Privacy notice

This page is an English summary of my privacy policy. The binding text is the Italian one: Privacy policy (in Italian). If the two differ, the Italian text prevails.

The summary follows the Italian text as updated on November 11, 2026.

Who is responsible for your data

This notice covers the website giovanniliguori.it. It is given under Article 13 of the GDPR (Regulation (EU) 2016/679) and the Italian Privacy Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).

The data controller is Giovanni Liguori, based in Italy, VAT no. 04865120168. Email: giovanni@giovanniliguori.it.

I have not appointed a Data Protection Officer (DPO), because the conditions of Article 37 of the GDPR do not apply.

What data the site collects

Browsing data: IP address, browser type, operating system, pages visited and time of access. Without your consent no analytics or marketing data is collected.
Forms: contact, guide requests, audits and the self-check, service questionnaires: usually name, email and the content of your request. I use them to reply to your request and for the other purposes stated in the dedicated sections (for example recording in the CRM). They are not passed on to third parties for their own purposes: the processors listed in this notice (for example HubSpot, Resend and Google) process them on my behalf; they may also reach OpenAI in the cases described further below, in the part on ChatGPT and Codex. Appointment bookings are made on Google Calendar booking pages (see “Processors and AI providers”).
Purchase data. See the section on purchases.
Analytics, only with your consent: Google Analytics 4 is loaded only if you accept analytics cookies in the banner. Before you choose, and if you refuse, the Google Analytics script is not loaded and no data reaches Google. If you accept, it records pages visited, session duration, device and browser used, and country, recognizing later visits from the same browser. The site does not use Google Ads: the consent signals ad_storage and ad_user_data are always denied; ad_personalization is granted only if you also accept marketing cookies. Until November 3, 2026 the script was also loaded without consent, in Google’s consent mode: without cookies, it sent Google signals about the pages visited and the site’s events, including the audit steps and interactions with the assistant.
Newsletter: signing up collects your email address, and the newsletter is managed through Resend. You can unsubscribe at any time with the link in every email. Double opt-in and proof of consent are described in the newsletter section below.

The forms and tools with their own rules (team training questionnaire, AI agents forms, AI audit, AI Act self-check, AI Build Day, client questionnaires, client area, Agent System Guide, Claude invites, newsletter, guides sent by email, AI assistant, advertising, podcast player, choice of language) are summarized in the sections below.

Purposes and legal bases

Providing services and handling contacts and bookings: performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR). The data you send through the contact and booking forms is needed to answer your requests.
Statistical analysis of web traffic: your consent (Art. 6(1)(a) GDPR). The Google Analytics 4 script is loaded, and its cookies set, only after your consent through the cookie banner. You can withdraw it at any time with “Manage cookies” at the bottom of every page, without affecting the lawfulness of processing before the withdrawal.
Legal and tax obligations: legal obligation (Art. 6(1)(c) GDPR), to comply with Italian tax law.

How long data is kept

Personal data is kept only as long as strictly necessary for the purposes it was collected for:

Technical data about requests to the server is processed for site security, as described in the security section below.
Data sent through the forms is kept for 24 months from the last contact, unless the law requires keeping it longer or a section below states a different period, and then deleted.
Analytics cookie data is kept by Google Analytics 4 for the retention period set in my property, then deleted by Google.
Your cookie banner choices stay in your browser (localStorage) for up to 6 months, after which the banner is shown again. The record of those choices the site keeps as proof of consent (date and time, choices, banner version, browser type and a pseudonymised fingerprint of the IP address, computed with a secret key) deletes itself after 24 months.

How deletion works: an automatic procedure, once a month, deletes from the site’s private archive (Upstash Redis) and from the contact list on Resend the data older than 24 months; the first run that actually deletes is scheduled for December 1, 2026. In the CRM (HubSpot), automatic deletion at 24 months covers contacts that came from the team training and AI agents forms, from the contact request of the AI Literacy guide and from the assistant, and had no follow-up; I delete the other CRM contacts myself, including those recorded before the procedure started, at expiry or earlier at your request. The notifications I receive by email and on Slack, the draft replies in Gmail, my working sessions on Claude and the work logs of the automations have no automatic deletion: I delete notifications, drafts and sessions at expiry or earlier at your request; for the logs on GitHub, see the section “AI Act self-check”.

The forms with their own retention periods are covered in their sections below.

Team training questionnaire

The questionnaire on the team training page (and on its Italian version) collects the data I need to prepare a training proposal for your team.

Contact details: first and last name, work email, company and, if you provide them, role, industry and phone number.
Your answers: number of people to train, current use of AI, goals, the processes and documents you work on, preferred format and timing.
Form language: the language you filled in the form in (Italian or English), also recorded in the CRM.
Your IP address: used temporarily, only to limit repeated submissions (rate limiting), never for profiling.

