01who's responsible
the data controller is thesmallmediacompany s.r.l., via martiri oscuri 16, 20125 milan, italy — vat IT13876460968.
privacy contact (referente privacy): alessandro facchini · dpo@thesmallmediacompany.com
02what we collect (and what we don't)
we keep this short on purpose. we collect only:
- —newsletter — your email address, if you choose to subscribe, and the language you were reading in, so we write to you in that one. we also know whether you open our emails: there's an invisible image inside that tells us, the way there is in almost every newsletter. if your mail app blocks images, we don't know — and that's fine.
- —contact form — your name, email, and message, when you write to us.
- —"talk to the creator" (ai voice) — your side of the conversation is processed in real time to let the ai respond. the audio is never stored; transcripts delete themselves after 60 days, and the only thing that stays is the anonymous realignment question (see §4).
- —analytics — anonymous usage and technical data (pages, device, approximate location), via google analytics, only if you accept analytics cookies (see §7).
- —server logs — standard technical logs (ip, browser) kept briefly for security.
- —anti-spam check — when you start typing in the newsletter box, a cloudflare turnstile challenge runs to tell a person from an automated script. cloudflare sees your ip address and technical signals from your browser. it sets no cookies, builds no profile, and is never used for advertising. nothing loads until you actually start typing.
what we don't collect, today: no age/gender/phone, no advertising or remarketing profiles, no browsing history outside our site, no sensitive data. and the rule that always holds: if we ever need more, we'll write it here before we start collecting it.
03why we use it, and our legal basis
- —deliver what you ask for (newsletter, answering your message) — consent / contract.
- —run and secure the site — legitimate interest.
- —understand, in aggregate, how the site is used so we can improve it — consent (analytics cookies).
- —meet legal obligations — legal obligation.
we do not sell your data, and we don't use it to profile or target you.
04the "talk to the creator" ai
this is an ai voice — the creator's voice, cloned, not the creator live. you're talking to a machine built to reflect you back to yourself, and it declares this itself. it is reserved for adults (18+).
- —the conversation is processed by elevenlabs (our provider) to generate replies in real time.
- —the audio is never recorded. because a voice can count as biometric data under some laws, this is deliberate.
- —conversations are transcribed, and transcripts delete themselves after 60 days. within that window we review them — in aggregate, never to identify anyone — solely to improve how the companion listens and answers. we don't ask your name, and there is no account.
- —one thing outlives the transcript: the realignment question. if the conversation brings you to put your own question into words, we keep the question itself — and nothing around it. it is kept only if it contains nothing that could identify you or anyone else; otherwise it is not kept at all. we never know who asked — only what was asked.
- —the companion has no memory between conversations: each one starts from nothing.
- —please don't share sensitive personal information in the conversation — it isn't the place for it. if you have, and want it gone, write to dpo@thesmallmediacompany.com.
- —elevenlabs processes data on our behalf under a data processing agreement; by default this may happen in the united states (covered by standard contractual clauses).
05how long we keep it
- —newsletter: until you unsubscribe.
- —contact messages: for as long as needed to handle your request and the relationship that follows from it. we review periodically and delete what's no longer needed — and you can ask us to delete your data at any time.
- —"talk to the creator": audio never stored; transcripts auto-delete after 60 days; the only thing kept beyond that is the anonymous realignment question (see §4).
- —analytics: aggregated; retention set to 14 months in google analytics.
- —server logs: short-term, for security only.
you can ask us to delete your data at any time (subject to legal requirements).
06who we share it with
we share data only with the providers that make the site work — never with advertisers or data brokers:
- —netlify — hosting and contact forms.
- —google — google analytics (only with your consent).
- —elevenlabs — the "talk to the creator" ai voice; it uses leading ai models as sub-processors under agreements that prohibit training on our content.
- —mailerlite — to send the newsletter (an eu-based provider, which keeps newsletter data within the eu).
- —cloudflare — the anti-spam check on the newsletter box (turnstile). it is there to protect strangers’ inboxes, not to profile you.
when you click a link to buy a book or listen elsewhere (amazon and other retailers, podcast apps, youtube), you leave our site and their privacy policies apply.
international transfers: some providers process data in the united states. where that happens, we rely on standard contractual clauses and providers with equivalent protections.
07cookies & analytics
we use only essential cookies by default. analytics cookies (google analytics) load only if you accept them in our cookie banner — and you can change your mind anytime. full detail in our cookie policy.
the anti-spam check on the newsletter box (cloudflare turnstile) sets no cookies and loads only once you start typing an email address — so simply reading the page never contacts it.
08your rights
wherever you are, we honor your right to access, correct, delete your data, withdraw consent, and opt out of communications. if you're in the eu/eea you also have the gdpr rights to restriction, portability, and objection.
to exercise any of these, email dpo@thesmallmediacompany.com. we'll respond within 30 days (or as your local law requires).
09security
we build on the best platforms in the world precisely because their security beats anything a one-person company could build alone — encryption in transit and at rest, access controls, and providers selected for strong privacy standards. no system is ever 100% secure, but we keep raising the bar.
10children
our work is made for adults. our services are not directed to anyone under 18, and we don't knowingly collect their data. if you believe we have, contact us and we'll remove it.
11changes
we may update this policy. significant changes will be flagged on the site (and by email, if it's about something you subscribed to). the "last updated" date above always tells you which version you're reading.
12contact & supervisory authority
questions, or want to exercise a right? dpo@thesmallmediacompany.com.
you also have the right to complain to the italian data protection authority (garante per la protezione dei dati personali) or your local supervisory authority.
