Controller and contact
The data controller is Luca Crudi. For personal-data requests, use the contact form with “Privacy” as the subject. The controller’s personal email address is not published for security reasons. contact form.
Contact form
The form collects email, subject and message to handle and answer the request. The legal basis is taking pre-contractual steps requested by the data subject when appropriate (Article 6(1)(b) GDPR) and otherwise the controller’s legitimate interest in handling correspondence (Article 6(1)(f)). Messages are not used for marketing and are kept only as long as needed, no longer than twelve months after closure unless legal or defence needs apply. New attachments are disabled; any legacy attachment is accessible only to the controller and follows the message’s retention period.
Reviews and moderation
Reviews collect a nickname, rating, text, date and a technical content fingerprint used to prevent duplicates; no email is requested. Publication relies on the reviewer’s separate consent (Article 6(1)(a) GDPR), while abuse prevention and moderation rely on legitimate interest (Article 6(1)(f)). Approved reviews remain while relevant or until withdrawal or removal; unapproved reviews are deleted within ninety days.
Travelling copies
The register collects a copy code, stop type, city or area, public place, date and optional note. It does not request names or contact details and forbids personal data. A stop remains public while useful to the register or until removal is requested.
Automatic Sites statistics
Sites automatically records traffic, unique visitors and page views and provides the controller with aggregate statistics. This site adds no advertising SDK. The precise identifier and retention period used by the platform are not exposed in the project. The controller uses these statistics only to understand site use, without advertising profiling, on the basis of legitimate interest (Article 6(1)(f) GDPR).
Clicks to bookstores
When a tracked link is selected, the database stores the action name, destination URL, page path and date. The application does not store cookies, IP addresses or user agents in this table. The purpose is aggregate conversion measurement based on legitimate interest. Raw records are retained for no more than twelve months; aggregate summaries may be kept while useful.
Technical providers and recipients
The site runs on OpenAI Sites and Cloudflare infrastructure, including Workers, D1, R2 reserved for any legacy attachments, CDN, security and technical logs. These providers may process technical data to deliver and protect the service. Google Maps receives browsing data only after the visitor chooses to load it. Bookstores receive data only when their link is opened and apply their own notices.
Cookies and browser storage
The 31 August 2026 check detected Cloudflare’s __cf_bm cookie, strictly necessary for bot protection and expiring after about thirty minutes of inactivity. The site sets no language-preference, advertising or profiling cookie and uses neither localStorage nor sessionStorage. Google Maps is blocked until user action. As only technical tools or user-triggered services are present, no consent banner is shown; this section is the essential cookie notice.
Transfers outside the EEA
Sites currently provides no data residency for Sites, D1, R2 or logs; Cloudflare states that cookie data may also be processed in the United States. The project code does not reveal which contractual safeguard applies to this account. The controller must retain and verify the providers’ data-processing terms and any Standard Contractual Clauses before stating a more specific basis.
Rights and complaint
You may request access, correction, deletion, restriction and objection and, where processing relies on consent, withdraw it at any time without affecting earlier processing. You may also lodge a complaint with the Italian Data Protection Authority at www.garanteprivacy.it.
Last updated
31 August 2026. This notice describes functions verified in the project and is not an automatic claim of full GDPR compliance.