Purpose and legal basis: replying to your request and preparing a proposal, that is, pre-contractual steps taken at your request (Art. 6(1)(b) GDPR), after you have read this notice. The data is not added to any newsletter or marketing list, which require separate consent.

Where the data goes: my CRM (HubSpot, EU instance) and an email notification sent to me through Resend. It is not stored in the site CMS or shared with anyone else.

Retention: 24 months from the last contact. If the request has not turned into a contract by then, the data is deleted from the CRM. You can ask for earlier deletion, or exercise your other rights (access, rectification, objection), using the contact details above.

Transfers outside the EU: HubSpot and Resend have their headquarters or sub-processors in the United States. Any access or transfer relies on the Standard Contractual Clauses (SCC) adopted by the European Commission, as provided in the providers’ data processing agreements; providers that declare adherence to the EU-US Data Privacy Framework (DPF) are listed in the section “Transfers outside the EU”.

Forms on the AI agents page

The two forms on the AI agents page (and on its Italian version), the pilot program application and the partnership proposal, collect the data I need to assess your request and reply.

Contact details: first and last name, work email and, if you provide it, your company or firm.
Your message: the process you want to automate, or the case or partnership you propose.
Form language: the language you filled in the form in (Italian or English), also recorded in the CRM.
Your IP address: used temporarily, only to limit repeated submissions (rate limiting), never for profiling.

Purpose and legal basis: replying to your request and assessing a project or partnership, that is, pre-contractual steps taken at your request (Art. 6(1)(b) GDPR), after you have read this notice. The data is not added to any newsletter or marketing list, which require separate consent.

Where the data goes: my CRM (HubSpot, EU instance) and an email notification sent to me through Resend. It is not stored in the site CMS or shared with anyone else.

Interactive AI audit

The AI audit (in Italian) calculates its result in your browser. Your answers reach the site only if you ask for the full report by email.

Your answers to the ten questions: until you ask for the report, they stay only in your browser, in the site’s local storage (localStorage), and restarting the audit deletes them. Your email address is never stored there.
If you ask for the report: your email address, your answers and the score the site recalculates from them.
When you confirm through the link you receive: date and time of the confirmation, the consent text you accepted, your browser type (user agent) and a pseudonymised fingerprint (hash computed with a secret key) of your IP address, never the address itself. They serve as proof of consent.
Your IP address and email, turned into a pseudonymised fingerprint (hash computed with a secret key), to limit repeated requests (rate limiting), never for profiling.
If you accepted analytics cookies, Google Analytics 4 records the steps of the audit (start, completion with the resulting profile, report request and confirmation), without your email address and without your individual answers, only if you accepted analytics cookies.

Purpose and legal basis: sending you the audit report and the PDF guide you asked for, based on your consent (Art. 6(1)(a) GDPR), given with the dedicated checkbox and confirmed through the link you receive by email (double opt-in). Without that click you do not receive the report and I do not write to you about anything else. The newsletter is a separate, optional checkbox: only if you tick it, and only after confirmation, your address joins the newsletter list, marked as coming from the audit. The score is calculated with fixed rules stated on the page: no AI model reads your answers.

Where the data goes: answers and proof of consent are stored in a private database of the site (Upstash Redis, provided by Upstash, Inc.), not in the site CMS. The confirmation email and the report are sent through Resend.

Retention: the answers sent with the report request sit in a temporary draft that deletes itself after 72 hours, or earlier, as soon as the report is sent. The confirmation link expires after 24 hours. After confirmation, email, answers, score and proof of consent stay in the site’s private archive for 24 months from the last contact, and are then deleted. You can ask for earlier deletion, withdraw your consent or exercise your other rights (access, rectification, objection) using the contact details above.

Transfers outside the EU: Vercel, Upstash and Resend have their headquarters or sub-processors in the United States. Any access or transfer relies on the Standard Contractual Clauses (SCC) adopted by the European Commission, as provided in the providers’ data processing agreements; providers that declare adherence to the EU-US Data Privacy Framework (DPF) are listed in the section “Transfers outside the EU”.

AI Act self-check

The AI Act self-check (in Italian) calculates an indicative result from your answers and emails you a copy.

Your email address and your two consent choices: the copy of the result (required) and the newsletter with updates on the AI Act and automation (optional).
The result: segment, traffic light and areas to fix. The answers that are needed only for the calculation are not stored.
Proof of consent: date and time, the text and version of the consent when the result is sent, your choice on the newsletter checkbox, your browser type (user agent) and a pseudonymised fingerprint (hash computed with a secret key) of your IP address.
Your IP address and email, turned into a pseudonymised fingerprint, to limit repeated requests (rate limiting), never for profiling.

