Privacy & cookies
Last updated: November 2026. This is a translation: if anything differs, the Italian version applies.
In a nutshell
This website doesn't profile anyone. There are no marketing cookies, no Google Analytics and no Facebook pixel. We use what you write to us in the contact form only to reply to you. Sometimes we email businesses at the address they publish on their own website: you'll find how this works below, under “Emails to businesses”.
Who handles the data
Inkwell Studio, Cristian Lazzarini and Ismail Xhakerri. For any request: assistenza@inkwellstudio.it.
What data we collect
- Contact form data: name, business name, email, phone number (optional) and the message you write.
- Quote simulator data: name, business name, email, phone (optional) and the choices you make in the simulator, so we can prepare your quote and send it to you.
- Custom previews: if we prepare a preview of your business's website, we use the business's details (name, town, address, phone, email, the name of the contact person, photos, logo and menu that you send us or have published). On the preview page we only count how many times it is opened and when, without knowing who opens it.
- Technical server data: IP address and connection information, kept by the hosting provider for security. To stop abuse, our server keeps the IP address of anyone who sends the form or opens a lot of pages for a few hours at most, then deletes it automatically.
- Visitor statistics: we count them ourselves, with no cookies and no external services. To count each person once a day, we calculate an irreversible fingerprint of the IP address and browser, which changes every night and can't be traced back to you. The fingerprints delete themselves after 70 days; only the totals remain, as numbers.
- Security log: if someone tries to log in to the private area, or requests addresses typical of attacks (for example admin pages of other systems or strings meant to break into the site), we store the date and time, IP address, city and provider derived from the IP, the program used (browser or robot), the requested address and the outcome. We never store passwords or verification codes. It serves to defend the site and to see whether anyone is trying to break in.
Why we use them
To reply to you and, if you become a client, to manage the work and meet the tax and accounting obligations required by law. Legal basis: your request and the performance of the contract (Art. 6(1)(b) GDPR). We don't need your consent because you're the one writing to us, and we don't send you anything else.
Custom previews are there to show you what your website could look like: the legal basis is your request, if you asked us for one, or otherwise our legitimate interest in presenting our work to you (Art. 6(1)(f) GDPR).
The technical data and visitor statistics help keep the website secure and show us which pages are useful: the legal basis is our legitimate interest (Art. 6(1)(f) GDPR), with the data kept to the bare minimum.
How long we keep it
Requests sent through the form are deleted automatically from our records after twelve months. If you become a client, accounting documents are kept for as long as the law requires (ten years).
Quotes from the simulator are deleted automatically no later than 45 days after the request. Custom previews are deleted automatically two months after the link expires.
The security log is deleted automatically after 90 days. Legal basis: our legitimate interest in protecting the site (art. 6.1.f GDPR).
Emails to businesses
Now and then we email businesses to introduce our work. We only use the generic address that the business publishes on its own website as a contact (for example info@ or bookings@), never personal addresses, together with the business name, the town and the page where we found it.
Legal basis: our legitimate interest in making our work known to other businesses (Art. 6(1)(f) GDPR). We send one email per business, with no follow-ups.
To stop receiving them, just reply “NO” or open the link at the bottom of the email: from then on we won't write to you again. To respect your choice we keep only the address and the date in a list of people who don't want to be contacted. Everything else is deleted after twelve months.
Who we share it with
No one, except the technical providers needed to run the website and our email, which process the data on our behalf as data processors:
- Cloudflare: hosts the website's pages and logs access to them for security.
- Resend: delivers the message you write in the form to our inbox.
- Register.it: runs our mailbox, from which the emails to businesses are sent. It is based in Italy.
Cloudflare and Resend are based in the United States: the data transfer is covered by the EU-U.S. Data Privacy Framework, under which both are certified, and by the standard contractual clauses approved by the European Commission.
We don't sell or pass on addresses to anyone else, and we don't use your data for advertising.
Cookies and browser storage
We don't set cookies for visitors: no advertising, no profiling, no third-party services. Fonts, animations and images are on our own server, so opening the pages doesn't connect you to Google or any other company.
Your browser only keeps a few small technical items, which stay on your device and don't tell us who you are:
- The theme (
inkwell.tema): the website is light or dark to match your device. If you choose the other theme with the moon button, your choice stays saved until you go back to your device's theme or clear the site data. - The home page animation (
ink.universo): remembers, for the current visit only, whether you've already seen it, so it doesn't start over when you come back to the home page. It's deleted automatically when you close the tab. - The page transition (
ink.sipario): the name of the page to write on the orange curtain. It lasts an instant and deletes itself.
Cloudflare, which hosts the website, may set a technical security cookie (__cf_bm) to tell people apart from automated programs: it lasts half an hour at most and is only there to protect the website.
The studio's private area, which only we can access, uses technical cookies for logging in: the session, the verification code step (five minutes) and one that leaves us out of the visit count.
These are all technical tools, needed to make the website work or to remember a choice you've made: the law doesn't require consent for them, and that's why you won't find a cookie banner.
Your rights
At any time you can ask to see your data, correct it, delete it, restrict its use, receive it in a machine-readable format or object to its use (for example to the emails to businesses), by writing to assistenza@inkwellstudio.it. We reply within thirty days. If something doesn't seem right, you can contact the Italian data protection authority (Garante per la protezione dei dati personali).
Giving us your data in the forms is not mandatory, but without it we can't reply to you or prepare your quote. We don't make automated decisions about you and we don't do profiling.