Privacy policy
What this site collects, why, for how long and who it is shared with. No boilerplate.
In short
This site is a personal portfolio. It sells nothing, has no visitor accounts and sets no profiling cookies. The data it handles is minimal and listed below one item at a time: technical server logs, whatever you type into the contact form and — only if you explicitly accept — anonymous, cookieless visit statistics.
No data is ever sold, shared with third parties for commercial purposes, or used to profile you.
Data controller
The data controller is Federico Musso (online: Numbfede), a private individual based in Italy. This site is a personal project: it is not a company and no business activity is carried out through it.
For anything concerning your data, write to numbfede@gmail.com. No Data Protection Officer has been appointed, as the conditions of Art. 37 GDPR do not apply.
If you write to me
This site has no contact form: the “get in touch” buttons simply open your own mail app with the address filled in. The message therefore leaves from your mailbox, not from the site, and the site keeps no copy of it.
- Data processed: whatever you choose to write in your email (typically your name, your email address and the content of the message).
- Purpose: reading your message and replying to it.
- Legal basis: steps taken at your request prior to a possible agreement, and the legitimate interest in replying to people who write (Art. 6.1.b and 6.1.f GDPR).
- Retention: the message stays in the controller's mailbox for as long as the conversation is useful, and is deleted once it no longer is.
The controller's mailbox is hosted on Gmail: as the email provider, Google processes the content of incoming messages under its own terms. If you would rather not go through Google, you can reach me via the social profiles listed on the site.
Visit statistics (only with your consent)
The site may use Vercel Web Analytics to understand which pages get read. The tool is loaded only if you choose “Accept all” in the banner: if you choose “Essential only”, or choose nothing at all, the script is never even downloaded.
- It uses no cookies and builds no persistent visitor identifier.
- It collects aggregate data: page viewed, referrer, country, device and browser type.
- Legal basis: your consent (Art. 6.1.a GDPR), revocable at any time from the “Cookies” button in the footer.
Data stored on your device
The site sets no cookies on visitors' devices. It does use your browser's local storage to remember a few preferences. That information stays on your device and is never transmitted to any server. The full list is in the cookie policy.
Providers and recipients
| Provider | Role | Data involved |
|---|---|---|
| Vercel | Site hosting and, with your consent, visit statistics | Technical logs, IP address, aggregate visit data |
| Google (Gmail) | Mailbox receiving the emails you send me | Content of the emails received |
| Fontshare | Delivery of the Clash Display and Satoshi typefaces | IP address and technical request data |
Some of these providers are based or run infrastructure outside the European Union: in those cases the transfer relies on the safeguards of Chapter V GDPR (typically standard contractual clauses and, for participating US providers, the EU-U.S. Data Privacy Framework). Data is not disclosed to anyone else, nor made public.
Your rights
You can exercise the rights granted by Articles 15-22 GDPR at any time by writing to the controller. In particular, you may request:
- access to the data concerning you, and a copy of it;
- rectification of inaccurate data or completion of incomplete data;
- erasure of your data (right to be forgotten);
- restriction of processing, and objection to processing based on legitimate interest;
- portability of data processed on the basis of consent or a contract;
- withdrawal of consent at any time, without affecting the lawfulness of processing already carried out.
If you believe the processing breaches the law, you may lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it), with the supervisory authority of your own country, or bring the matter before a court.
Children
The site is not aimed at children under 14 and does not knowingly collect their data. If a parent or guardian believes a child has submitted data through the form, they can ask for its deletion by writing to the controller.
Changes
This policy may be updated if the site's features or providers change. The date at the top marks the latest update; earlier versions can be reconstructed from the site repository's public history.