Purpose and legal basis: sending you the copy of the result, with your consent (Art. 6(1)(a) GDPR). I receive a notification with your email and the result, record the contact in my CRM (HubSpot, EU instance) with segment, traffic light, areas, origin and your choice on the newsletter and, for high-risk or prohibited results, a reminder to consider a personal reply: this rests on my legitimate interest in following up a request on a compliance topic (Art. 6(1)(f) GDPR), to which you can object at any time by writing to me. An automation based on Claude (Anthropic) reads these notifications every day and prepares the draft of a possible reply: the draft stays in my mailbox, and I read it and decide whether to send it. A second automation based on Claude checks every day that no request is left unanswered and alerts me on Slack, with your email, the segment, the traffic light and the areas. Today, without the newsletter checkbox, you receive no automatic email beyond the copy of the result. With the newsletter checkbox, the result email contains the link to confirm the subscription. For some results a follow-up email prepared in advance is planned: it is not sent today and, before it is switched on, I will update this notice. From July 28 to October 13, 2026 this email was sent automatically through Resend to people who had obtained a limited-risk result, without checking the newsletter checkbox.

Where the data goes: the site’s private database (Upstash Redis), my CRM (HubSpot), the emails sent through Resend and my internal notification (Gmail and Slack, see “Processors and AI providers”), the automation that prepares the drafts (Claude, Anthropic) and its logs (the log of sent emails and the work log, with a copy of the latter), in private repositories of mine on GitHub. Until November 11, 2026 the emails were also in my internal notes and in a contact analysis log, in the same space on GitHub: they have been removed from there, but remain in the history of those repositories (see “Retention” below).

Retention: 24 months from the last contact, then the data is deleted automatically from the site’s database and from Resend; I delete it from the CRM myself (see “How long data is kept”). The exceptions below apply. The notification and the draft reply in Gmail, the Slack notification, my working sessions on Claude and the logs on GitHub contain your email and have no automatic deletion. I delete the notification and the draft in Gmail, the Slack notification and the sessions on Claude at your request or at expiry. In the logs on GitHub the line with your email can be removed from the file, but the history of my private repositories, and of their copies on my computers, keeps it: today there is no procedure that deletes it from that history. You can ask for earlier deletion, withdraw your consent or exercise your other rights using the contact details above.

Transfers outside the EU: Vercel, Upstash, Resend, HubSpot, Google, Slack, Anthropic and GitHub have their headquarters or sub-processors in the United States. Any access or transfer relies on the Standard Contractual Clauses (SCC) adopted by the European Commission, as provided in the providers’ data processing agreements; providers that declare adherence to the EU-US Data Privacy Framework (DPF) are listed in the section “Transfers outside the EU”.

AI Build Day

The AI Build Day page (in Italian) has two forms: the “Mini map” request, before purchase, and the questionnaire you fill in after paying through the site (purchases up to November 9, 2026). Since November 9 the day is booked and paid on the Google Calendar page (see the Google entry in “Processors and AI providers”).

Mini map: email, industry, the problem you want to solve, the text and version of the consent, your browser type and a pseudonymised fingerprint of your IP address.
Questionnaire after purchase: your answers on your business, the problem, the tools you use, your experience with Claude and an optional link, tied to the name and email of the purchase verified on Stripe.

Purpose and legal basis: for the Mini map, preparing it and sending it to you at your request, with the consent you give in the form (Art. 6(1)(a) GDPR); for the questionnaire, preparing the day you bought (performance of the contract, Art. 6(1)(b) GDPR). Only if you gave marketing consent in the banner, the Mini map request and the first submission of the questionnaire are sent to Meta, as described in the section on advertising.

Where the data goes: the Mini map request in the site’s private database (Upstash Redis); both forms in my CRM (HubSpot, EU instance) and in emails sent through Resend, to you and to me. The discovery call is booked on Google Calendar pages; if you have already paid, you book by writing to me.

Retention: the Mini map request stays in the private archive for 24 months from the last contact. Since November 12, 2026 the contact created in my CRM by the request is deleted automatically after 24 months without changes, unless a deal has started; before that date I deleted it myself; the data tied to the purchase follows the section on purchases.

Transfers outside the EU: Vercel, Upstash, Resend, HubSpot and Stripe have their headquarters or sub-processors in the United States. Any access or transfer relies on the Standard Contractual Clauses (SCC) adopted by the European Commission, as provided in the providers’ data processing agreements; providers that declare adherence to the EU-US Data Privacy Framework (DPF) are listed in the section “Transfers outside the EU”.

Questionnaires for clients

Some pages of the site, not listed in the menus, let clients and prospective clients fill in a kickoff or analysis questionnaire for a project, by my invitation.

Data: name and email of the person filling it in, the answers and a pseudonymised fingerprint of the IP address. If you save a draft to resume it, you receive a link valid for 7 days and the draft deletes itself after 30 days.

