Privacy notice

This website belongs to Luca Colucci, a brand, marketing and digital consultant based in New York City. This page explains, feature by feature, what the site collects, why, and where it is kept. To ask a question, get a copy of your data, correct it or have it deleted, write to me through the contact form.

Data controller

The data controller is Colucci Luca, an Italian sole proprietorship (ditta individuale) trading as Luca Colucci. Registered office: Via Piero Gobetti 14, 20024 Garbagnate Milanese (MI), Italy. VAT IT12760270962. Email: lc@lucacolucci.it. Website: lucacolucci.it.

Cookies and tracking: only with your consent

Analytics and advertising tools stay off until you choose. On your first visit a banner lets you accept all, reject all or pick by category, with the same weight given to each option. You can change your choice at any time from the “Cookie settings” link at the bottom of every page. Until you accept, none of the tools below is loaded, and Google’s tags are told that consent is denied.

• Necessary (always on): a cookie named lc_consent that remembers your choice for 6 months, after which you are asked again. If you sign in to an account, three more cookies keep you signed in (lc_at and lc_rt, up to 30 days, and lc_pkce, 10 minutes while you sign in). They are not used for anything else.
• Analytics (only if you accept): Google Analytics 4, to count visits and see which pages and links are useful. Its cookies (_ga) last up to 13 months.
• Marketing (only if you accept): the Meta Pixel, the LinkedIn Insight Tag and Google Ads conversion tracking, to measure ads on Meta, LinkedIn and Google and their results, such as sign-ups, meeting requests and purchases. Their cookies (_fbp, _gcl, li_fat_id) last up to 90 days.

With your consent these tools receive the pages you visit and a few actions: a sign-up to the Academy list, a meeting request, the start and the completion of a purchase (with its amount), and clicks to Amazon and Eventbrite, which are counted as clicks and never as purchases. If you accepted marketing cookies, a sign-up or a purchase is also confirmed to Meta from the server (Meta’s Conversions API), with your email address in one-way hashed form only. Google, Meta and LinkedIn process this data as independent companies, mostly in the United States, under their own privacy policies. Withdrawing consent stops all of this from that moment on.

Academy list (newsletter)

• What: your email address, the topics you pick (optional), the exact consent wording you agreed to and the time you agreed.
• Why: to email you about new books, library releases and events. No emails are being sent yet. A copy goes to the private system I use to manage my work.
• Basis: your consent, which you can withdraw at any time (GDPR art. 6.1.a).

Meeting requests

• What: the meeting type, the event (if any), the time windows you suggest, your name, email, company and message, and the time you agreed to this notice.
• Why: to read your request and reply to arrange a meeting. The form never reads or shows my calendar. A copy goes to the private system I use to manage my work.
• Basis: your request and your consent (GDPR art. 6.1.a and 6.1.b).

Accounts

• What: your email address, the name you add (optional), and when you signed up and signed in. You sign in with a one-time link sent by email, or with Google if you choose it; no password is stored here.
• Why: to give you access to what you bought or subscribed to, and to show your purchases, downloads and membership in one place.
• Basis: the contract with you (GDPR art. 6.1.b).

Purchases and payments

Payments are processed by Stripe. You enter your card details on Stripe’s own checkout page: they never reach this site and are never stored here. Stripe also emails your receipts. This site keeps a record of each order (what you bought, the amount, the currency, the date, its status, and the references Stripe gives it) and of your membership (plan, status, renewal date), to give you access and to answer questions about a payment. Stripe processes payment data on my behalf and, for fraud prevention and its legal duties, as an independent company under its own privacy policy. When a purchase is completed, a short notice (what was bought, the amount, your email) goes to the private system I use to manage my work.

Spam protection

To limit abuse of the two forms above, the server stores a one-way, salted hash of your IP address next to your submission and uses it only to count how many submissions arrive from the same connection in an hour. The IP address itself is not stored.

Outbound link counts

Links to Amazon, Eventbrite and WhatsApp pass through a small counter on this site before opening. It records only which link was followed, the page on this site it was on, and the time. It stores no IP address, no cookie and nothing that identifies you. If you accepted analytics or marketing cookies, clicks to Amazon and Eventbrite are also reported to those tools, as described above.

Contact form and Free Audit

The contact form and the Free Audit work as before and have their own privacy notice, shown next to each form. In short: contact-form messages are delivered to my inbox through Formspree; Free Audit answers are processed with Google services (Sheets, Apps Script, PageSpeed) and an AI model, and your name, email and phone are never sent to the AI.

Where data is kept

• Academy list sign-ups, meeting requests, link counts, accounts, orders and memberships are stored in a database hosted by Supabase, used only for this website. Sign-in emails are sent by Supabase.
• Payments are handled by Stripe, as described above.
• Only with your consent: Google (Analytics and Ads), Meta (Pixel and Conversions API) and LinkedIn (Insight Tag), as described above.
• The site is hosted on Netlify, whose servers process standard technical data (such as IP address and browser type) to deliver the pages.
• Fonts are loaded from Google Fonts, so your browser connects to Google’s servers to download them.

How long

Data is kept for up to 24 months, or until you withdraw consent or ask for deletion, whichever comes first. It is never sold. Account data is kept while your account exists. Order and payment records are kept for as long as tax and accounting law requires, even after an account is deleted. Cookies last as long as stated in the cookies section above.

Your rights

You can ask for access to your data, for corrections, or for deletion at any time, and withdraw consent for the Academy list. You can withdraw or change your cookie consent from “Cookie settings” at the bottom of every page, and ask for your account to be deleted from your account page. You can also contact your data protection authority. Write to me through the contact form or at lc@lucacolucci.it.