Skip to main content

Privacy notice

Last updated: 26 October 2026

This website is the personal portfolio of Angelo D'Agostino, who is the data controller for the processing described here. You can reach him through the contact page. The site is built to collect as little as possible: there is no advertising, no analytics and no tracking. The one exception: when I send my CV through a private link, opening and downloading it is counted, and so is starting a PDF download from the public Curriculum page, as described in “Private CV links”.

Hosting and security (Cloudflare)

  • The site runs on Cloudflare Workers. To deliver pages and protect the site, Cloudflare processes technical data of every request, such as your IP address, the address requested, the browser's user agent and the time.
  • Short technical logs (request metadata and error messages) are kept by Cloudflare's Workers Logs for at most 3 days, to diagnose faults and abuse.
  • Legal basis: legitimate interest in operating and securing the site (art. 6(1)(f) GDPR). Cloudflare, Inc. acts as processor under its Data Processing Addendum; transfers outside the EU rely on the EU–US Data Privacy Framework and Standard Contractual Clauses.

Contact form and correspondence

  • Purpose: to read and answer your message and to keep the conversation that follows in one place. When you write through the contact form, your name, your e-mail address, the type of request you choose and your message are stored in the site's database as a conversation, and the owner is notified by e-mail. The owner's replies, and your answers to them, are added to the same conversation.
  • What is stored for each conversation: your name and e-mail address, the type of request, the language of the page, the messages as plain text with their date and time and, for the owner's replies, the delivery status reported by the mail provider (accepted, delivered, delayed, bounced, marked as spam). Your IP address, browser details and tracking identifiers are not stored.
  • No tracking and no profiling: replies are sent as plain text, without tracking pixels or rewritten links, so nobody records whether or when you open a message or click a link. Your data is not used for profiling, marketing or automated decisions.
  • Attachments are not imported: if you reply with an attachment, only its file name is noted and the file is discarded. E-mails written in HTML are reduced to plain text and never displayed as web content, so no remote content is loaded.
  • Providers, acting on the owner's instructions: Cloudflare (hosting on Workers, and Email Routing, which receives your replies); Resend (sends the owner's replies from contact@angelo-dagostino.com and reports their delivery events back to the site — sending happens from Resend's EU region, eu-west-1 in Ireland, but Resend stores the data it processes, that is the messages it sends and their delivery events, in the United States, under the EU–US Data Privacy Framework and the EU Standard Contractual Clauses incorporated in its data processing agreement); Neon (the PostgreSQL database where conversations are stored, hosted in the EU on AWS eu-central-1, Frankfurt).
  • To stop automated abuse, the form uses Cloudflare Turnstile (a privacy-preserving check) and a short-lived rate limit keyed on your IP address; neither stores your data after the check.
  • The legacy edition of the site (legacy.angelo-dagostino.com) has the same form. It sends what you type to this site, through the same checks and with the same effect as above, and sets no cookie.
  • Retention: a conversation is kept while it is open. Once archived, it is deleted automatically after 12 months. Mail that cannot be matched to a conversation is deleted after 30 days unless the owner files it; technical delivery-event records are deleted after 30 days. The owner can export or delete a conversation at any time, and does so on request.
  • Legal basis: your request (art. 6(1)(b) GDPR), and the owner's legitimate interest in answering, keeping a record of the correspondence and protecting the form (art. 6(1)(f) GDPR). To receive a copy of your conversation or have it deleted, write through the contact page or reply to any message.

Cookies and local storage

  • theme — remembers light or dark mode (1 year). lang-choice — remembers your language (1 year), and is written only when you pick a language with the language switcher; opening a page in a language stores nothing. These are strictly necessary for features you choose, so no consent banner is needed for them.
  • Legacy edition (legacy.angelo-dagostino.com): no cookie. It keeps legacy-lang in local storage — your language, written only when you follow one of its language links — and legacy-theme — light or dark mode, written only when you use its toggle — plus two short-lived session-storage entries that stop the opening loader and the page transition from replaying. Preferences only: no identifier, never sent to the server.
  • ad:hc:v1:* local-storage entries — remember whether you have already seen the opening animation and the 3D hint, and whether you have entered the 3D experience, so they are not replayed. Interface preferences only: no identifier, never sent to the server.
  • No advertising or analytics cookies are used. Cloudflare may set strictly technical security cookies.

Private CV links (counting views and downloads)

  • When I send my CV through a private link, I count how that link is used, so I can tell whether the document reached the right person. This covers documents opened through such a link and PDF downloads started from the public Curriculum page (there the page view itself is not counted, only the download, with no link attached); the rest of the site is not affected. Opening the document and starting a PDF download are each counted once a day, with the language you used and, for a download, the theme, the photo choice and the kind of file (designed or plain ATS version).
  • What is stored for a count: a pseudonymous code, the day, the language, the choice made on a download, and which link was used. The code is calculated from a shortened form of your IP address (the last part is dropped) and your browser's user agent, mixed with a secret that changes every day. Your IP address, your user agent and your identity are not stored, and because the secret changes daily the same person gets a different code each day and on each link. The code is pseudonymous: it remains personal data, and while the day's secret exists someone who holds it could test whether a code matches a given address and browser.
  • The daily secret is deleted after at most 48 hours (database backups kept by the provider for its restore window can hold it a little longer). Counts are kept for 13 months and then deleted; deleting a link deletes its counts. Visits from the owner's own signed-in browsers, search-engine and link-preview robots, and browsers that only pre-load a page are left out of the counts as far as the site can tell; the owner opening a link on a device that never signed in to the admin area would be counted.
  • What the sender sees: totals of views and downloads, per language and per link, and when each link was last opened. Each link carries a label that only the owner sees (for example the company or role it was sent to); it is never shown to you and never appears in a document.
  • Cookies: opening the document sets one strictly necessary session cookie, used only to keep it open (it ends after 30 minutes of inactivity, after 8 hours at most, or when you press Close). No analytics or tracking cookies are used and nothing is stored on your device for counting.
  • Legal basis: legitimate interest in knowing whether the documents I send are opened (art. 6(1)(f) GDPR). The data is processed on the site's hosting and database providers named elsewhere in this notice, acting as processors. To ask what is held about you, to object, or to have it deleted, write through the contact page and mention the link or the day you used it; since a code cannot be traced back to a person without the day's secret, I may not be able to single out your records, and I will tell you so.

Embedded media

  • Some interactive scenes play music or video through YouTube's privacy-enhanced embed (youtube-nocookie.com). When a player loads, Google receives technical data such as your IP address, under Google's privacy policy.

Your rights

  • You can ask for access to, correction or deletion of your personal data, restriction of or objection to its processing, and data portability (arts. 15–22 GDPR), by writing through the contact page.
  • You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or the authority of your country.