01who's responsible
the data controller is thesmallmediacompany s.r.l., via martiri oscuri 16, 20125 milan, italy — vat IT13876460968.
privacy contact (referente privacy): alessandro facchini · dpo@thesmallmediacompany.com
02what we collect (and what we don't)
we keep this short on purpose. we collect only:
- —newsletter — your email address, if you choose to subscribe, and the language you were reading in, so we write to you in that one. we also know whether you open our emails: there's an invisible image inside that tells us, the way there is in almost every newsletter. if your mail app blocks images, we don't know — and that's fine.
- —contact form — your name, email, and message, when you write to us.
- —"talk to the creator" (ai voice) — your side of the conversation is processed in real time to let the ai respond. the audio is never stored; transcripts delete themselves after 60 days, and the only thing that stays is the anonymous realignment question (see §4).
- —analytics — anonymous usage and technical data (pages, device, approximate location), via google analytics, only if you accept analytics cookies (see §7).
- —server logs — standard technical logs (ip, browser) kept briefly for security.
- —anti-spam check — when you start typing in the newsletter box, a cloudflare turnstile challenge runs to tell a person from an automated script. cloudflare sees your ip address and technical signals from your browser. it sets no cookies, builds no profile, and is never used for advertising. nothing loads until you actually start typing.
- —video — the film on the home page and the orepiccole trailers play in our own player on cloudflare stream; the orepiccole films come from youtube, in its privacy-enhanced mode (youtube-nocookie.com), and only when you press play. when the player loads, whoever streams the video sees your ip address and some technical data from your browser, which it needs to deliver it. cloudflare stream sets no cookies; youtube, once you press play, may use its own, under its privacy policy.
- —press contacts — if you're a journalist, your professional details may be with us. what, why and for how long: §11.
what we don't collect, today: no age/gender/phone, no advertising or remarketing profiles, no browsing history outside our site, no sensitive data. and the rule that always holds: if we ever need more, we'll write it here before we start collecting it.
03why we use it, and our legal basis
- —deliver what you ask for (newsletter, answering your message) — consent / contract.
- —run and secure the site — legitimate interest.
- —tell the press about our work, when a story is in their beat — legitimate interest (§11).
- —understand, in aggregate, how the site is used so we can improve it — consent (analytics cookies).
- —meet legal obligations — legal obligation.
we do not sell your data, and we don't use it to profile or target you.
04the "talk to the creator" ai
this is an ai voice — the creator's voice, cloned, not the creator live. you're talking to a machine built to reflect you back to yourself, and it declares this itself. it is reserved for adults (18+).
- —the conversation is processed by elevenlabs (our provider) to generate replies in real time.
- —the audio is never recorded. because a voice can count as biometric data under some laws, this is deliberate.
- —conversations are transcribed, and transcripts delete themselves after 60 days. within that window we review them — in aggregate, never to identify anyone — solely to improve how the companion listens and answers. we don't ask your name, and there is no account.
- —one thing outlives the transcript: the realignment question. if the conversation brings you to put your own question into words, we keep the question itself — and nothing around it. it is kept only if it contains nothing that could identify you or anyone else; otherwise it is not kept at all. we never know who asked — only what was asked.
- —the companion has no memory between conversations: each one starts from nothing.
- —please don't share sensitive personal information in the conversation — it isn't the place for it. if you have, and want it gone, write to dpo@thesmallmediacompany.com.
- —elevenlabs processes data on our behalf under a data processing agreement; by default this may happen in the united states (covered by standard contractual clauses).
05how long we keep it
- —newsletter: until you unsubscribe.
- —contact messages: for as long as needed to handle your request and the relationship that follows from it. we review periodically and delete what's no longer needed — and you can ask us to delete your data at any time.
- —"talk to the creator": audio never stored; transcripts auto-delete after 60 days; the only thing kept beyond that is the anonymous realignment question (see §4).
- —analytics: aggregated; retention set to 14 months in google analytics.
- —server logs: short-term, for security only.
you can ask us to delete your data at any time (subject to legal requirements).
06who we share it with
we share data only with the providers that make the site work — never with advertisers or data brokers:
- —netlify — hosting and contact forms.
- —google — google analytics (only with your consent).
- —elevenlabs — the "talk to the creator" ai voice; it uses leading ai models as sub-processors under agreements that prohibit training on our content.
- —mailerlite — to send the newsletter (an eu-based provider, which keeps newsletter data within the eu).
- —google workspace — our mailboxes (press@, dpo@ and the replies to your messages): when you write to us, or we write to you personally, that is where the mail lives.
- —cloudflare — the anti-spam check on the newsletter box (turnstile) and the player for our videos (stream). it is there to protect strangers’ inboxes and to stream you the videos, not to profile you.
