email address and a telephone number, with no consent checkbox and no information link, while Cookiebot and Google Tag Manager are loaded. Symptomation is established in Italy, so the regulation applies to it: the absence of any published documentation is a transparency gap a buyer should raise directly.

Who owns the data?

Symptomation publishes no terms and conditions, no privacy policy and no legal notice, so the question of who owns the data collected by Xibyl is left entirely unanswered. The only quasi-legal page on the site is a cookie policy whose body is empty and filled at runtime by a third-party Cookiebot script; that generic declaration refers to a privacy notice that does not exist. Nothing states whether sensor readings, the learned machine models or the resulting forecasts belong to the customer or to the vendor, nor what the vendor may do with them, nor with whom they may be shared. These terms must be obtained in writing from the company before any pilot.

Reuse rights

Because no terms and conditions exist, the site says nothing about whether a customer may reuse the data or the outputs produced by Xibyl, or on what conditions. There is no licence grant, no restriction and no permission clause of any kind to read. The interface is described as providing downloadable reports and KPI monitoring, which implies that measurements and analyses can be exported, but no right is ever attached to that export. Any reuse of the collected signals, of the failure forecasts or of the reports should therefore be negotiated explicitly and written into the supply contract.

Data retention & training

Hosting summary

No hosting country and no hosting region are named anywhere on the site. The only architectural statement is that the predictive algorithms can run locally on the edge computer, on a company server or in the cloud — a deployment topology, not a data location — and the cloud provider is never identified. In practice this means the customer may be able to keep processing entirely on its own premises, which would make the question of jurisdiction moot, but the site never confirms that choice is contractually available or how a cloud deployment would be handled. Nothing is said about where models, historical signals or reports would be stored, nor under which jurisdiction. The public website itself is served from an Italian address, but that describes the brochure site and says nothing about where customer data would live. Prospective buyers should obtain the hosting arrangement, the provider identity and the applicable jurisdiction in writing.