Privacy and cookie notice

Last updated: 16 September 2026

• No profiling cookies
• No third party trackers
• Data stored in the EU
• Erasure with confirmation

Data controller

The data controller is Edoardo Caciolo, who runs the Alatar project. For any request about your personal data you can write to support@alatar.it.

What data we collect

This site collects personal data in two places only, both at your initiative.

Early access form. It collects: email (required), name, company and message (optional), the selected role and the consent you express. Together with the submission we record the IP address and the browser user agent, used exclusively to prevent abuse and automated submissions. If you tick the optional updates checkbox, we also use your email to send you occasional news about the state of the project: every message contains a link to stop receiving them at any time, without losing your place on the list.

Research questionnaire on how CVs get read. Answers are anonymous: we do not store the IP address or the user agent with the answers. The final email field is optional, is used only to send you the aggregated results, and is not used for anything else.

Local preferences. The light or dark theme and the preferred language are stored in your browser's localStorage and never leave your device.

Purposes and legal basis

Managing the early access list: consent, Article 6(1)(a) GDPR. Project status updates: separate optional consent, revocable at any time through the link in every email. Aggregated research on how CVs get read: consent, expressed through voluntary participation. Abuse prevention on the form: legitimate interest, Article 6(1)(f) GDPR.

Retention

Early access data is kept until you withdraw consent or the program closes, is deleted 30 days after the beta invitation is sent, and in any case is kept no longer than 24 months from collection. Anonymous questionnaire answers are kept in aggregated form for the duration of the research; optional emails are deleted after the aggregated results are sent. Encrypted copies of the database, made only to restore it after a loss, are kept for up to 42 days and then deleted.

Where the data lives

Data is stored in a PostgreSQL database managed by the site's hosting provider (DigitalOcean), on servers in the European Union. Encrypted copies of that database, made only to restore it after a loss, are stored on Cloudflare R2, Cloudflare's storage service, also on servers in the European Union: Cloudflare holds them as a processor on our behalf. No data is sold, transferred or shared for third party marketing.

Visits to www.alatar.it pass through Cloudflare's network, which sits between your browser and the site as a proxy and CDN: every request, with your IP address, traffic routing data and information about your system's configuration, goes through a Cloudflare data center, which may be outside the European Union. For the content that transits its network and for the logs it makes available to whoever runs the site, Cloudflare acts as a processor on our behalf; for other traffic data its privacy policy (cloudflare.com/privacypolicy) names Cloudflare as controller. For transfers of personal data from the European Union to the United States, Cloudflare states that it relies on the EU-U.S. Data Privacy Framework and, as a fallback, on standard contractual clauses.

Your rights

At any time you can request access, rectification, erasure, restriction of processing and portability of your data, or withdraw consent, by writing to the controller. You also have the right to lodge a complaint with your supervisory authority.

Right to be forgotten. You can request the complete erasure of your data (Article 17 GDPR) by writing to support@alatar.it from the address you registered with. The erasure is carried out within one month and you receive a confirmation email with the exact list of the data removed; we keep only a technical record of the operation, free of personal data, as proof that the erasure happened. When the erasure is carried out, the data leaves the live database at once; encrypted backup copies that already contain it are not altered, but are deleted when they expire, at most 42 days after they were made. Should one of those copies be needed to restore the database, we do not put it back into use before re-applying the erasures carried out after the copy's date. If you left your email in the questionnaire you can choose between removing the email, the personal report and its link, leaving your answer anonymous in the aggregates, or deleting the whole answer.

Anonymous questionnaire answers. Answers submitted without an email cannot be traced back to you: for this reason, as Article 11 GDPR provides, we can neither hand them over nor delete them on request.

Cookies

This site uses no profiling cookies and hosts no third party trackers. There are no analytics tools. The only information the site stores in the browser is the technical theme and language preference (localStorage), which does not identify a person. The forms are protected by the Cloudflare Turnstile anti-spam check, which tells a person filling them in from a program: for that verification alone Cloudflare processes the IP address and some technical browser signals, and may set a technical cookie the check needs. Turnstile does not profile and does not reconstruct browsing.

Changes

Any change to this notice will be published on this page with its update date.