Lipp respects the privacy of everyone who visits the site or gets in touch. This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and describes clearly what personal data I collect, why, on what legal basis, where it is processed, for how long, and how you can exercise your rights. If anything isn't clear, write to
hello@lipp.dev.
Data controller
The data controller is Luca Piacentini (Lipp), based in Rome, Italy.
No Data Protection Officer (DPO) is appointed, as it is not mandatory under GDPR Art. 37. For any matter concerning personal data the point of contact is the controller:
hello@lipp.dev · +39 331 85 35 877.
Personal data I collect
Contact form. When you submit the form I collect first name, last name, email, type of service requested, project description, desired timeline and budget range. Providing your name, email and project description is required in order to follow up on your request: without them I cannot reply. The other fields are optional and only help me frame the request.
Browser technical storage. To improve your experience the site stores some information in your browser via
localStorage (these are not cookies):
lp_lang — selected languagelp_accent — custom accent colourlp_scroll — scroll position from the last session (30 minutes TTL)lp_chat_v1 — draft message in the contact form (24 hours TTL)lp_consent_v1 — your cookie choice
This information stays on your device, is never sent to a server and can be deleted from your browser settings at any time.
Server technical logs. The hosting provider Vercel automatically records technical logs (IP address, user-agent, timestamp) for security, abuse prevention and diagnostic purposes. They are not used for profiling nor cross-referenced with other data to identify you.
Email communications. If you write me an email or reply to one of mine, I retain our conversation for as long as needed to manage the professional relationship.
I do not collect special categories of data (GDPR Art. 9, e.g. health, opinions, orientation) and ask you not to include them in your messages.
Purpose and legal basis
I process your data for the purposes listed below, on the legal basis indicated:
- Reply to your requests via form or email — pre-contractual measures at your request (GDPR Art. 6.1.b);
- Deliver the service if we become client and contractor — contract performance (GDPR Art. 6.1.b);
- Comply with legal, tax and accounting obligations — legal obligation (GDPR Art. 6.1.c);
- Maintain technical logs, ensure site security and prevent abuse — legitimate interest (GDPR Art. 6.1.f);
- Store technical preferences in the browser — legitimate interest, strictly necessary for the requested service;
- Any statistical analysis or optional third-party tools — consent (GDPR Art. 6.1.a), withdrawable at any time from the cookie banner.
Data recipients
Your data is processed by the following providers, acting as data processors under GDPR Art. 28 and with whom a data processing agreement (DPA) is (or will be) in place:
- Resend (Resend Inc., USA) — sending the notification of your request to me and the confirmation email to you;
- Supabase (Supabase Inc., USA) — structured storage of contact form requests, when active;
- Vercel (Vercel Inc., USA) — site hosting and service logs.
Data may also be disclosed to advisors (e.g. an accountant) or to competent authorities where required by law. I do not sell your personal data to third parties and I do not use it for advertising profiling.
Transfers outside the EU
Some of the providers listed above are based in the United States. Transfers take place under appropriate safeguards pursuant to Chapter V of the GDPR: Standard Contractual Clauses approved by the European Commission (SCC) and, where the provider has joined it, certification under the EU-US Data Privacy Framework. A copy of the safeguards in place can be requested by writing to the controller.
Retention period
I keep data only for as long as necessary for the purposes it was collected for:
- Form request emails and data: up to 24 months from the last interaction, unless earlier deletion is requested or a contractual relationship begins;
- Data relating to contracts and tax obligations: for the period required by law (usually 10 years);
- Technical logs: managed by the provider, usually no longer than 12 months;
- Browser technical storage: within the time windows in section 2 (24h / 30min / persistent until you clear or change consent).
Security of processing
I adopt appropriate technical and organisational measures under GDPR Art. 32 to protect your data: encrypted transmission via HTTPS/TLS, access restricted to the controller alone, selection of providers offering adequate guarantees, and data minimisation. No system is 100% secure; in the event of a personal data breach posing a risk to your rights, I will act under GDPR Arts. 33-34, notifying the supervisory authority and, where required, the data subjects.
Automated decision-making
I do not carry out any automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of GDPR Art. 22.
Minors
The site and the services offered are not directed at minors. I do not knowingly collect personal data from children under 14; if you believe a minor has provided me with data without proper authorisation, write to
hello@lipp.dev and I will delete it.
Your rights
As a data subject you have the right to:
- access the data concerning you (Art. 15);
- correct it (Art. 16);
- request its erasure (Art. 17);
- restrict processing (Art. 18);
- receive the data in a readable format and port it elsewhere (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of prior processing (Art. 7.3);
- lodge a complaint with the Italian Data Protection Authority.
To exercise your rights, write to
hello@lipp.dev. I'll reply without undue delay and in any case within 30 days (GDPR Art. 12). Exercising your rights is free of charge.
Cookies and similar technologies
The site currently does not use profiling cookies or third-party analytics. Browser technical storage (see section 2) is strictly necessary for the site to function or tied to preferences you set voluntarily, and therefore does not require consent.
Specifically, the
localStorage entries used are:
lp_lang — selected language;lp_accent — custom accent colour;lp_scroll — scroll position from the last session (30 minutes TTL);lp_chat_v1 — draft message in the contact form (24 hours TTL);lp_consent_v1 — your cookie choice.
This is first-party technical storage, kept only on your device and never sent to a server; you can delete it at any time from your browser settings.
When I activate optional tools in the future (e.g. Vercel Analytics or error tracking), they will only run after your explicit consent, manageable from the banner you see on first visit and reopenable at any time via the “Cookie” link in the footer.
Changes to this policy
Any changes will be communicated by updating the “Last updated” date at the top. Substantive changes (e.g. new purposes or new data processors) will also be notified via the cookie banner on your next visit, so that a fresh consent can be requested where necessary.
