This is a personal site: there are no accounts and no ads, and nothing is sold or shared for marketing. It handles personal data in four places: the newsletter, the contact form, the visit counter and the server itself. Below is what each one keeps, why, and for how long.
Who is responsible
The data controller is me, Roberto Gallea, in Italy. For anything about your data, write to me through the contact form. I have not appointed a data protection officer.
The newsletter
When you subscribe, I store your email address, together with the time, IP address and browser user agent of your signup and of your confirmation. These details are the proof that you asked for the newsletter and confirmed it, so I keep them as long as you are subscribed.
The legal basis is your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every email, or by writing to me. Your email address is the only thing you have to give, and without it I cannot send you the newsletter.
The list lives in the site's own database, on its server. When you confirm, I receive an email with your address and the number of subscribers.
The emails are delivered by Brevo (Sendinblue SAS, 9-17 rue Salneuve, 75017 Paris, France), which acts as my processor under its data processing agreement. Brevo stores data in the EU only, at OVH in France and Germany and at Google Cloud in Belgium.
I add no tracking to the emails. Brevo, however, adds open and click tracking to the emails it delivers, and it can't be switched off completely: I set it to the most private options available, so statistics are anonymous and opens and clicks are not tracked per person without consent.
If you don't confirm within 7 days, your signup is deleted. When you unsubscribe, your address and its consent record are deleted from the list.
The contact form
The form asks for your name, email address, a subject and a message, so that I can reply. The legal basis is my legitimate interest in answering the messages people send me (GDPR Art. 6(1)(f)).
Each message is stored on the site's server and emailed to me, through Brevo as above. I keep messages until I delete them; write to me and I will delete yours.
Analytics
I count visits with GoatCounter, to know which pages people read. It uses no cookies and stores nothing in your browser, and it keeps only totals, such as page views per day, referrers and browser types. To count unique visits it holds your IP address and user agent in memory for up to 8 hours, without ever saving them.
GoatCounter is run by Martin Tournoij, in the Republic of Ireland, on servers of Hetzner Online GmbH in Finland and Germany. The totals stay until I delete the account, plus 30 days of backups. The legal basis is my legitimate interest in knowing how the site is used (GDPR Art. 6(1)(f)).
Hosting
The site runs on a server rented from Webdock.io ApS (Tværvejen 9A, 5580 Nørre Aaby, Denmark), in Webdock's own data centre in Denmark, and the data never leaves the EU. Webdock is my processor under its data processing agreement.
Like any web server, it records each request in its logs: your IP address, the address you asked for, the time and your browser's user agent. I use the logs to keep the site running and secure, which is my legitimate interest (GDPR Art. 6(1)(f)), and they are deleted as they rotate.
Cookies and other services
The site sets two cookies, a session cookie and a security token, which the forms need to protect against forged submissions. If you pick a light or dark theme, your choice is saved in your browser and never sent to the server. Fonts are served by the site itself.
Some pages embed a video from YouTube or Vimeo. The player loads from youtube-nocookie.com, or from Vimeo with do-not-track turned on, and those services receive your IP address and browser details when the player loads; their own privacy policies apply.
Your rights
Under the GDPR you can ask me to access, correct or delete your data, to restrict or object to how I use it, and to receive it in a portable format. Where the legal basis is consent, you can withdraw it at any time, without affecting what happened before. Write to me through the contact form.
No decisions about you are made automatically, and no profiles are built.
If you think I am handling your data unlawfully, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, or to the authority of the EU country where you live or work.