- —youtube (google) — the orepiccole films embedded in the page, only when you press play.
when you click a link to buy a book or listen elsewhere (amazon and other retailers, podcast apps, youtube), you leave our site and their privacy policies apply.
international transfers: some providers process data in the united states. where that happens, we rely on standard contractual clauses and providers with equivalent protections.
07cookies & analytics
we use only essential cookies by default. analytics cookies (google analytics) load only if you accept them in our cookie banner — and you can change your mind anytime. full detail in our cookie policy.
the anti-spam check on the newsletter box (cloudflare turnstile) sets no cookies and loads only once you start typing an email address — so simply reading the page never contacts it.
the player for our videos (cloudflare stream) sets no cookies. the orepiccole films embedded from youtube set none until you press play; after that, youtube may use its own, as its privacy policy says.
08your rights
wherever you are, we honor your right to access, correct, delete your data, withdraw consent, and opt out of communications. if you're in the eu/eea you also have the gdpr rights to restriction, portability, and objection.
to exercise any of these, email dpo@thesmallmediacompany.com. we'll respond within 30 days (or as your local law requires).
09security
we build on the best platforms in the world precisely because their security beats anything a one-person company could build alone — encryption in transit and at rest, access controls, and providers selected for strong privacy standards. no system is ever 100% secure, but we keep raising the bar.
10children
our work is made for adults. our services are not directed to anyone under 18, and we don't knowingly collect their data. if you believe we have, contact us and we'll remove it.
11if you're a journalist
our media relations are ai-driven: the newsroom writing to you is made of ai agents we built, with a person deciding. this is the part of the policy that's for you — the notice the law asks us to give you the first time we write (gdpr, art. 14).
- —how your details reach us. either you signed up on our newsroom (email and language, on your consent — every list mail has an unsubscribe link), or we found your professional contact where you published it: your outlet's masthead, its contacts page, your byline, your professional profile. in that case we note where we found it, and when.
- —what we keep. name, outlet, role, beat, country, professional email, the source we found it in, what we sent you and whether you replied. nothing from private sources, no phone number unless you gave it to us, no profiling.
- —why, and on what basis. to tell you about our work when a story is in your beat, and to answer you when you write. for sign-ups: consent. for public professional contacts: our legitimate interest in reaching the press — and yours in hearing about things worth covering. we don't do bulk mail: a story reaches you because it's yours.
- —how long. while you're a relevant contact; we review the list every year and delete what's stale. if you ask us to stop, we stop at once — and keep only your address on a do-not-contact list, so we never write again by mistake.
- —who sees it. alessandro facchini — the only human-in-the-loop at thesmallmediacompany — and the ai agents that do the press office's work, voice or otherwise. for list mailings, mailerlite as our processor (§6); personal mails go from our own google workspace mailbox. we never sell or share it.
- —ai, declared. the agents prepare stories, drafts and replies; a person decides what goes out, every time. if an ai voice answers you, it says so before you say a word.
to object, correct or ask anything: one email to press@thesmallmediacompany.com or dpo@thesmallmediacompany.com. no form, no reason needed — and the rights in §8 are yours in full.
12youtube api services
thesmallmediacompany s.r.l. uses the youtube api services in an internal tool, «orepiccole pubblicazione», that uploads and schedules videos on the company’s own youtube channels (@orepiccole-it, @orepiccole-en, @orepiccole-es, @orepiccole-de, @orepiccole-fr, @orepiccole-pt). by interacting with our features connected to youtube you agree to be bound by the youtube terms of service. how google handles data is described in the google privacy policy.
- —what the api touches. only the data of our own channels, through the oauth authorisation of our own account: video metadata, uploads, thumbnails, subtitles and publishing status. no data about viewers or any other youtube user.
- —sharing and cookies. this data is not shared with anyone, and the tool adds no cookies, on this site or elsewhere.
- —where it is kept. the oauth tokens stay only on the company’s computer, protected by the operating system’s permissions, and never on third-party servers. the metadata is what we publish ourselves on youtube.
- —revoking access and deletion. access can be revoked at any time from the google security settings page, security.google.com/settings/security/permissions. after a revocation, or on request, we delete the tokens and any stored api data within 7 days; we never keep api data for more than 30 days without refreshing it.
questions about this: dpo@thesmallmediacompany.com.
13changes
we may update this policy. significant changes will be flagged on the site (and by email, if it's about something you subscribed to). the "last updated" date above always tells you which version you're reading.
14contact & supervisory authority
questions, or want to exercise a right? dpo@thesmallmediacompany.com.
you also have the right to complain to the italian data protection authority (garante per la protezione dei dati personali) or your local supervisory authority.