Purpose and legal basis: preparing the proposal or starting the project you asked for (pre-contractual steps or performance of the contract, Art. 6(1)(b) GDPR).

Where the data goes: the site’s private database (Upstash Redis) and emails sent through Resend, to you and to me, with the answers also attached.

Retention: 24 months from the last contact, unless the answers become part of a contract’s documentation, which follows the contract’s own timing.

Client area

Clients with an active project can sign in to a private area to share files and materials with me. Access is personal and has its own notice, shown at sign-in.

Data: sign-in data (email), the files and materials you upload, and access and delivery logs. The session is stored in your browser’s local storage (localStorage, key area-sicura-auth), not in a cookie, and ends after 15 minutes of inactivity and in any case after 8 hours. Answers to questionnaires in progress stay saved in your browser until you send them or sign out with the sign-out button: if you close the tab without signing out, they stay on that device.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Where the data goes: Supabase, with the data hosted in Frankfurt. Retention: files and materials until the end of the project plus 30 days, then deleted; access and delivery logs for 24 months.

AI Systems Check questionnaire

The AI Systems Check service has been suspended since October 13, 2026 and cannot be bought today. For people who bought it earlier, the questionnaire collected company data (company name, VAT number, tax code, industry, size, address), the email of the company owner and the answers about the AI systems in use. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). The data is in my CRM (HubSpot, EU instance) and in emails sent through Resend; payment was verified on Stripe. Retention: as stated in the section on purchases.

AI Literacy guide

The AI Literacy page (in Italian) sends you by email the link to the free guide, after you confirm your address through the link you receive.

Your email address and your choice on the optional contact checkbox (“It is fine if Giovanni writes to me to discuss my case”). The newsletter is not offered here.
When you confirm through the link: date and time, the text of the consents with their version, your browser type (user agent) and a pseudonymised fingerprint (hash computed with a secret key) of your IP address. They serve as proof of consent.
Your IP address and email, turned into a pseudonymised fingerprint, to limit repeated requests (rate limiting); they delete themselves within an hour.
To open the guide, the technical cookie alf_access, valid for 30 days and only on the pages of the guide. The ticks, notes and log you fill in within the guide stay in your browser (localStorage) and do not reach the site.

Purpose and legal basis: sending you the guide, with your consent (Art. 6(1)(a) GDPR) confirmed through the link you receive by email. It is a single delivery, with no newsletter subscription. If you tick the contact checkbox, with that consent I record the contact in my CRM (HubSpot, EU instance) and may write to you to discuss your case.

Where the data goes: proof of consent in the site’s private database (Upstash Redis); the emails go out through Resend; only with the contact request, the contact in my CRM (HubSpot).

Retention: 24 months from the last contact, then the data is deleted, from the CRM too if the contact had no follow-up. You can withdraw your consent or ask for earlier deletion using the contact details above.

Transfers outside the EU: Vercel, Upstash, Resend and HubSpot have their headquarters or sub-processors in the United States. Any access or transfer relies on the Standard Contractual Clauses (SCC) adopted by the European Commission, as provided in the providers’ data processing agreements; providers that declare adherence to the EU-US Data Privacy Framework (DPF) are listed in the section “Transfers outside the EU”.

Agent System Guide

The Agent System Guide page (in Italian) sends you by email the link to the free guide, after you confirm your address through the link you receive.

Your email address and your newsletter choice (optional checkbox ticked or not). Until you confirm, the site does not store them: they travel only in the link of the confirmation email, sent through Resend.
When you confirm through the link you receive: date and time of the confirmation, the consent text you accepted with its version, your browser type (user agent) and a pseudonymised fingerprint (hash computed with a secret key) of your IP address, never the address itself. They serve as proof of consent. Next to them, the sending of the guide and, if you chose it, your newsletter sign-up are recorded.
Your IP address and email, turned into a pseudonymised fingerprint (hash computed with a secret key), to limit repeated requests (rate limiting), never for profiling. These fingerprints delete themselves within an hour.
Analytics: the confirmation page sends Google Analytics 4 a conversion event, without your email address, only if you accepted analytics cookies.

Purpose and legal basis: sending you the guide you asked for, based on your consent (Art. 6(1)(a) GDPR), given with the required checkbox of the form and confirmed through the link you receive by email (double opt-in). Without that click you do not receive the guide. It is a single delivery: no subscription and no promotional email. The newsletter is a separate, optional checkbox: only if you tick it, and only after confirmation, your address joins the newsletter list, with the proof described in the newsletter section below.

Where the data goes: proof of consent and the record of what was sent are stored in a private database of the site (Upstash Redis, provided by Upstash, Inc.), not in the site CMS. The confirmation email and the email with the guide are sent through Resend. If you choose the newsletter, your address also joins the newsletter list on Resend.

