The small print
Privacy Policy
Last updated:
1. Who we are
This website is operated by Matteo Greco. For privacy questions or requests, contact privacy@matteogreco.net.
2. What data we collect and why
Website analytics
We use Umami Cloud to understand website usage and newsletter referrals. It processes page, referral and technical request information. We use the reports for general trends, not to identify or contact visitors. Aggregated reports do not mean that no personal data or identifiers are processed.
Newsletter links include shared campaign parameters, not your email address or subscriber ID. We do not send names, email addresses or message contents as custom analytics properties.
Our legal basis is our legitimate interest in maintaining and improving the website (Article 6(1)(f) GDPR).
Newsletter
We use Brevo to send occasional new-article emails to subscribers, using your email address and optional name. Signup is optional and separate from contacting us. New website subscriptions require email confirmation. We keep signup-request and subscription records to document requests and manage consent and duplicate-message prevention.
Our legal basis is your consent (Article 6(1)(a) GDPR). You can unsubscribe through any newsletter or contact us, and update your name through the preferences link. Withdrawing consent does not affect earlier lawful processing.
Brevo's anonymous reporting provides aggregate open and click counts for newsletters and confirmation emails, rather than linking those events to individual contact profiles in those reports. Emails may still contain tracking pixels and redirected links. We do not use individual open/click reports to profile readers.
Contact and article feedback
We process your name, email address, message, optional answers, page/article details and privacy acknowledgement to respond and handle feedback. Article feedback is private, not a public comment. Any newsletter choice is recorded separately and requests email confirmation; sending a message does not subscribe you.
Submissions and delivery records are stored in Cloudflare D1. Postmark delivers messages to our Google Workspace inbox, with Postmark open and link tracking disabled.
Our legal bases are Article 6(1)(b) GDPR for contract-related or pre-contractual requests, and Article 6(1)(f) for ordinary correspondence and abuse prevention.
Hosting and security
Cloudflare Workers hosts the website and form services; Cloudflare D1 also stores signup-request records. Cloudflare provides DNS and security services. IP addresses and browser/request information are processed for delivery and abuse prevention. Our form database stores a pseudonymous IP digest, not the raw IP address; this is not necessarily anonymous data.
Our legal basis is our legitimate interest in a secure, functioning website (Article 6(1)(f) GDPR).
3. Data location and transfers
These providers operate internationally. Data may be stored, processed or accessed outside the European Economic Area, including in the United States.
Their published terms describe transfer arrangements including adequacy decisions, the EU–US Data Privacy Framework for covered transfers, and Standard Contractual Clauses with supplementary safeguards where required. The applicable arrangement depends on the provider, service, destination and agreement. Contact us for information or a copy of relevant safeguards.
4. How long we keep data
We retain data only as long as needed for its purpose, taking account of your choices and applicable obligations:
- Subscription details while your newsletter subscription is active. Limited consent and suppression records may remain after unsubscribing to respect your choice and prevent unwanted emails. Unconfirmed legacy records remain inactive.
- Correspondence and delivery/security records while needed to handle requests, follow-up issues and proportionate security or legal needs.
- Analytics statistics and technical records while needed to understand website usage, subject to the service's retention arrangements.
Deletion requests are considered across our databases, providers, inbox and restricted archives or backups. Minimal suppression records may still be needed to prevent further unwanted emails.
5. Your rights under GDPR
You have the right to:
- Access your personal data
- Request correction or deletion
- Restrict or object to processing
- Withdraw consent without affecting earlier lawful processing
- Lodge a complaint with the Garante per la protezione dei dati personali (Italy's data protection authority)
To exercise your rights, contact privacy@matteogreco.net.
6. Changes
Updates will be posted here with a new "last updated" date.