Legal
Privacy & Cookie Policy
How GiacApp S.r.l. handles the data you send through the project brief form, and what this site stores in your browser. In short: no cookies of our own, no advertising trackers, no profiling.
1 · Project brief form
Privacy notice for the contact form
This notice is given under Article 13 of Regulation (EU) 2016/679 (GDPR) to anyone who sends a project brief through the form on the For Agencies page.
Data controller
GiacApp S.r.l., Italy, VAT number 13131931001, certified email (PEC) info@pec.giacapp.com. For anything about your data, write to international@giacapp.com.
Data Protection Officer (DPO): Gianluca Giacalone, reachable at the same addresses.
The registered office address of GiacApp S.r.l. is still missing: add it to the first paragraph above. Also check that the DPO appointment has been communicated to the Garante.
What we collect
The data you enter in the form:
- Name, company and work email (required)
- Project type and project stage, chosen from a list, and the expected timing (optional)
- The project description you write (required)
Please do not include personal data of other people, or special categories of data, in the description: we do not need them to reply.
To protect the form from abuse, the server that receives it also sees your IP address. It is used to limit repeated submissions (at most five every ten minutes) and is not stored with the brief; like any web request, it can appear in the technical logs of the hosting platform. The form also contains a hidden anti-spam field that people never see: submissions that fill it in are discarded.
Why, and on what legal basis
We use the data only to reply to your request and to assess a possible collaboration with your company. The legal basis is Article 6(1)(b) GDPR: processing necessary to take steps at your request before entering into a contract. Name, company, email and description are needed to reply: without them we cannot answer you.
We do not use the data for marketing, we do not add you to any mailing list and we take no automated decisions about you.
Who handles the data for us
The form is sent to a function hosted on Google Firebase (Google Cloud, region europe-west1, Belgium), which forwards it by email through Twilio SendGrid to our mailbox. These providers act as data processors on our behalf:
- Google (Firebase Hosting and Cloud Functions): hosts this site and runs the form endpoint. The platform logs record technical data about each request, and the function log records the company name of each brief sent.
- Twilio SendGrid: delivers the brief to our mailbox. The email contains everything you entered in the form.
- Google Workspace: hosts the international@giacapp.com mailbox, where the brief is stored.
Confirm that data processing agreements (DPA) are in place with Google (Cloud and Workspace) and Twilio SendGrid. Mailbox provider verified from the giacapp.com MX records on 30/09/2026: Google Workspace.
Inside GiacApp the brief is read only by the people who handle new projects. We do not sell the data or pass it to anyone else.
If the form cannot reach our server, the page opens your own email program with the brief pre-filled: in that case the message travels through your email provider, like any email you send us.
Transfers outside the EU
Twilio SendGrid is a United States company, so the content of the brief is transferred to the US in order to be delivered. Google may also process data outside the EU under its own terms. These transfers take place with the safeguards required by Chapter V GDPR.
Name the transfer mechanism actually in place for Twilio SendGrid and Google (EU-U.S. Data Privacy Framework certification and/or Standard Contractual Clauses in their DPAs): not verified from here. Also check whether the SendGrid account uses EU data residency, which would change this paragraph.
How long we keep it
The brief is kept in our mailbox for as long as needed to handle your request and any collaboration that follows from it, and then deleted. The technical logs of the form function are kept by Google Cloud Logging for 30 days, and SendGrid keeps its delivery logs (sender, recipient, subject and delivery events) for up to 30 days.
Still to decide: how long briefs stay in the mailbox after the last contact. Google Workspace keeps mail until it is deleted, unless a Vault retention rule exists (not checkable from here). The 30 days for Cloud Logging is Google’s default for the _Default bucket: gcloud needed a new login, so confirm it was not changed with
gcloud logging buckets describe _Default --location=global --project giacapp-com. SendGrid: 30 days is the documented Email Logs retention.
Your rights
Under Articles 15 to 22 GDPR you can ask us for access to your data, rectification, erasure, restriction of processing and data portability, and you can object to the processing. Write to international@giacapp.com: we reply within one month.
You also have the right to lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali, or the authority of the EU country where you live or work.
2 · Cookies and similar technologies
No cookies of our own. Here is what the site does use.
This site sets no cookies. Fonts and scripts are served by the site itself: there are no Google Fonts, tag managers, social pixels or captchas. Three things read or store information in your browser, or connect to another server, and this is what each of them does.
Visit statistics: Umami
We count visits with Umami, an open-source analytics tool that we host ourselves, on our own server in Crema (CR), Italy. It shows us aggregate figures: pages viewed, referring sites, country, browser and device type, and a few events such as the language switch, clicks on external links and email addresses, and a brief being sent.
- It sets no cookies and stores no identifier in your browser.
- Your IP address is not stored in clear: together with the browser’s user agent it is turned into a one-way hash, with a salt that changes every month, so that visits can be counted without knowing who made them. The IP is also used to derive the country.
- No profiling and no combination with other data: the statistics are not linked to the form or to anything else.
- The data stay on our server in Italy and are not passed to third parties.
Verified on ct-stats on 30/09/2026: Umami has no retention setting and no cleanup job, so the data are kept from the first event (18/09/2026) with no time limit. Decide a period, set up the deletion and state it here. Salt rotation: SALT_ROTATION not set, monthly default.
To switch it off: Umami stops counting your visits to this site if you open the browser console on any page and run localStorage.setItem('umami.disabled', 1), which saves that key in your browser. Content blockers that block analytics scripts have the same effect. The script is not configured to follow the browser’s Do Not Track setting.
Preferences: theme and language
When you use the switches in the header, the site remembers your choice in your browser’s local storage (localStorage), under two keys:
giacapp-theme:darkorlightgiacapp-lang:enorit, also set when you open a link ending in?lang=enor?lang=it
These are functional preferences that you set yourself. They stay in your browser, are never sent to our server or to anyone else, and you can delete them at any time by clearing this site’s data in your browser settings.
Videos: YouTube in privacy-enhanced mode
YouTube videos are shown as a still image stored on this site. Until you click play, the page makes no connection to YouTube. When you click, the video loads from youtube-nocookie.com, YouTube’s privacy-enhanced mode, and from that moment the player is provided by Google, which may store information in your browser and process data according to Google’s privacy policy.
Clicking play is your choice: if you do not click, nothing reaches Google. The one video that is not on YouTube, in the Mastercard Avatar case study, is served by this site and involves no third party.
Why there is no cookie banner
The site uses no profiling or advertising cookies and no third-party trackers. The preferences above are technical storage that you set yourself, the statistics are first-party, aggregate and cookieless, and YouTube is reached only after you choose to play a video. For this reason the site does not show a cookie banner.
Questions about this page: international@giacapp.com.
Last updated: 30 September 2026