Who is responsible
The controller of your personal data on caioricciuti.com isCaio Ricciuti, an individual established in Spain. For anything privacy-related, write to me@caioricciuti.com.
The short version
- Reading this site sets no cookies and needs no account.
- Visits are counted with self-hosted, cookieless analytics that do not store your IP address.
- If you use the contact form, I get what you type in it, and nothing else.
- I do not sell your data, share it for advertising or profile you.
What is collected, and why
Contact form
The form on the consulting page asks for yourname, email address, an optionalservice you are interested in, and yourmessage. The site does not store them: they are sent straight to my inbox as an email, sent by my own mail server (hosted by Hetzner in Finland), with your address set as the reply-to. I use them only to answer you and, if we agree to work together, to prepare and carry out that work.
Legal basis: taking steps at your request before a possible contract (GDPR Art. 6(1)(b)), and my legitimate interest in answering messages sent to me (Art. 6(1)(f)).
Spam protection (Cloudflare Turnstile)
The contact form is protected by Cloudflare Turnstile, a CAPTCHA alternative. Its script loads only when you start filling in the form, not when you merely read a page. When it runs, your browser sends Cloudflare technical data such as your IP address, browser and device characteristics, which Cloudflare uses to tell people from bots. The server then asks Cloudflare whether the check passed, sending the check's result token and your IP address.
Legal basis: my legitimate interest in keeping the form free of spam and abuse (Art. 6(1)(f)), and a check that is necessary for the message you chose to send.
Anti-abuse limits
To stop the contact form being used to flood my inbox, the server counts submissions per IP address in memory for up to 24 hours. These counters are never written to disk and disappear when the server restarts.
Visit statistics (Umami)
To see which pages are read, this site uses Umami, running on my own server at a.caioricciuti.com. No third party receives this data. For each page view it records the page address (without the query string or fragment), the referring site, the browser, operating system and device type, screen size, language, and a country, region and city derived from your IP address at that moment. Your IP address itself is not stored, no cookies are set, and page views are grouped only by an anonymous session identifier. I look at the results as aggregated statistics; they are not used to identify or profile you.
Legal basis: my legitimate interest in knowing how my own site is used (Art. 6(1)(f)), within the conditions the Spanish Data Protection Agency (AEPD) sets for audience measurement that needs no consent: first-party only, statistics only, no cross-site tracking, and disclosed here.
You can opt out on this browser at any time. Opting out stores a singleumami.disabled flag in this browser's local storage, which the analytics script checks before sending anything.
Server logs
Like any web server, the one hosting this site keeps access logs of each request: IP address, date and time, the address requested, referring page and user agent. They exist to keep the site running and secure (diagnosing faults, blocking attacks). Short-lived request traces with the same kind of data are kept for up to 30 days. Logs rotate automatically and are deleted as they age out; they are not used for analytics or shared with anyone.
Legal basis: my legitimate interest in operating a secure website (Art. 6(1)(f)).
Who else handles your data
- Hetzner Online GmbH (Germany) hosts the server, in a data centre in Finland. Everything on this site, including the analytics, the logs and the mail server that sends contact-form messages, runs there.
- Cloudflare, Inc. (United States) runs the Turnstile spam check on the contact form.
- Google hosts the mailbox at me@caioricciuti.com, where contact-form messages and emails you send me arrive.
Cloudflare and Google process data in the United States or elsewhere outside the EU. Those transfers rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, under each provider's data processing terms.
Links to other sites (GitHub, LinkedIn, X and others) are plain links: nothing is loaded from them until you click one, and then their own privacy policies apply.
How long it is kept
- Contact messages: in my mailbox for as long as needed to deal with your enquiry. If it leads to paid work, what the law requires me to keep for tax and accounting is kept for the periods the law sets.
- Analytics: at most 25 months.
- Server logs and traces: a few weeks at most, as described above.
- Backups of the server are kept for up to 14 days, so deleted data can survive in them for up to that long.
Your rights
You can ask me for access to your personal data, and to correct, delete, or restrict it, to receive it in a portable format, or object to processing based on legitimate interest. Email me@caioricciuti.com; I will answer within one month.
If you think your data is being handled unlawfully, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the supervisory authority where you live or work.
Other things worth knowing
- No automated decision-making or profiling takes place.
- Giving your data is voluntary. Without an email address I cannot reply to a message.
- If this notice changes, the new version is published here with a new date.