Privacy Policy
Data Controller
The data controller is Matteo, author and operator of MAuToBlog (a private individual running a personal, non-commercial website). For any request about your personal data, including exercising the rights described below, you can email privacy@mauto.dev or use the contact form with “Privacy” in the subject.
What data I process
This is a static website: it has no database, requires no registration and uses no cookies. The only personal data processed is described below.
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Hosting and delivery | IP address, user agent, requested page (technical logs) | Serve the site and keep it secure | Legitimate interest (Art. 6(1)(f) GDPR) | According to the hosting provider’s policies |
| Umami statistics | IP address (only to derive the country, not stored), visited pages, referrer, browser, operating system, device type | Aggregated usage statistics | Legitimate interest (Art. 6(1)(f) GDPR) | Aggregated metrics are kept indefinitely, as they do not identify the visitor |
| Umami Session Replay | Mouse movements, clicks, scrolling, with input fields masked | Improve the user experience | Consent (Art. 6(1)(a) GDPR) | Up to 90 days |
| Comments (Giscus) | IP address on load; if you comment, GitHub account and comment text | Allow comments on articles | Legitimate interest (Art. 6(1)(f) GDPR); to comment, your voluntary sign-in to GitHub | Comments stay public on GitHub until you delete them |
| Contact form | Name, email, subject, message | Reply to your request | Pre-contractual measures / data subject’s request (Art. 6(1)(b) GDPR) | Up to 12 months after the last exchange, then deleted |
Traffic Analysis Tools
Umami Analytics
I use Umami in self-hosted mode, on a server I manage. Umami:
- does not use cookies
- does not store your IP address: it is used only at the time of the visit to derive your approximate country
- does not build profiles or track you across websites
- produces only aggregated metrics (visited pages, referrers, device type, country)
No consent is required because processing is minimal, limited to aggregated statistics and based on the legitimate interest in understanding how the site is used.
Umami Session Replay (consent-based only)
Only if you give consent via the banner, Umami Session Replay is activated, which records browsing sessions (mouse movements, clicks, scrolling) for the sole purpose of improving the site experience. This tool:
- is loaded only after your explicit consent (by clicking “Accept”): if you decline or make no choice, it is not activated
- records only a sample of sessions, for a maximum of 5 minutes each
- applies masking of sensitive data entered in input fields
- does not use cookies
You can withdraw consent at any time via the “Reset Consent” link in the footer. Withdrawal takes effect from the next page load.
Contact Form
If you write to me via the contact form, the data you enter (name, email, subject, message) is received through Netlify Forms and used only to reply to you. I do not use it for newsletters or marketing and do not share it with third parties.
Comments
Comments on articles use Giscus, which stores comments as public discussions on GitHub. When the page loads, the comment box is fetched from giscus.app, which therefore receives your IP address. To comment you must sign in with your GitHub account: in that case your comment and username are public and processed by GitHub under its privacy statement. You can edit or delete your comments directly on GitHub.
Service Providers and Data Transfers
To run the site I rely on the following providers, which process data on my behalf as processors (Art. 28 GDPR):
| Provider | Service | Location |
|---|---|---|
| Netlify, Inc. | Site hosting, CDN, contact form | USA |
| Cloudflare, Inc. | Network and protection for the statistics server | USA |
| GitHub, Inc. | Comment storage (Giscus) | USA |
| Giscus (giscus.app) | Loading the comment box | Global CDN |
| jsDelivr | Loading the MathJax library, only on articles with mathematical formulas | Global CDN |
Netlify, Cloudflare and GitHub participate in the EU-U.S. Data Privacy Framework, which is the basis for transferring data to the United States (Art. 45 GDPR).
Cookies and Local Storage
This website uses no cookies. The only data stored in your browser is the following:
| Name | Type | Purpose | Consent required |
|---|---|---|---|
cookie-consent (localStorage) | Technical | Stores your choice on the banner | No |
I do not use profiling cookies or share data with third parties for advertising purposes.
Managing consent
A banner is shown on first visit. You can reset your choice at any time via the “Reset Consent” link in the footer.
Your Rights
Under Arts. 15–22 GDPR you have the right to:
- access your data and receive a copy
- request rectification or erasure
- request restriction of processing
- object to processing based on legitimate interest
- receive your data in a structured format (portability)
- withdraw your consent at any time, without affecting the lawfulness of prior processing
To exercise them, email privacy@mauto.dev or use the contact form. Please note that Umami statistics are aggregated and do not allow me to trace your visit.
Right to lodge a complaint
You have the right to lodge a complaint with your national data protection authority under Art. 77 GDPR. In Italy: Garante per la Protezione dei Dati Personali.
Last updated: 13 October 2026