Privacy policy
What data www.blulang.co collects, why, for how long, and what rights you have.
Last updated:
This is a translation of the Italian text, which prevails if the two differ.
1. Who processes your data
The data controller is Francesco Testatonda, a sole proprietorship trading as BluLang, based in Civitanova Marche (MC), VAT number IT02117170437. For any privacy request: write to BluLang. Certified email (PEC): certified email (PEC).
The controller has not appointed a data protection officer (DPO), because there is no obligation to do so (Article 37 of the GDPR).
2. What data we process
Browsing data. The provider that hosts the site, Vercel Inc., records technical data about every request: IP address, date and time, page requested, browser type. This data is needed to run and protect the site, and we do not use it to identify you. The IP address is also used to limit form submissions, to a maximum of 5 every 10 minutes, and questions to the agent, to a maximum of 10 every 10 minutes: it stays in the server's memory and is not saved.
Brief from the contact page. If you send us the brief, we collect your email address, your name if you enter it, the sentence you wrote to the agent and its reply, the language and the page you are writing from. The brief reaches us by email and you receive an automatic confirmation, always with the same text. The brief is sent only when you press Send, or when you open your email app with the brief already filled in. If you write to the agent on the home page and then go to the contact page, the sentence is carried in the page address, which ends up in the browsing data; we never send it to analytics tools.
Agent. When you write to the agent, on the home page or on the contact page, your sentence (up to 500 characters) and the page language go from our server to Anthropic, which writes the reply with its artificial intelligence model Claude. We do not save the sentence or the reply: they stay on the page until you decide to send us the brief. Anthropic deletes them within 30 days, unless its automated systems flag them as a breach of its usage policy (in which case it keeps them for up to 2 years) or the law requires them to be kept, and it does not use them to train its models. Please do not write personal data to the agent: the project is all it needs. If Claude does not reply, the agent uses simple rules that run in your browser.
Applications. If you apply for a role, we collect your name, email address, the link to your portfolio, your message and the role. If you check the optional box, we also keep your application for future openings.
Email and bookings. If you write to us, we process the data you send us in order to reply to you. If you book a call, the booking goes through Google Calendar: your name, your email address and the time slot you choose reach the controller's calendar.
Analytics. Only if you accept analytics cookies does the site use Google Analytics 4 to count visits, page views and actions, for example opening the form, a successful submission or a click on “Book a call”. We never send your name, your email address or what you write, and we remove the brief from page addresses. Without consent, the Google Analytics script is not even loaded.
What we do not do. We do not sell data, we do not carry out advertising profiling, we do not use remarketing pixels and we do not have a newsletter.
3. Why and on what basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Running and protecting the site | browsing data | legitimate interest (Article 6.1.f of the GDPR) | as long as the provider keeps its logs, up to 30 days |
| Replying to your brief or your email | form data, emails | pre-contractual steps at your request (Article 6.1.b) | 24 months from the last exchange |
| Replying to your request to the agent | sentence written to the agent, page language | pre-contractual steps at your request (Article 6.1.b) | we do not keep it; Anthropic up to 30 days, except when flagged (see above) |
| Assessing your application | application data | pre-contractual steps at your request (Article 6.1.b) | until the selection process ends, up to 6 months |
| Keeping your application for future openings | application data | consent, optional (Article 6.1.a) | 24 months, or until you withdraw consent |
| Site analytics | measurement data | consent (Article 6.1.a) | 14 months in Google Analytics |
| Legal obligations, if you become a client | contract and tax data | legal obligation (Article 6.1.c) | 10 years |
4. Who receives the data
Only the providers needed to run the site, which process the data on the controller's behalf as processors (Article 28 of the GDPR).
| Provider | What it does | Based in | Privacy policy |
|---|---|---|---|
| Vercel Inc. | hosts the site and records the browsing data | United States | vercel.com/legal/privacy-policy |
| Resend, Inc. | sends the form emails, from servers in Ireland | United States | resend.com/legal/privacy-policy |
| Google Ireland Ltd. | mailbox (Google Workspace), bookings (Google Calendar), analytics (Google Analytics 4, only with consent) | Ireland | policies.google.com/privacy |
| Anthropic Ireland, Limited | writes the agent's replies with the Claude model | Ireland | anthropic.com/legal/privacy |
No one else receives your data, unless required by law.
5. Transfers outside the European Union
Vercel and Resend are based in the United States; Google Ireland may transfer data to Google LLC and Anthropic Ireland to Anthropic, PBC, both in the United States. These transfers rely on the EU-US Data Privacy Framework for certified companies and, in any case, on the standard contractual clauses approved by the European Commission (Article 46.2.c of the GDPR).
6. Your rights
You can ask at any time for access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing (Articles 15-22 of the GDPR). You can withdraw your consent whenever you want, without affecting what was done before (Article 7.3). To exercise your rights: write to BluLang. We reply within one month (Article 12.3).
7. Complaints
If you think the processing violates the law, you can contact the Italian Data Protection Authority (Garante per la protezione dei dati personali) (garanteprivacy.it) or the authority of the country where you live.
8. Cookies
The cookies and other data that the site saves in your browser are described in the cookie policy.
9. Changes
This policy changes when the site or the law changes. The date at the top shows the version in force.