/ Privacy Policy

Data Controller: Alessandro Sanino — VAT ID IT04128340041 — alessandro@sanino.dev — certified email (PEC): alessandro.sanino@pec.it

This policy describes how personal data is processed when you use this website (alessandro.sanino.dev) and the related services, in accordance with Regulation (EU) 2016/679 (“GDPR”). No Data Protection Officer has been appointed, as the processing carried out does not require one; for any privacy matter you can contact the controller directly at the addresses above.

Whose data, and where it comes from

The data processed concerns visitors of this website and people who get in touch (prospects, clients). All data is collected directly from you — through the contact form, the call booking, the newsletter subscription, or the free AI tools. No data is obtained from third-party sources. This website is not directed at children under 14, and no data of minors is knowingly collected.

What data is processed, and why

Contact form

If you use the contact form, the data you submit (name, email address, message content) is processed to respond to your inquiry and handle any follow-up.

• Legal basis: taking steps at your request prior to entering into a contract (art. 6(1)(b) GDPR).
• Processor: form submissions are collected and stored by Netlify (Netlify, Inc., USA), which hosts this website.
• Retention: for the time needed to handle your request, and no longer than 12 months from the last contact, unless a business relationship follows.

Call booking

If you book a call, your data (name, email, and any notes you add) is processed by Cal.com through its EU-hosted service (cal.eu) to schedule and manage the appointment.

• Legal basis: taking steps at your request prior to entering into a contract (art. 6(1)(b) GDPR).
• Retention: for the time needed to manage the appointment and any resulting engagement.

Newsletter

If you subscribe to the newsletter (hosted on Substack, at saniales.substack.com), your email address is processed to send you the newsletter itself.

• Legal basis: your consent (art. 6(1)(a) GDPR), given at subscription. You can withdraw it at any time via the unsubscribe link included in every email, without affecting the lawfulness of processing carried out before withdrawal.
• Processor: Substack Inc. (USA). Subscription takes place on the Substack platform, whose own privacy policy also applies to your relationship with Substack.
• Retention: until you unsubscribe.

Hosting and server logs

This website is hosted by Netlify (Netlify, Inc., USA). Like any hosting provider, Netlify may temporarily process technical data (such as IP addresses) in server logs for security and service delivery purposes.

• Legal basis: legitimate interest in the security and operation of the website (art. 6(1)(f) GDPR).
• Retention: logs are kept for the short technical periods defined by the provider (as a rule, no longer than 30 days), unless needed to investigate security incidents.

Live chat

This website uses the Chatway live-chat widget (operated by Poptin LTD, Israel) to let you ask questions in real time. If you start a conversation, the messages you send and any contact details you choose to provide (name, email) are processed to answer you. The widget may also process technical data of visitors (IP address, pages visited, browser and device information) to operate the chat service.

• Legal basis: taking steps at your request prior to entering into a contract for chat conversations (art. 6(1)(b) GDPR); legitimate interest in offering a real-time support channel for the technical operation of the widget (art. 6(1)(f) GDPR).
• Processor: Poptin LTD (Israel) acts as data processor; its privacy policy also applies.
• Retention: chat conversations and contact details are retained for the time needed to handle the conversation and any follow-up, and are periodically deleted.

AI tools — free cloud cost assessment

If you use the free cloud cost assessment (under /ai-tools/), the data you submit — your email address and the PDF document you upload (a cloud invoice or quote, which may itself contain personal or financial data) — is processed to generate the assessment and deliver it to your inbox. Technical data (IP address) is also processed for rate limiting and abuse prevention.

How the processing works:

1. The text of your PDF is extracted on the service’s own servers, without any AI involvement.
2. Before any AI analysis, personal identifiers found in the text (email addresses, IBANs, VAT/tax IDs, phone numbers) are automatically redacted.
3. Only the redacted text is sent to AI language models through OpenRouter (OpenRouter, Inc., USA), configured with zero-data-retention options so that prompts are not stored or used for training by the model providers.
4. The result is emailed to you through Brevo (Brevo SAS, France, EU).