Retention: the confirmation link expires after 24 hours. After confirmation, email, proof of consent and the record of what was sent stay in the site’s private archive for 24 months from the last contact, and are then deleted. You can ask for earlier deletion, withdraw your consent or exercise your other rights (access, rectification, objection) using the contact details above.

Claude invites

The Claude invites page (in Italian) sends you by email one of my invitations to Claude, after you confirm your address through the link you receive. There are 3 invitations, given in order of confirmation: if they have run out, you receive an email that tells you so.

Your email address. Until you confirm, the site does not store it: it travels only in the link of the confirmation email, sent through Resend.
When you confirm through the link you receive: date and time of the confirmation, the consent text you accepted with its version, your browser type (user agent) and a pseudonymised fingerprint (hash computed with a secret key) of your IP address, never the address itself. They serve as proof of consent.
Your place in the order of confirmation and the outcome: invitation assigned, or invitations run out.
Your IP address and email, turned into a pseudonymised fingerprint (hash computed with a secret key), to limit repeated requests (rate limiting), never for profiling. These fingerprints delete themselves within an hour.
Analytics: the confirmation page sends Google Analytics 4 a conversion event with the outcome (invitation assigned or invitations run out), without your email address, only if you accepted analytics cookies.

Purpose and legal basis: sending you the invitation you asked for, or telling you they have run out, based on your consent (Art. 6(1)(a) GDPR), given with the required checkbox of the form and confirmed through the link you receive by email (double opt-in). It is a single delivery: the newsletter is not offered here, and your address does not join any contact or newsletter list.

Where the data goes: proof of consent, your place and the outcome are stored in a private database of the site (Upstash Redis, provided by Upstash, Inc.), not in the site CMS. The emails are sent through Resend. The invitation is a link from Anthropic: the site does not send your address to Anthropic, but if you use the link and sign up for Claude, Anthropic processes that data under its own privacy policy.

Retention: the confirmation link expires after 24 hours. After confirmation, email, proof of consent, place and outcome stay in the site’s private archive for 24 months from the last contact, and are then deleted. You can ask for earlier deletion, withdraw your consent or exercise your other rights (access, rectification, objection) using the contact details above.

Guides sent by email

Two PDF guides arrive by email right away, without double opt-in: the token guide (in Italian) and the “5 workflow” guide (from the “5 workflow” page (in Italian) or from the blog article that offers it).

Your email address, used to send you the guide.
Download record: if you ask for the “5 workflow” guide from the blog article, your address is recorded in a contact list on Resend as a record of the download. If you ask for it from the “5 workflow” page, or ask for the token guide, it is not recorded in any list.
Your IP address and email, turned into a pseudonymised fingerprint (hash computed with a secret key), to limit repeated requests (rate limiting), never for profiling. These fingerprints delete themselves within an hour.

Purpose and legal basis: sending you the guide you asked for, that is, carrying out your request (Art. 6(1)(b) GDPR). The token guide is a single send, with no emails after it. The email with the “5 workflow” guide contains the link to stop receiving anything else. If you asked for it from the “5 workflow” page, you receive only that email. If you asked for it from the blog article, the emails that follow it go out only if you also gave newsletter consent with double opt-in (newsletter section above). Until September 30, 2026 the second and third emails went out to everyone, without checking consent, and people who asked for the token guide were recorded in the same contact list on Resend. In the token guide form, the newsletter checkbox is optional and never preselected: if you tick it, you receive a second email, with the confirmation link.

Where the data goes: the emails are sent through Resend. The site does not store your address in its own database or in the CMS; the only list is the Resend one described above, for those who download from the blog article.

Retention: your address stays in the contact list on Resend for 24 months from sign-up or from the last recorded interaction, and is then deleted; if you use the link in the email you stay marked as unsubscribed until then. You can ask for earlier deletion or exercise your other rights (access, rectification, objection) using the contact details above.

Transfers outside the EU: Resend and Upstash have their headquarters or sub-processors in the United States. Any access or transfer relies on the Standard Contractual Clauses (SCC) adopted by the European Commission, as provided in the providers’ data processing agreements; providers that declare adherence to the EU-US Data Privacy Framework (DPF) are listed in the section “Transfers outside the EU”.

Third-party content: podcast

The podcast page shows the Spotify player only when you start it with the “Load the Spotify player” button. Before the click the page does not contact Spotify. After the click the player is served by Spotify AB, which may set its own cookies and process your data as an independent controller, under its own privacy policy (spotify.com/legal/privacy-policy). Alternatively you can open the podcast directly on Spotify.

Third-party content: video

The case study page (and its Italian version) shows a YouTube video only when you start it with the “Play the video” button. Before the click the page does not contact YouTube. After the click the player is served by Google Ireland Limited (YouTube) in privacy-enhanced mode (youtube-nocookie.com), which may still save data on your device and process your data as an independent controller, under its own privacy policy (policies.google.com/privacy).

