Privacy Policy

Last updated: August 5, 2026 — version 5.0 (previous: August 3, 2026, v4.1)

This Privacy Policy describes how the website www.andreapiani.com (hereinafter "Website") collects, uses, and protects users' personal data, in compliance with the General Data Protection Regulation (GDPR - EU Regulation 2016/679).

The Website is a static site hosted on Vercel with one single serverless function (/api/lead), which exists solely to deliver contact-form submissions to the Controller by email. There is no database, no analytics or tracking, no profiling cookies, no chatbot and no AI assistant. Since 5 August 2026 the Website also serves all of its own assets (fonts, images, stylesheets, scripts) from its own domain, so merely browsing it triggers no request to any third-party server. The amount of personal data processed is therefore minimal, as described below.

1. Types of Data Collected

The Controller collects the following types of personal data:

1.1 Data Provided Voluntarily by the User (contact forms)

The Website's contact and quote-request forms collect the data you type — typically:

• Name and Surname
• Email
• Phone Number (optional)
• Company/Organization (optional)
• Project Description and other technical information provided in forms

Step by step:

1. Typing — while you type, the data stays in your browser.
2. Submission — on submit, a script of the Website (assets/js/lead-capture.js) collects the completed fields and sends them over HTTPS to the serverless function /api/lead, running on the Vercel infrastructure.
3. Delivery — the function composes an email and delivers it to the Controller through the transactional email service Resend (Resend Inc., USA). The email lands in the Controller's Gmail mailbox. If you provided a valid email address, it is set as the message's Reply-To.
4. WhatsApp (optional) — in parallel, your browser opens WhatsApp with a pre-filled message. This step is your choice: if you complete it, the message also transits through Meta Platforms Ireland Ltd. If you do not, step 3 has happened anyway.

There is no database: the data is not stored by the serverless function or on any server of the Website — the only stable copy is the email in the Controller's mailbox. It is not passed to any CRM, marketing-automation platform or third-party form service, and it feeds no profiling and no marketing lists. Legal basis: pre-contractual measures at your request (Art. 6.1.b GDPR) — your consent is not required for this purpose, and for that reason it is not requested; what you are owed is information, which is given here and in short form underneath every form.

1.2 Navigation Data

The Website performs no analytics and no tracking: no statistics endpoint, no measurement cookie, no logging of pages visited or clicks. Simply browsing the Website does not cause the Controller to store your IP address.

The following technical data is nevertheless processed:

• Hosting connection logs at Vercel Inc., which — like any web host — may process the connection IP address and basic request metadata to deliver the pages and ensure security and availability of the service (see §4).
• IP address when a form is submitted: the /api/lead function reads the request's source IP (X-Forwarded-For header) and keeps it in volatile memory for 60 seconds for the sole purpose of rate-limiting submissions and blocking automated floods. The IP is never written to disk, never included in the email sent to the Controller and never linked to the form data. Legal basis: legitimate interest in the security of the service (Art. 6.1.f GDPR, Recital 49).
• Anti-spam honeypot: forms contain a hidden field that human users never see or fill in. If it is filled, the submission is discarded. It collects no personal data.

1.3 Cookies and Local Storage

The Website uses:

• Cookies: none. Since 5 August 2026 the Website sets no cookies at all — the former cookie_consent cookie existed only to remember an answer to a consent banner that had nothing to consent to, and both have been removed.
• localStorage: only technical user-interface preferences (for example the dark-mode theme). No tracking identifiers are stored.
• Profiling or third-party analytical cookies: none.

For more details, see our Cookie Policy.

