Privacy Policy

Data controller

Data controller: Davide Terrile. For any request regarding your data write to communication@davideterrile.it.

Photograph downloads

To request the file of a photograph we collect:

• email;
• name, if provided;
• newsletter consent (optional);
• the requested photograph;
• date and time of the request;
• IP address and browser user agent.

These data are used to:

• process the request and generate the temporary download link;
• prevent technical abuse and log file access;
• send a transactional confirmation message;
• send editorial updates only when newsletter consent is given.

Contributions

When you send a contribution we collect:

• email, name (if provided), optional message;
• amount, currency, payment status;
• Stripe payment session identifier;
• date and time.

Used to:

• process the payment via Stripe;
• send confirmations and thanks;
• handle support, errors and refunds;
• keep the required administrative documentation.

Admin area

Access to the admin area is handled through Supabase Auth. Only the strictly necessary authentication data (user identifier, email, session, role) are processed.

Services involved

• Lovable and Lovable Cloud (application hosting);
• Supabase (database, authentication, storage);
• Stripe (payment processing);
• SMTP2GO (transactional email delivery);
• Cloudflare (edge, distribution, protection);
• Aruba (domain, DNS, email), where applicable.

No analytics, Google Analytics, Meta Pixel or other profiling tools are used.

Newsletter

Newsletter subscription is optional and not required to download the photographs. The legal basis for the processing is consent, which can be revoked at any time: once revoked, the address is excluded from communications and from the export of active subscribers. Transactional emails (download or contribution confirmations) are kept separate from editorial communications, and supporters are not subscribed automatically. Subscribers are currently managed within the site's own infrastructure; no external newsletter provider is in use yet. Should an external newsletter service be adopted, this notice will be updated with the provider, its privacy role, the place of processing and any safeguards for international transfers before it is used. Data is retained for as long as the subscription remains active or until consent is revoked; after revocation only the minimum information needed to document consent and its withdrawal may be kept, for as long as required to protect rights and comply with applicable obligations. Until an automatic system is in place, you can revoke consent by writing to communication@davideterrile.it.

Retention

Data are retained for the time needed to handle the request, comply with applicable obligations, prevent abuse and protect the controller's rights. Data used for editorial communications are retained until consent is revoked.

Rights

At any time you may exercise the rights of:

• access, rectification, deletion;
• restriction of and objection to processing;
• portability, where applicable;
• withdrawal of consent;
• complaint to the competent authority.

To exercise your rights write to communication@davideterrile.it.