The site’s AI assistant (turned off)

Since October 2, 2026 the assistant has been turned off: it does not appear on the site and receives no questions. This section remains to describe how the data collected while it was active is handled, in particular the emails left with the chat form, kept in the CRM as described below.

Until October 2, 2026 the site offered a conversational assistant based on AI (Google Vertex AI Search, on Google Cloud infrastructure in the European Union). From July 17 to October 2, 2026 the same service also answered the questions in the box on the /risorse page, with no email form and no Analytics events. People who used it were interacting with an automated system, not with a person, in line with Article 50 of Regulation (EU) 2024/1689 (the AI Act). It answered only from the content published on the site and cited its sources. Its answers were generated automatically and could contain errors: they always had to be checked against the sources shown.

Your questions, sent to Google Vertex AI Search (European Union) to generate the answer.
Your IP address, used temporarily to limit abuse of the service (rate limiting), not for profiling.
If you left your email in the chat form, your email address and any message, used only to contact you back at your request.
Interactions with the assistant (questions sent, answers with no results, booking invitations, feedback and form submission) were recorded in Google Analytics 4 to improve the service: with cookies if you had accepted analytics cookies, otherwise as signals without cookies (Google consent mode, in use on the site until November 3, 2026). From June 26 to August 14, 2026 the text of the question was also sent to Google: up to 200 characters for questions sent, in full (up to 1000 characters) for answers with no results and booking invitations, even if you had not accepted analytics cookies. From August 14 to October 2, 2026 only the length of the question sent was sent; for answers with no results and booking invitations, no data about the question.

Legal bases: for the answers, performance of the service requested and my legitimate interest in providing information about the site’s content (Art. 6(1)(b) and 6(1)(f) GDPR); for the contact form, your request to be contacted (pre-contractual steps, Art. 6(1)(b) GDPR), after you have read this notice (since August 14, 2026; before that the form collected consent, Art. 6(1)(a) GDPR). The email left in the chat was recorded in my CRM (HubSpot, EU instance) and reached me, with your message if any, as an email notification (Resend), only to contact you back, and was not added to any newsletter or marketing list, which remained subject to separate consent.

Retention: questions and IP addresses are not used for profiling; the conversations the service recorded as sessions remain in my Google Cloud project until they are deleted; the text of questions sent to Google Analytics 4 from June 26 to August 14, 2026 follows that service’s data retention. The email left with the contact form is kept in the CRM for 24 months from the last contact; if the request has not turned into a contract by then, it is deleted: automatically for requests from August 27, 2026, by me for earlier ones. Any message is only in the email notification to me, which I delete at expiry or earlier at your request. You can exercise your rights (access, rectification, erasure, objection) using the contact details above.

Transfers outside the EU: the providers involved (Google for Vertex AI Search and Analytics, HubSpot, Resend) are US companies. Even when the data is hosted in data centers in the European Union, any access or transfer relies on the Standard Contractual Clauses adopted by the European Commission, as provided in the providers’ data processing agreements; providers that declare adherence to the EU-US Data Privacy Framework are listed in the section “Transfers outside the EU”.

Advertising: Meta Pixel and Conversions API

To measure the effectiveness of ad campaigns on Meta platforms (Facebook and Instagram) and for remarketing, the site uses the Meta Pixel and the Meta Conversions API. They process browsing data (pages visited and events such as viewing the product and starting checkout). For the events sent from the server through the Conversions API the site transmits the email address turned into a fingerprint (SHA-256 hash): for a completed purchase only that; for the AI Build Day Mini map request and the first submission of the questionnaire after the AI Build Day purchase, also the IP address, the browser type and the identifiers of the _fbp and _fbc cookies. After marketing consent, Meta’s script also saves in your browser (localStorage) the site you came from and the time (lastExternalReferrer, lastExternalReferrerTime).

Legal basis: your consent (Art. 6(1)(a) GDPR). The Pixel starts only after you give marketing consent through the cookie banner. Server-side events are sent only if you gave marketing consent in the site banner before checkout or before submitting the form: in every other case nothing is sent to Meta. Before consent, no Meta script is loaded and no cookie is set. You can withdraw consent at any time with “Manage cookies”.

Joint controllers: for collecting and transmitting to Meta the data of the Pixel and the Conversions API, I and Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) are joint controllers under Article 26 of the GDPR, according to Meta’s Controller Addendum. Any further processing Meta carries out for its own purposes is under its sole responsibility and is described in its policy. You can exercise your rights with me or with Meta. If data is transferred to Meta Platforms, Inc. in the United States, Meta Platforms, Inc. declares its participation in the EU-US Data Privacy Framework (DPF) for the transfer; failing that, the Standard Contractual Clauses (SCC) apply. Meta’s policy: facebook.com/privacy/policy.

