Privacy Policy_

This Privacy Policy describes how Andrea Falcon ("I", "me", the data controller) handles personal data when you visithttps://andreafalcon.dev (the "Website"). It is provided in accordance with Regulation (EU) 2016/679 (GDPR) and the Italian Privacy Code (Legislative Decree 196/2003 as amended byLegislative Decree 101/2018).

1. Data controller

The data controller is Andrea Falcon, based in Udine, Italy. You can reach me at falcon.andrea88@gmail.com for any privacy-related request (see section 7).

2. Categories of personal data processed

• Navigation data — page paths, timestamps, approximate location (country/region derived from IP), browser and device type, referrer. Collected by Google Analytics 4 with IP anonymization enabled.
• Behavioral session data — mouse movement, clicks, scroll, page engagement. Collected by Microsoft Clarity to produce heatmaps and anonymous session recordings.
• Chat messages — any text you submit through the"Ask me anything" chat is sent to my server, then forwarded toMistral AI to generate a reply. Each message, the reply and your user-agent string are stored in a server-side log for abuse monitoring and quality review.
• Consent preferences — the choice you make on the cookie banner (accept/reject per category) is stored in a first-party cookie so the Website remembers it across page loads.
• Server logs — the reverse proxy in front of this site (Traefik) stores request logs for security and operational purposes. These logs may contain IP addresses and are rotated on a short schedule.

3. Legal basis for processing

• Consent (Art. 6(1)(a)) — for Google Analytics 4 and Microsoft Clarity. These tools only run after you grant the "Analytics" category in the cookie banner. You can withdraw consent at any time from the banner (link "Manage preferences" in the footer of the banner).
• Legitimate interest (Art. 6(1)(f)) — for the AI chat feature (providing the service you explicitly asked for by typing a message), for the cookie banner's own first-party storage (necessary to remember your choice), and for reverse-proxy security logs.

4. Purposes of processing

• Aggregate statistics on how the Website is used (analytics).
• Identifying usability issues through heatmaps and session replays.
• Answering questions you ask through the AI chat widget.
• Protecting the Website from abuse, scraping and attacks.

5. Recipients of the data

Personal data is shared only with the following third parties acting asprocessors or independent controllers, each under their own terms:

• Google LLC (Google Analytics 4) —privacy policy, data processed in the United States under adequate safeguards (SCCs).
• Microsoft Corporation (Microsoft Clarity) —privacy statement, data processed in the United States.
• Mistral AI (chat model) —terms, hosted in the European Union.
• CookieYes (consent management) —privacy policy.
• Hosting provider for the Docker container running this Website (infrastructure-level access only).

No personal data is sold or disclosed to third parties for marketing purposes. There is no advertising on this Website.

6. Retention periods

• Google Analytics 4: 14 months (configurable; currently at default).
• Microsoft Clarity: 18 months.
• Mistral chat log (server-side): 90 days, then automatically deleted by a scheduled rotation script (CHAT_LOG_RETENTION_DAYS). Erasure requests are honored immediately regardless of the rotation schedule.
• CookieYes consent record: 12 months.
• Reverse-proxy access logs: rotated roughly every 7–14 days.

7. Your rights

Under Articles 15–22 of the GDPR you have the right to:

• Access the personal data I hold about you (Art. 15).
• Rectify inaccurate or incomplete data (Art. 16).
• Erasure ("right to be forgotten") of your data (Art. 17).
• Restrict processing pending verification (Art. 18).
• Portability — receive your data in a structured format (Art. 20).
• Object to processing based on legitimate interest (Art. 21).
• Withdraw consent at any time for consent-based processing, without affecting prior lawfulness (Art. 7(3)).
• Lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it) or any other EU supervisory authority.

8. How to exercise your rights

Send an email to falcon.andrea88@gmail.com from the address you want verified. I will respond within 30 days (Art. 12(3)). For erasure requests specific to a chat conversation, include the approximate date and a few distinctive words from your message so I can locate it in the log.

9. International transfers

Google Analytics and Microsoft Clarity transfer data to the United States under the European Commission's adequacy decision for theEU-US Data Privacy Frameworkand Standard Contractual Clauses. Mistral AI processes data inside the EU, so no transfer applies.

10. Security measures

The Website is served over HTTPS. The data controller does not store payment data or government IDs. Server access is restricted and authenticated. The API key for Mistral lives only on the server and is never exposed to the browser.

11. Changes to this policy

I may update this policy when tools, cookies or processing change. TheLast updated date above reflects the latest revision. Material changes will also be highlighted through the cookie banner if they affect consent.

12. Contact

For any question about this policy or your personal data, write tofalcon.andrea88@gmail.com.

See also the Cookie Policy for the detailed list of cookies and how to disable them.