Privacy Policy

Data controller

The data controller is Antonio Morlino. For requests concerning the protection of personal data you can write to dev@antoniomorlino.com.

Personal data processed

The site may process the following categories of data:

• data sent voluntarily through the contact form, such as type of request, name, email, subject, message and any attached file (an image or a PDF, for example a CV), which arrives only by email and is not stored on the site;
• data sent through the personal data management page, such as email, request type and message;
• technical data required for the operation and security of the site, such as IP address, user agent, date and time of the request, referring page when available;
• cookie preferences, technical visitor identifier and consent events log;
• statistical browsing data collected through Google Analytics 4, only if the user enables the Analytics category: pseudonymous browser identifier, pages viewed, date and time, source channel, language, device and browser type, approximate geographic area;
• technical data needed to access and protect the admin area, if used by the controller;
• for the students area, only the student's email, the password they choose (stored in encrypted form), the request, activation and last access dates and the access status;
• for the clients area, none of the data entered is saved: to limit repeated attempts, an encrypted fingerprint (hash) of the IP address and email used is kept for a maximum of 24 hours.

Purposes and legal bases

• Replying to requests sent via the contact form: performance of pre-contractual measures requested by the user or legitimate interest in managing professional communications.
• Handling requests relating to privacy rights: compliance with obligations under applicable law.
• Store cookie preferences and consent given by the user: compliance with transparency obligations and legitimate interest in documenting the choices made.
• Managing the student area, that is sending the activation link and letting enabled users access lesson materials and educational games: delivery of the service requested by the student.
• Ensuring security, preventing abuse and keeping the site and admin area working properly: legitimate interest in the security of the service.
• Measuring how the site performs with Google Analytics 4, that is how many people visit it, which pages they read and which channel they come from: user's consent, revocable at any time. Without consent the tool is not loaded.
• Enabling any other optional marketing tools only after the user's consent, should they be configured in the future.

Restricted area: students and clients

The student area is reserved for my students, including minors: that is why it asks only for the email, with no name, photo or profile. School addresses immediately receive a single-use activation link valid for 7 days; other addresses are approved manually. By opening the link the student reads and accepts the dedicated notice and chooses a password, which is never sent by email. Inside there is the lesson material, available for download, and the educational games, which use the same login. Downloads and game usage are not logged; the code written in the games stays in the browser. All the details are in the students area notice.

The client area is used to show temporary previews of sites and apps in progress to those who receive the credentials. As long as there are no active previews it lets no one in and does not store the data entered.

Provision of data

Providing data in the forms is optional, but necessary to receive a reply or to handle the request sent. Technical browsing and security data is necessary to deliver the site, record preferences correctly and protect the systems.

Recipients and providers

Data may be processed by technical providers that support the delivery of the site, such as hosting, database, network services, libraries loaded from CDN and email services if configured. In production the site is planned on Netsons hosting with a dedicated database. Data is not sold or disclosed to third parties for independent commercial purposes.

The site's emails (service replies, admin area access codes, activation links and student area notifications) are delivered by Brevo (Sendinblue SAS, France) on my behalf. The site's forms may use the Cloudflare Turnstile anti-robot check: Cloudflare, Inc. receives the technical browser data needed for the check, with the guarantees required by the GDPR for transfers to the United States.

If the user enables the Analytics category, the statistical browsing data is processed by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as data processor, according to the Google Analytics data processing terms.

The Pro licence for the plugins is purchased through Freemius, Inc., which sells it as a reseller: the data entered at checkout (name, email, payment and billing details) goes directly to Freemius, which processes it as an independent controller under its own policy (freemius.com/privacy). The site does not receive it and does not store it; from Freemius I receive the sales data needed to provide the licence and support.

Transfers outside the EEA

If a technical provider processes data outside the European Economic Area, the transfer takes place only where there is an adequacy decision or the safeguards required by the GDPR, such as standard contractual clauses or equivalent measures applicable to the service used.

Google Analytics may involve a transfer of data to the United States: Google LLC adheres to the EU-US Data Privacy Framework, which is the subject of an adequacy decision by the European Commission, and additionally applies the standard contractual clauses provided for by the GDPR.

Freemius is based in the United States: anyone buying a Pro licence sends their checkout data to Freemius under the safeguards described in its privacy notice.

Retention

Data sent through the contact form and privacy requests is kept for as long as necessary to handle the request and, as a rule, no longer than 24 months, unless further protection of rights, legal obligations or requests from the data subject apply. Consent events are kept for as long as necessary to document the choices made and the site's compliance. Cookie preferences saved in the browser follow the durations indicated in the Cookie Policy.

The statistical data collected through Google Analytics is retained for 14 months from collection and then automatically deleted.

In the student area, an enabled address is deleted after 24 months without access; an activation link never used after 90 days from the last send; an undecided request after 90 days; a refused or revoked address after 12 months. Technical data on access attempts and requests is deleted after 24 hours.

Rights of the data subject

Users may request access, rectification, erasure, restriction, objection and data portability in the cases provided for by the GDPR. Where processing is based on consent, users may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. To start a request use the Personal data management page or write to dev@antoniomorlino.com.

Complaint to the authority

If you believe that the processing of your personal data infringes applicable law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or apply to the competent judicial authority. More information is available on the Garante's website: how your personal data is protected.

Cookies

The site uses technical cookies for operation, preferences and security, including the reserved area session cookie, which expires when the browser is closed. The Analytics category enables Google Analytics 4 cookies and is loaded only after consent; the Marketing category stays off, because no advertising services are connected. Preferences are described in the Cookie Policy and can be changed at any time from the link in the footer.

Browsing statistics

The site uses Google Analytics 4 for one purpose only: to know how many people visit it, which pages they read and which channel they come from (search, direct link, social, other sites). Measurement starts only after consent is given through the cookie banner: without consent the Google script is not loaded and no data is sent.

The configuration excludes advertising: Google signals are disabled, no advertising profiling or remarketing activity is carried out and the data does not feed advertising products. The information collected remains statistical and does not allow the visitor's identity to be traced.

Consent can be withdrawn at any time from the "Cookie preferences" button in the footer: measurement stops and the Google cookies already present in the browser are removed. Details of the individual cookies are in the Cookie Policy.

Automated processes

The site does not use automated decision-making or profiling with legal or similarly significant effects on the user.

Updates

This notice may be updated in the event of technical, regulatory or organisational changes. The version published on this page shows the date of the last update.