You can manage your ad preferences, object to personalized advertising and withdraw consent at any time through the site’s cookie banner, your Meta account settings and youronlinechoices.eu. The _fbp and _fbc cookies are described in the cookie summary.

Processors and AI providers

I use the following processors under Article 28 of the GDPR:

Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland): Google Analytics 4 for statistical analysis of web traffic, active only with your consent to analytics cookies, and Google Workspace (Gmail, Drive, Calendar) for business email, files and calendar; Google Cloud (Vertex AI Search) for the site’s assistant, turned off since October 2, 2026. Since November 9, 2026, appointment bookings from the site go through Google Calendar booking pages, which open on a Google domain: Google processes the name, email and answers you enter in the booking form; for paid bookings, payment is handled by Stripe. Google Ireland relies on Google LLC (USA) as a sub-processor; for the transfer, Google LLC declares its participation in the EU-US Data Privacy Framework (DPF), and the Standard Contractual Clauses (SCC) in Google’s data processing terms also apply. Privacy policy.
Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA): website hosting and, through Vercel Speed Insights, page performance measurement (Web Vitals). Speed Insights sets no cookies and cannot reconstruct your browsing or identify you: for each measurement it records the page, connection type, browser, device type and operating system, country and the metric value. Privacy policy.
Sanity AS (Grensen 13, 0159 Oslo, Norway): content management system (CMS). Privacy policy.
Stripe (Ireland for EU customers, with group companies in the United States): payment processing and checking that a purchase has been paid before accepting the related questionnaires. Transfer: Standard Contractual Clauses (SCC) provided in the provider’s data processing agreement (DPA); Stripe also declares its participation in the DPF.
Cal.com, Inc. (USA): handled the site’s appointment bookings until November 9, 2026 and keeps the data of the bookings made up to that date (name, email, date and form answers). The site no longer uses it, but until I turn them off the booking pages on Cal.com remain reachable from links already shared: whoever books there leaves name, email and answers with Cal.com, and those bookings no longer reach my systems. The transfer relies on Cal.com’s data processing agreement.
Upstash, Inc. (USA): the site’s private database (Upstash Redis), connected through Vercel. It holds in particular the proofs of consent and the request data described in the sections on the AI audit, the AI Literacy guide, the AI Act self-check, AI Build Day, client questionnaires, the Agent System Guide, the Claude invites and the newsletter; the state of the welcome sequence; the record of cookie banner choices; the fingerprints (hashes) used to limit repeated requests. Data hosted in the European Union. Transfer: Standard Contractual Clauses (SCC) provided in the provider’s data processing agreement (DPA); Upstash also declares that it relies on the EU-US Data Privacy Framework (DPF).
Supabase Pte. Ltd. (Singapore), with the data hosted in the European Union (Frankfurt): database of the client area, described in the “Client area” section. Transfer, for any access from outside the EU (for example support): Standard Contractual Clauses (SCC) provided in the provider’s data processing agreement (DPA).
Slack Technologies, LLC (USA): internal notifications to me. Technical site alerts show the email in masked form (only the first two letters before the @ and the domain); the notifications of AI Act self-check results show the email, segment and areas of the result, so I can decide whether to reply. Transfer: Standard Contractual Clauses (SCC) provided in the provider’s data processing agreement (DPA); Slack also declares its participation in the DPF through Salesforce.
GitHub, Inc. (USA): my private repositories with the work logs of the automations; the log of sent emails and the work log of the self-check automation, with a copy of the latter in a second private repository of mine, contain the emails of the leads (in the copy, since November 11, 2026, the emails are replaced by pseudonyms). An internal analysis log of acquisition sources records, for requests and purchases that came from the site, channel, industry, outcome and, for purchases, product and amount, without emails; for some requests the company name, the date and the subject of the email received and a reference to internal notes remain: it helps me understand which channels bring clients and requests, on the basis of my legitimate interest (Art. 6(1)(f) GDPR), to which you can object by writing to me; it is kept as long as that analysis needs it and not beyond the retention periods of the data it derives from. Until November 11, 2026 the emails of leads and buyers were also in internal notes, in reports and in that log, from which they have been removed; they remain in the history of those repositories. My internal sales management notes, in the same private repositories, also concern some buyers and some people who wrote from the site: since November 11, 2026, in most of these notes a pseudonym replaces the name, and product, date and amount remain; before, they also contained the name and, for some, role, company and city taken from the public LinkedIn profile, which remain in the history of the repositories. These notes serve to follow the relationship with clients, to understand how they came to buy, to ask for a testimonial where appropriate and to propose my other products with direct LinkedIn messages (on July 23, 2026 they were sent to 7 buyers of Claude Mastery), on the basis of my legitimate interest (Art. 6(1)(f) GDPR), to which you can object by writing to me: after an objection you receive no further messages of this kind. Transfer: Standard Contractual Clauses (SCC) provided in the provider’s data processing agreement (DPA).
Anthropic Ireland, Limited (Dublin, Ireland): content processing with Claude, under a commercial contract. Anthropic Ireland relies on Anthropic PBC (USA) as a sub-processor. Transfer: Standard Contractual Clauses (SCC).
ElevenLabs (ElevenLabs Ltd. and Eleven Labs Inc.): synthetic voice, audio, sound effects and music generated through the API, for my own content (including my cloned voice) and for a video job carried out for a client. Transfer: Standard Contractual Clauses (SCC) provided in the provider’s data processing agreement (DPA).
HubSpot, Inc. (USA), with the data hosted in the European Union: CRM for contacts, requests and purchases. Transfer, for any access from the United States: Standard Contractual Clauses (SCC) provided in the provider’s data processing agreement (DPA); HubSpot also declares its participation in the DPF.
Plus Five Five, Inc. (Resend, USA): newsletters, transactional emails and notifications to me, and the contact lists described in the individual sections. Account and contact data are stored in the United States. Transfer: Standard Contractual Clauses (SCC) provided in the provider’s data processing agreement (DPA); Resend also declares its participation in the DPF.
Meta Platforms Ireland Ltd. (Dublin, Ireland): advertising measurement, as joint controller for the Pixel and the Conversions API, as described in the section on advertising.