Despite the automatic redaction, please do not upload documents containing personal data of third parties that is not necessary for the cost analysis — remove or obscure it beforehand.

• Legal basis: performance of the service you request when submitting the form (art. 6(1)(b) GDPR); legitimate interest in preventing abuse for rate limiting (art. 6(1)(f) GDPR).
• Processors: the service runs on Scaleway (EU, Amsterdam); data is stored on an Aiven managed database (EU, Amsterdam); requests are proxied through Cloudflare for security.
• Retention: the uploaded PDF, the extracted text and the generated assessment are automatically deleted 30 days after submission. Within the first 7 days, an identical document may reuse the already-generated result instead of being reprocessed.

Analytics

This website uses Cloudflare Web Analytics (Cloudflare, Inc., USA), a privacy-first measurement tool: it does not use cookies, does not fingerprint devices, and does not track you across sites. Only aggregated, anonymous metrics (page views, referrers, browser type) are collected.

• Legal basis: legitimate interest in measuring website usage (art. 6(1)(f) GDPR). No consent is required as no cookies or persistent identifiers are used.

Nature of data provision

Providing your data is never a statutory obligation. Providing name and email through the contact form or the booking is however necessary to receive a reply or schedule the call, and providing an email address in the AI tools is necessary to receive the assessment: without them, your request cannot be handled. Newsletter subscription is entirely optional.

Cookies and local storage

This website does not use profiling or advertising cookies, and shows no cookie banner because none is required. The browser’s localStorage is used only for technical preferences that never leave your device:

• theme — your light/dark theme preference
• lang — your language preference (English/Italian)

The call booking widget is loaded from cal.eu; when you open it, Cal.com may set its own strictly technical cookies (session and security), which are necessary for the widget to work and are not used for profiling. Their use is governed by Cal.com’s privacy policy.

The Chatway live-chat widget uses its own technical cookies and identifiers, needed to keep your chat session and conversation history across pages. They are not used for advertising or cross-site profiling. Their use is governed by Chatway’s privacy policy.

Recipients and international transfers

Data may be processed by the service providers named above, acting as data processors. No data is sold or shared with third parties for marketing purposes.

• Netlify, Cloudflare and Substack are US companies certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as providing adequate protection.
• Cal.com bookings are processed with EU data residency (cal.eu).
• Poptin LTD (Chatway) is based in Israel, a country covered by a European Commission adequacy decision.
• The AI tools run entirely in the EU (Scaleway and Aiven, Amsterdam) and send emails through Brevo (France, EU). Only the PII-redacted document text is transferred to OpenRouter, Inc. (USA) for AI analysis, under the safeguards of the European Commission’s Standard Contractual Clauses and with zero-data-retention settings.

You can request a copy of, or further information about, the safeguards applied by writing to the controller.

Automated decision-making

The free cloud cost assessment is generated automatically by AI language models, but it is purely informational advice with no legal or similarly significant effects on you: it is not a decision within the meaning of art. 22 GDPR. No other processing involves automated decision-making or profiling.

Your rights

Under articles 15–22 GDPR you have the right to access your data, rectify it, erase it, restrict its processing, and receive it in a portable format, as well as to withdraw any consent given. To exercise these rights, write to alessandro@sanino.dev or alessandro.sanino@pec.it; you will receive a reply within one month. You also have the right to lodge a complaint with the Italian supervisory authority (Garante per la Protezione dei Dati Personali).

Right to object

In addition to the rights above, you have the right to object at any time, on grounds relating to your particular situation, to any processing based on legitimate interest (server logs, analytics, the technical operation of the live chat, and abuse prevention of the AI tools, as described above). In case of objection, the data will no longer be processed for those purposes unless compelling legitimate grounds prevail.

Changes to this policy

Any material change will be published on this page with an updated date.