Lipp respects the privacy of everyone who visits the site or gets in touch. This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and describes clearly what personal data I collect, why, on what legal basis, where it is processed, for how long, and how you can exercise your rights. If anything isn't clear, write to
hello@lipp.dev.
Data controller
The data controller is Luca Piacentini (Lipp), based in Rome, Italy.
No Data Protection Officer (DPO) is appointed, as it is not mandatory under GDPR Art. 37. For any matter concerning personal data the point of contact is the controller:
hello@lipp.dev · +39 331 85 35 877.
Personal data I collect
Contact form. When you submit the form I collect first name, last name, email, type of service requested, project description, desired timeline and budget range. Providing your name, email and project description is required in order to follow up on your request: without them I cannot reply. The other fields are optional and only help me frame the request.
Browser technical storage. To improve your experience the site stores some information in your browser via
localStorage (these are not cookies):
lp_accent — custom accent colourlp_chat_v1 — draft message in the contact form (24 hours TTL)lp_consent_v1 — your cookie choicelp_lang_hint_off — language notice already dismissed
In
sessionStorage (cleared when you close the tab):
lp_scroll — the section to resume from after a reload (30 minutes TTL)lp_lang_switch — records that you just switched language, so the intro is not replayed
This information stays on your device, is never sent to a server and can be deleted from your browser settings at any time.
Server technical logs. The hosting provider Vercel automatically records technical logs (IP address, user-agent, timestamp) for security, abuse prevention and diagnostic purposes. They are not used for profiling nor cross-referenced with other data to identify you.
Email communications. If you write me an email or reply to one of mine, I retain our conversation for as long as needed to manage the professional relationship.
I do not collect special categories of data (GDPR Art. 9, e.g. health, opinions, orientation) and ask you not to include them in your messages.
Purpose and legal basis
I process your data for the purposes listed below, on the legal basis indicated:
- Reply to your requests via form or email — pre-contractual measures at your request (GDPR Art. 6.1.b);
- Deliver the service if we become client and contractor — contract performance (GDPR Art. 6.1.b);
- Comply with legal, tax and accounting obligations — legal obligation (GDPR Art. 6.1.c);
- Maintain technical logs, ensure site security and prevent abuse — legitimate interest (GDPR Art. 6.1.f);
- Store technical preferences in the browser — legitimate interest, strictly necessary for the requested service;
- Any statistical analysis or optional third-party tools — consent (GDPR Art. 6.1.a), withdrawable at any time from the cookie banner.
Data recipients
Your data is processed by the following providers, acting as data processors under GDPR Art. 28 and with whom a data processing agreement (DPA) is (or will be) in place:
- Resend (Resend Inc., USA) — sending the notification of your request to me and the confirmation email to you;
- Supabase (Supabase Inc., USA) — structured storage of contact form requests, when active;
- Vercel (Vercel Inc., USA) — site hosting, service logs and, only with your consent, aggregate statistics via Vercel Web Analytics (no cookies, no profiling);
- Sentry (Functional Software Inc., USA) — error diagnostics: server-side for the functions handling the form, and in the browser only with your consent to the statistics category;
- Google (Google Ireland Ltd. / Google LLC, USA) — the mailbox where I receive the notification of your request is hosted on Gmail, so the content of the form passes through it and is stored there.
Data may also be disclosed to advisors (e.g. an accountant) or to competent authorities where required by law. I do not sell your personal data to third parties and I do not use it for advertising profiling.
Transfers outside the EU
Some of the providers listed above are based in the United States. Transfers take place under appropriate safeguards pursuant to Chapter V of the GDPR: Standard Contractual Clauses approved by the European Commission (SCC) and, where the provider has joined it, certification under the EU-US Data Privacy Framework. A copy of the safeguards in place can be requested by writing to the controller.
Retention period
I keep data only for as long as necessary for the purposes it was collected for:
- Form request emails and data: up to 24 months from the last interaction, unless earlier deletion is requested or a contractual relationship begins;
- Data relating to contracts and tax obligations: for the period required by law (usually 10 years);
- Technical logs: managed by the provider, usually no longer than 12 months;
- Browser technical storage: within the time windows in section 2 (24h / 30min / persistent until you clear or change consent).
Security of processing
I adopt appropriate technical and organisational measures under GDPR Art. 32 to protect your data: encrypted transmission via HTTPS/TLS, access restricted to the controller alone, selection of providers offering adequate guarantees, and data minimisation. No system is 100% secure; in the event of a personal data breach posing a risk to your rights, I will act under GDPR Arts. 33-34, notifying the supervisory authority and, where required, the data subjects.
Automated decision-making
I do not carry out any automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of GDPR Art. 22.
Minors
The site and the services offered are not directed at minors. I do not knowingly collect personal data from children under 14; if you believe a minor has provided me with data without proper authorisation, write to
hello@lipp.dev and I will delete it.
Your rights
As a data subject you have the right to:
- access the data concerning you (Art. 15);
- correct it (Art. 16);
- request its erasure (Art. 17);
- restrict processing (Art. 18);
- receive the data in a readable format and port it elsewhere (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of prior processing (Art. 7.3);
- lodge a complaint with the Italian Data Protection Authority.
To exercise your rights, write to
hello@lipp.dev. I'll reply without undue delay and in any case within 30 days (GDPR Art. 12). Exercising your rights is free of charge.
Cookies and similar technologies
The site does not use profiling cookies and installs no third-party cookies. Browser technical storage (see section 2) is strictly necessary for the site to function or tied to preferences you set voluntarily, and therefore does not require consent.
Specifically, the
localStorage entries used are:
lp_accent — custom accent colourlp_chat_v1 — draft message in the contact form (24 hours TTL)lp_consent_v1 — your cookie choicelp_lang_hint_off — language notice already dismissed
In
sessionStorage (cleared when you close the tab):
lp_scroll — the section to resume from after a reload (30 minutes TTL)lp_lang_switch — records that you just switched language, so the intro is not replayed
This is first-party technical storage, kept only on your device and never sent to a server; you can delete it at any time from your browser settings.
Two optional tools are in use, both conditional on your consent to the “Statistics” category. Vercel Web Analytics measures visits in aggregate, without cookies and without profiling. Sentry collects diagnostics for errors that occur in your browser (error message, page, browser type) so that I can fix them. Neither is downloaded without your consent. If you withdraw it, the analytics script is removed from the page and error diagnostics are closed: from that moment nothing further is transmitted, with no need to reload. Because of a technical limitation in Sentry, the handlers it already registered in the open tab stay in memory until you reload, but they send nothing. You can change your mind at any time via the “Cookie” link in the footer.
Changes to this policy
Any changes will be communicated by updating the “Last updated” date at the top. Substantive changes (e.g. new purposes or new data processors) will also be notified via the cookie banner on your next visit, so that a fresh consent can be requested where necessary.