2. Purpose of Processing and Legal Basis

Purpose	Legal Basis (GDPR)	Retention Period
Respond to quote/contact requests (incl. delivery of the form via /api/lead and Resend)	Performance of pre-contractual measures (Art. 6.1.b GDPR)	24 months from last contact; no storage on the Website side (transit only)
Form security and abuse prevention (per-IP rate limit, anti-spam honeypot)	Legitimate interest (Art. 6.1.f GDPR)	IP in volatile memory for 60 seconds, never written to disk
Send commercial communications/newsletter	Explicit consent (Art. 6.1.a GDPR)	Until consent withdrawal
Tax and accounting compliance	Legal obligation (Art. 6.1.c GDPR) — law of the Controller's country of establishment (Spain: Ley 58/2003, Código de Comercio art. 30) and, for relationships governed by Italian law, DPR 633/1972 and art. 2220 Civil Code	6 years from the last accounting entry (10 years where Italian law applies)
Hosting and delivery of the static site (technical connection logs at the hosting provider Vercel)	Legitimate interest (Art. 6.1.f GDPR) — security and availability of the service	According to the hosting provider's retention policy

3. Processing Methods

Personal data is processed using IT and telematic tools, in compliance with GDPR security measures. Processing is carried out:

• ✓ With predominantly automated methods
• ✓ For the time strictly necessary for the purposes for which they were collected
• ✓ With access limited only to the Controller and authorized data processors
• ✓ Adopting adequate technical and organizational security measures: HTTPS/TLS on every connection; HTTP security headers on every page (Content-Security-Policy restricting resource loading to the Website's own domain, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, Strict-Transport-Security); no third-party assets; origin checks, per-IP rate limiting and an anti-spam honeypot on the form function; service credentials held in the hosting provider's environment variables and never in the published source code

4. Data Communication and Disclosure

4.1 Data Recipients

Your personal data may be communicated to:

• Vercel Inc. — Hosting provider (static-site CDN) for andreapiani.com, Covina, California, USA. As processor, may handle technical connection logs (IP address, request metadata) — Privacy Policy
• Meta Platforms Ireland Ltd. (WhatsApp) — Delivery of contact messages, but only if you actively send the pre-filled message from your own WhatsApp app — Privacy Policy
• Resend Inc. — Transactional email service that delivers contact-form submissions to the Controller's mailbox (Delaware, USA). Processes the form data only for as long as delivery requires — Privacy Policy
• Google LLC / Google Ireland Ltd. — Gmail, the Controller's mailbox, which receives the form emails (USA / Ireland) — Privacy Policy
• Accountant / tax consultants — Only for contractual/tax compliance

No third party receives data merely because you open a page. Since 5 August 2026 the Website serves all of its assets (fonts, images, stylesheets, scripts) from its own domain: there are no longer any requests to Google Fonts, Unsplash, Flickr or other external CDNs. Browsing the Website therefore discloses your IP address only to the hosting provider (Vercel), as is technically unavoidable for any website. Every other recipient listed above comes into play only if you take an action: submitting a form, clicking a WhatsApp link, or sending an email.

Transfers outside the EU: Some providers (Vercel, Resend, Google/Gmail and, where applicable, Meta/WhatsApp) may process data in the USA. There are no transfers to China or to any other non-EU country. Such transfers occur through:

• ✓ The EU–US Data Privacy Framework, where the provider is certified
• ✓ Standard Contractual Clauses approved by the European Commission
• ✓ Adequate safeguards provided by Art. 44-49 GDPR

4.2 No Public Disclosure

Your personal data will never be publicly disclosed or sold to third parties for commercial purposes.

5. Your Rights (Art. 15-22 GDPR)

As a data subject, you have the right to:

6. Data Security

The Controller adopts adequate technical and organizational security measures to protect personal data from unauthorized access, loss, destruction, or disclosure, including:

• ✓ HTTPS/SSL encryption for all communications
• ✓ Static architecture with no database, which minimizes the attack surface and the amount of data at rest
• ✓ Data minimization: no analytics, no tracking, no server-side storage of form data
• ✓ Limited access to data only by authorized personnel

7. Cookies and Similar Technologies

The Website sets no cookies at all and uses no analytical or profiling cookies. For detailed information on:

• Types of cookies used
• Duration and purposes
• How to manage/disable cookies

See our Cookie Policy.

8. Minors

The Website's services are not directed at minors under 16 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data, contact us for immediate deletion.

9. Changes to the Privacy Policy

This Privacy Policy may be updated periodically for regulatory compliance or service changes. Changes will be published on this page with an update of the date at the top. We invite you to regularly consult this page.

10. Contact and Complaints

← Back to Homepage