About this website
This is an author showcase website. It does not manage shopping carts, orders, payments or payment-card data. Purchase links open external bookstores, which independently handle sales and buyers’ data.
Controller and contact
The data controller is Luca Crudi. For personal-data requests, email contacts@lucacrudi.com with “Privacy” as the subject, or use the contact form. contact form.
Contact form
The form collects email, subject and message to handle and answer the request and generates a reference code. It also stores an email hash to limit repeated submissions: this is pseudonymised, not anonymous, data and is deleted with the message. The legal basis is taking pre-contractual steps requested by the data subject when appropriate (Article 6(1)(b) GDPR) and otherwise the controller’s legitimate interest in handling correspondence (Article 6(1)(f)). Messages are not used for marketing and are kept only as long as needed, with a retention deadline twelve months after closure recorded by the controller, subject to documented legal or defence exceptions. Legacy messages without a closure date require controller review. Maintenance deletes expired data and records its last successful run; the controller checks it and can run it manually. New attachments are disabled; any legacy attachment is accessible only to the controller and follows the message’s retention period.
Reviews and moderation
Reviews collect a nickname, rating, text, date and a technical content fingerprint used to prevent duplicates; no email is requested. Publication relies on the reviewer’s separate consent (Article 6(1)(a) GDPR), while abuse prevention and moderation rely on legitimate interest (Article 6(1)(f)). Approved reviews remain while relevant or until withdrawal or removal; unapproved reviews expire after ninety days and are deleted by maintenance. New submissions record the date and version of the accepted publication statement.
Travelling copies
The register collects a copy code, stop type, city or area, country, the name and address of a public place, optional geographic coordinates, date and an optional note. New submissions stay private until the controller approves them; unapproved submissions expire after ninety days. Approved public details power the map, directions, availability, ranking and Limes recognition. Device location is requested only after an explicit action. Visitors can also select a point on the map or enter the address manually. When automatic completion is used, coordinates rounded to five decimal places (roughly metre-level precision, not anonymous data) are sent through the site to OpenStreetMap’s Nominatim service to obtain the selected point’s address; they are not stored in the site database until the stop is submitted. Names and contact details are not requested; homes, private addresses and other personal data are forbidden. Submission and publication rely on consent given in the form (Article 6(1)(a) GDPR); moderation and abuse prevention rely on the controller’s legitimate interest (Article 6(1)(f)). A stop remains public while useful to the register or until removal is requested.
Automatic Sites statistics
Sites automatically records traffic, unique visitors and page views and provides the controller with aggregate statistics. This site adds no advertising SDK. The precise identifier and retention period used by the platform are not exposed in the project. The controller uses these statistics only to understand site use, without advertising profiling, on the basis of legitimate interest (Article 6(1)(f) GDPR).
Clicks to bookstores
When a tracked link is selected, the database stores the action name, destination URL, page path and date. The application does not store cookies, IP addresses or user agents in this table. The purpose is aggregate conversion measurement based on legitimate interest. Raw records expire after twelve months and are removed by maintenance. Query strings and fragments are stripped from new destination URLs; aggregate summaries may be kept while useful.
Technical providers and recipients
The site runs on OpenAI Sites and Cloudflare infrastructure, including Workers, D1, R2 for event posters, photographs, videos and any legacy attachments, CDN, security and technical logs. These providers may process technical data to deliver and protect the service. On the Travelling copies page, OpenStreetMap’s Nominatim receives rounded coordinates and essential request data from the server when a visitor asks for automatic address completion. The location picker uses OpenStreetMap only after the visitor chooses to load it: the browser contacts its tile servers for the visible map area and sends ordinary technical connection data. The embedded Google Maps map loads only after selecting “Load Google Maps”: the browser contacts Google and may transmit the IP address, technical information and identifiers linked to the browser or Google account. Bookstores receive data only when their link is opened and apply their own notices.
Cookies and browser storage
The 9 October 2026 check detected Cloudflare’s __cf_bm cookie, strictly necessary for bot protection and expiring after about thirty minutes of inactivity. Abuse controls store only site-wide function counters, without IP addresses or visitor identifiers, expiring within two hours and removed by maintenance. The public application code sets no language-preference, advertising or profiling cookie and uses neither localStorage nor sessionStorage. The optional Google Maps embed is disabled when the page opens. If enabled, Google may use its own cookies or technologies depending on the browser, settings and any Google account. Use the adjacent button to disable the map; manage any cookies already set through your browser or Google settings. The site does not store this choice.
Transfers outside the EEA
Sites does not currently guarantee EEA data residency, including databases, files and logs. Its DPA identifies OpenAI Ireland Ltd as the contracting entity for EEA users and OpenAI as the processor of hosted data. Onward transfers outside the EEA rely on Standard Contractual Clauses or European Commission adequacy decisions under the DPA. Links to the DPA and sub-processor list appear below; information about safeguards can be requested at contacts@lucacrudi.com. External mapping services follow their own privacy notices.
Private area sign-in
Administrative access uses Sign in with ChatGPT. After authentication, the site receives the email and, when available, profile name to verify the controller’s access. The platform manages the session and necessary authentication cookies. This protects site administration and personal data on the basis of legitimate interest (Article 6(1)(f) GDPR). Public pages and submission forms do not require an account.
Photographs and videos
The controller checks publication rights before publishing event media. Main descriptive and location metadata are removed from new uploads; this does not conceal people, documents or locations visible or audible in the content. Older files require a separate review.
Rights and complaint
You may request access, correction, deletion, restriction, objection and portability where applicable and, where processing relies on consent, withdraw it at any time without affecting earlier processing. You may also lodge a complaint with the Italian Data Protection Authority at www.garanteprivacy.it.
Handling privacy requests
The controller keeps a private record of the requester’s reference, right exercised, receipt date, actions and response to fulfil legal obligations concerning data subject rights (Article 6(1)(c) GDPR). Closed cases and the minimal activity log expire after twelve months and are removed during maintenance. Any additional documented need to defend legal claims is assessed separately.
Last updated
9 October 2026. This notice describes functions verified in the project and is not an automatic claim of full GDPR compliance.
Newsletter
The newsletter is being prepared: subscriptions are not active and no addresses are collected for this purpose. Contact-form and travelling-copy data are not automatically subscribed to the newsletter.