Privacy.

The site is static and asks you for nothing: no form to fill in, no account to create, nothing to accept. The only data that moves on its own is what any server records in order to answer you.

There is a private area under the same address, but it is my desk: I use it to write quotes and keep client records. Nobody signs up, there is nothing to fill in and there is no password to steal — it opens only from my own devices, with biometric recognition.

The host logs your IP address, the date and time, the address of the page requested, your browser and operating system. This keeps the pages coming, keeps the site standing and defends it from abuse: the legal basis is legitimate interest (art. 6(1)(f) GDPR). I do not use this data to profile you and I do not combine it with anything else.

I need to know how many people come through here and which pages they land on, otherwise I am writing blind. For that I use Vercel Web Analytics, which counts visits in aggregate: how many, on which page, from which country, on what kind of device.

It installs no cookies and saves nothing on your device. It does not even recognise you from one day to the next: the code that tells one visit from another is computed on the spot from your IP address and browser, is never stored, and changes every day. What reaches me are numbers, not people. The legal basis is legitimate interest (art. 6(1)(f) GDPR); if you would rather stay out of it, your browser’s analytics blocking is enough.

There are none. Neither mine nor third-party ones: no Google Analytics, no advertising pixels, no profiling and no advertising. That is why there is no banner to dismiss — I would have nothing to ask you.

The only thing left on your device is your preference between the light and dark themes, saved in the browser’s local storage the moment you flip the switch yourself. It never leaves your computer, it never reaches me, and it disappears if you clear the site’s data. It is a technical tool and as such requires no consent (art. 122 of the Italian Privacy Code and the Garante’s guidelines of 10 June 2021).

The typefaces are hosted here too: opening the site, your browser contacts neither Google nor any other outside provider.

Email, phone, WhatsApp and LinkedIn live outside this site: here you only find the address. When you get in touch I process what you send me — your name, your address, your number, whatever you write — to reply and to work out together whether it makes sense to work together. The legal basis is taking steps at your request before entering into a contract (art. 6(1)(b)).

I keep the correspondence for as long as the conversation needs it, and then for as long as it might serve to defend a legal claim. If the contact turns into an engagement, tax records stay for ten years, as the law requires.

The “Book a call” button takes you away from here, to Google Calendar. From that point the data you enter is processed by Google Ireland Limited under its own privacy notice; what reaches me is the appointment with the name and email address you gave. If you would rather not go through Google, write to me: we can fix the same slot by email.

When a conversation turns into a proposal, I send the quote as a web address rather than an attachment. That page is kept out of search engines and cannot be found by guessing: only someone with the link gets there.

To write it I keep what a valid document needs: company name, address, VAT or tax number, and the name, role and contact details of the person I am talking to. The record also holds the notes I take to remember what we said. You give me this data, in the measure it takes to issue the document and carry the work forward. The legal basis is taking steps at your request before entering into a contract, and then performing it if the work goes ahead (art. 6(1)(b) GDPR); for accounting records it becomes a legal obligation (art. 6(1)(c)).

When you open the link, the page notes the moment it was opened, the kind of browser, and a fingerprint computed on the spot from your IP address and browser. It tells me whether the quote arrived and whether it was read, instead of my calling you back blind. The fingerprint changes every day, it exists only so the same reading is not counted twice, and the IP address is never stored anywhere. The legal basis is legitimate interest (art. 6(1)(f)); if you would rather it did not happen, say so and I will send the document as a PDF.

The page does not ask you to accept or decline: there is no form and no button that decides anything. I record the outcome myself after we have spoken, with the date and — if you tell me who gave the go-ahead — the name and role of the person who confirmed. No automated decision-making, no profiling.

The quote stays for as long as the work needs it and, afterwards, for as long as it might serve to defend a legal claim; if it becomes an engagement, tax records stay for ten years. You can ask me to delete it sooner: if it is not yet an accounting document, I will, and the link stops working.

I do not sell data and I do not hand it to anyone. It is seen only by the providers I need in order to work, appointed as processors under art. 28 GDPR.

Vercel Inc., which hosts the site, the private area and the quotes, and gathers the aggregate statistics: pages are served from the Frankfurt region, and for any transfers outside the European Economic Area the provider relies on the European Commission’s standard contractual clauses.

Neon Inc., which runs the database holding the client records and the quotes: the data sits on AWS infrastructure in Frankfurt, under the same standard contractual clauses for any transfers outside the European Economic Area.

IONOS SE, for the domain registration and the mailbox, with servers in the European Union.

Google Ireland Limited, but only if you choose to book a call.

WhatsApp Ireland Limited, but only if you choose to message me on WhatsApp: messages follow WhatsApp’s own privacy policy, and what reaches me is your number, your profile name and what you write.

Beyond them, data may reach my accountant and the authorities, in the cases where the law requires it.

At any time you can ask me to access your data, correct it, erase it, restrict its processing or object to it, and to receive it in a machine-readable format (arts. 15 to 22 GDPR). One email to the address above is enough: I answer within a month.

If you think I am handling your data in a way I shouldn’t, you can turn to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority of the country you live in.