PostTheDocAcademic job calls
ITSubscribe
Back to the home page

Privacy

Privacy notice.

Which personal data PostTheDoc processes, why, for how long and how you can exercise your rights (Articles 13 and 14 of Regulation (EU) 2016/679, “GDPR”).

Controller

The data controller is Davide Carnemolla, whom you can reach at herbrant@protonmail.com. PostTheDoc is an independent, free project, not an official service of the Italian Ministry (MUR).

Which data

  • Subscription: email address, chosen positions, fields, regions and institutions, email language, subscription status (awaiting confirmation or active).
  • Proof of consent and security: dates of subscription, last change and confirmation, version of the privacy notice in force at confirmation, time of the last service email and number of confirmation emails sent to an address not confirmed yet (to limit them).
  • Delivery history: identifiers of the calls already sent to you and when, so that you never get the same call twice; and of the changes to those calls (for example an extended deadline) you were told about, so that you are told only once.
  • Technical data: IP address and browser data received by the servers hosting the site and the API; the signals collected by the anti-bot check (Cloudflare Turnstile) when you subscribe or ask for a link; aggregate visit statistics (Umami), without cookies, without storing the IP address and not collected at all if your browser sends the “Do Not Track” signal.

You are not asked for your name, affiliation or any other data, and no special categories of data (Article 9) are processed.

Why, and on what basis

  • Sending you notifications about calls and service emails (confirmation, manage links): based on your consent (Article 6(1)(a)), which you give by confirming the subscription from the link received by email. You can withdraw it at any time by unsubscribing; withdrawal does not affect the lawfulness of earlier processing.
  • Protecting the service from bots and abuse (anti-bot check, at most one service email every 5 minutes and a few confirmation emails per address) and demonstrating the consent received, as Article 7(1) requires: based on legitimate interest (Article 6(1)(f)).
  • Counting visits in aggregate, to understand whether the site is useful: based on legitimate interest (Article 6(1)(f)). The statistics cannot identify you.

The service is meant for people aged 14 or over, the minimum age to give consent on one’s own in Italy (Article 2-quinquies of the Italian Privacy Code). Providing your email is optional, but without it notifications cannot be sent. Your data is not used for advertising or marketing, and it is neither sold nor shared with third parties. Matching calls to your preferences is a plain filter on the choices you make: it is neither profiling nor an automated decision with legal effects (Article 22).

Who processes it

The service relies on these providers, which process data on behalf of the controller as processors (Article 28), under their data processing agreements:

  • Cloudflare, Inc. (United States): API, subscriber database (stored in the European Union) and Turnstile anti-bot check.
  • Brevo (France): email delivery. Open and click tracking is turned off for individual recipients: Brevo only counts them in aggregate.
  • GitHub, Inc. (United States): hosting of the site and the daily check of new calls, which reads the subscriber list to prepare the emails.
  • Umami Software, Inc. (United States): visit statistics, stored in the European region of Umami Cloud.

Cloudflare, GitHub and Umami may process data outside the European Union. Transfers rely on the adequacy decision on the EU-US Data Privacy Framework, for certified providers, or on the standard contractual clauses approved by the European Commission (Article 46).

GitHub, for the access logs of the site, and Cloudflare, for the signals of the anti-bot check, may also process some technical data for their own purposes, such as security and abuse prevention: for those they act as independent controllers, under their own privacy policies.

Donations, which are optional, happen entirely on Buy Me a Coffee, which acts as an independent controller under its own privacy policy, and donating is not linked in any way to your subscription.

For how long

  • Active subscription: as long as you stay subscribed. When you unsubscribe, your email, preferences and delivery history are deleted immediately.
  • Delivery history: each delivery, and each notice of a change, is deleted after 400 days, when its call has long been closed.
  • Subscription never confirmed: deleted automatically 7 days after it was requested.
  • Technical and delivery logs kept by the providers: for the period set by each provider, usually a few days or weeks.

Your rights

You can access your data, rectify it, erase it, restrict its processing, receive it in a portable format and object to processing based on legitimate interest (Articles 15–22), as well as withdraw your consent. From the Manage subscription page you can do it yourself, at any time:

  • change your preferences;
  • download all the data stored about you, as JSON;
  • unsubscribe, deleting all your data.

To change your email address, unsubscribe and subscribe again with the new one. For any other request write to herbrant@protonmail.com: you will get an answer within one month.

If you believe the processing infringes the GDPR, you can lodge a complaint with the Italian Garante per la protezione dei dati personali or with the supervisory authority of the EU country where you live or work.

Cookies

The site sets no cookies. It only stores in your browser:

  • your choice of light or dark theme and of the site’s language (localStorage);
  • while subscribing, the email typed on the home page, to hand it over to the form (sessionStorage, cleared when the tab is closed);
  • on the manage page, the access link received by email (sessionStorage).

The Cloudflare Turnstile anti-bot check is loaded only on the subscribe and manage pages and is needed to keep the service secure; according to Cloudflare, it does not use cookies to collect or store information.

Changes

Any change to this notice will be published on this page; if the purposes or the providers change, subscribers will be told by email.

Last updated: 2 October 2026.