This page explains what happens to your email address if you give me one, and what is measured when you read something here. It is short because very little happens in either case.
Who is responsible
I am. Arnaldo De Lisio, Italy. You can reach me at delisioarnaldo@gmail.com. I am the data controller for anything described here.
What is collected
An email address, and only when you type it into the form and submit it. Nothing else is collected from you.
Why, and on what legal basis
I use the address to send you my essays by email. The legal basis is your consent, under Article 6(1)(a) of the GDPR. You give that consent by submitting the form and then clicking the confirmation link in the double opt-in email that follows. You can withdraw it at any time by using the unsubscribe link at the bottom of any email I send, which stops everything from that moment on and does not affect what was lawful before it.
Who else handles it
Buttondown, LLC, 406 W Franklin St. #201, Richmond, VA 23221, United States, stores the address and sends the emails on my behalf, as a processor acting on my instructions. Their data processing agreement and list of subprocessors are public.
Transfer outside the EU
Because Buttondown operates in the United States, your address is processed there. That transfer is safeguarded by the European Commission’s standard contractual clauses, Implementing Decision (EU) 2021/914.
How long it is kept
Until you unsubscribe or ask me to delete it. After that it is removed.
Your rights
You have the right to access your data, to have it corrected, to have it erased, to restrict how it is processed, to receive it in a portable form, to object to processing, and to withdraw your consent. Email delisioarnaldo@gmail.com and I will handle it directly.
If you think I have handled your data badly, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, at garanteprivacy.it.
Cookies and analytics
This site sets no cookies and carries no tracking pixels. Nothing is stored on or read from your device.
It does use Vercel Web Analytics, run by Vercel Inc. in the United States as a processor on my instructions, under their data processing agreement. It counts page views and referrers in aggregate, so I can see whether a piece is read and where readers came from. The script is served from this domain, so the page makes no request to a third party.
What it does not do: no cross-site tracking, no advertising profile, no attempt to work out who you are. Vercel derives a temporary identifier from the incoming request, and that identifier resets every 24 hours.
One custom event is recorded when someone submits the subscribe form, so I can tell whether the writing leads anywhere. It records that a submission happened and which page it came from, not who made it. Your email address goes to Buttondown, never to Vercel.
The legal basis here is legitimate interest, Article 6(1)(f) of the GDPR, rather than consent, because nothing is stored on or read from your device. That is also why you see no cookie banner.