Privacy notice.

Which personal data PostTheDoc processes, why, for how long and how you can exercise your rights (Articles 13 and 14 of Regulation (EU) 2016/679, “GDPR”).

Controller

The data controller is Davide Carnemolla, whom you can reach at herbrant@protonmail.com. PostTheDoc is an independent, free project, not an official service of the Italian Ministry (MUR).

Which data

• Subscription: email address, chosen positions, fields, regions and institutions, email language, subscription status (awaiting confirmation or active).
• Proof of consent and security: dates of subscription, last change and confirmation, version of the privacy notice in force at confirmation, time of the last service email (to limit how often they are sent).
• Delivery history: identifiers of the calls already sent to you and when, so that you never get the same call twice.
• Technical data: IP address and browser data received by the servers hosting the site and the API; the signals collected by the anti-bot check (Cloudflare Turnstile) when you subscribe or ask for a link; aggregate visit statistics (Umami), without cookies, without storing the IP address and not collected at all if your browser sends the “Do Not Track” signal.

You are not asked for your name, affiliation or any other data, and no special categories of data (Article 9) are processed.

Why, and on what basis

• Sending you notifications about calls and service emails (confirmation, manage links): based on your consent (Article 6(1)(a)), which you give by confirming the subscription from the link received by email. You can withdraw it at any time by unsubscribing; withdrawal does not affect the lawfulness of earlier processing.
• Protecting the service from bots and abuse (anti-bot check, at most one service email every 5 minutes per address) and demonstrating the consent received: based on legitimate interest (Article 6(1)(f)) and the obligation set by Article 7(1).
• Counting visits in aggregate, to understand whether the site is useful: based on legitimate interest (Article 6(1)(f)). The statistics cannot identify you.

Providing your email is optional, but without it notifications cannot be sent. Your data is not used for advertising or marketing, and it is neither sold nor shared with third parties. Matching calls to your preferences is a plain filter on the choices you make: it is neither profiling nor an automated decision with legal effects (Article 22).

Who processes it

The service relies on these providers, which process data on behalf of the controller as processors (Article 28), under their data processing agreements:

• Cloudflare, Inc. (United States): API, subscriber database and Turnstile anti-bot check.
• Brevo (France): email delivery. Open and click tracking is turned off for individual recipients: Brevo only counts them in aggregate.
• GitHub, Inc. (United States): hosting of the site and the daily check of new calls, which reads the subscriber list to prepare the emails.
• Umami Software, Inc. (Umami Cloud): visit statistics.

Cloudflare, GitHub and Umami may process data outside the European Union. Transfers rely on the adequacy decision on the EU-US Data Privacy Framework, for certified providers, or on the standard contractual clauses approved by the European Commission (Article 46).

Donations, which are optional, happen entirely on GitHub Sponsors or Buy Me a Coffee: those platforms act as independent controllers under their own privacy policies, and donating is not linked in any way to your subscription.

For how long

• Active subscription: as long as you stay subscribed. When you unsubscribe, your email, preferences and delivery history are deleted immediately.
• Subscription never confirmed: deleted automatically after 7 days.
• Technical and delivery logs kept by the providers: for the period set by each provider, usually a few days or weeks.

Your rights

You can access your data, rectify it, erase it, restrict its processing, receive it in a portable format and object to processing based on legitimate interest (Articles 15–22), as well as withdraw your consent. From the Manage subscription page you can do it yourself, at any time:

• change your preferences;
• download all the data stored about you, as JSON;
• unsubscribe, deleting all your data.

To change your email address, unsubscribe and subscribe again with the new one. For any other request write to herbrant@protonmail.com: you will get an answer within one month.

If you believe the processing infringes the GDPR, you can lodge a complaint with the Italian Garante per la protezione dei dati personali or with the supervisory authority of the EU country where you live or work.

Cookies

The site sets no cookies. It only stores in your browser:

• your choice of light or dark theme (localStorage);
• while subscribing, the email typed on the home page, to hand it over to the form (sessionStorage, cleared when the tab is closed);
• on the manage page, the access link received by email (sessionStorage).

The Cloudflare Turnstile anti-bot check is loaded only on the subscribe and manage pages and is needed to keep the service secure; according to Cloudflare, it does not use cookies to collect or store information.

Changes

Any change to this notice will be published on this page; if the purposes or the providers change, subscribers will be told by email.

Last updated: 24 September 2026.