Besides Claude (Anthropic), I use these AI systems: ElevenLabs (synthetic voice, audio, sound effects and music, including my cloned voice), OpenAI (ChatGPT and Codex, also for social carousel images, on an individual plan), Legal Data Hunter, Apify and the AI features of HubSpot; locally, on my own hardware, Whisper, VoxCPM2 and the Ollama models (qwen2.5, gemma3, bge-m3, nomic-embed-text), which involve no data transfer. The OpenAI plan I use is individual and does not include a data processing agreement: for this reason OpenAI is not listed among the processors, and I do not use OpenAI to process data collected by the site. Codex, however, works on my working files, on my computer: among them are the self-check logs, with the emails of leads, and other working copies and notes that contain emails or names of some leads and buyers of the site. When I use Codex on those files, OpenAI may receive their content. Codex also has the Slack connection and control of the computer’s apps: when I use them, OpenAI may also receive the Slack notifications described in this notice and what is visible on the screen. At least until the end of October 2026, my video calls with clients, partners and leads, including those booked from the site, were recorded and transcribed with ChatGPT Meetings (OpenAI): notes and transcripts stay in my OpenAI account until I delete them, and on request I delete those that concern you. Video calls are no longer recorded today. Since November 11, 2026, in most notes and reports emails and names are replaced by pseudonyms, but not in all files. Google remains a provider for Google Analytics 4 and Google Workspace, and for Google Cloud (Vertex AI Search), where the sessions of the assistant turned off on October 2, 2026 remain. In another Google Cloud project of mine, suspended since October 2, 2026, an archive of copies of my internal notes remains, including sales notes with the name of some buyers, until I delete it. Gemini, Antigravity, Perplexity, Grok (xAI), Tavily, Gamma, Granola (the meeting notes up to October 31, 2026 remain in its account until I delete them), Vibe Prospecting, Higgsfield, GPT-OSS, Sanity AI Assist (the writing assistant of the content management system, used until June 9, 2026) and the qwen model on an external server are no longer in use. How each system is used is described on the AI transparency page (in Italian).

Transfers outside the EU

Some processors are based outside the European Economic Area or rely on sub-processors there: Google LLC (for Google Ireland), Vercel Inc., Upstash, Inc., Supabase Pte. Ltd. (Singapore, with the data hosted in the EU), Anthropic PBC (for Anthropic Ireland), ElevenLabs, Stripe, HubSpot, Inc. (with the data hosted in the EU), Resend, Slack Technologies, LLC, GitHub, Inc., Sanity (for its US sub-processors), Cal.com, Inc. (for bookings made up to November 9, 2026 and for those made later on its pages that are still active) and Meta Platforms, Inc. Except as stated for Cal.com and Meta in their own sections, the transfer relies on the Standard Contractual Clauses (SCC) approved by the European Commission, as provided in the data processing agreements. Google, Meta, Stripe, HubSpot, Resend, Slack, Upstash, Vercel and ElevenLabs also declare that they participate in the EU-US Data Privacy Framework (DPF), the subject of the European Commission’s adequacy decision of July 10, 2023: where participation is active, it applies too. AI models run locally, on my own hardware, involve no transfer outside the EU. Spotify, when you start the podcast player, processes data as an independent controller, under its own privacy policy; the same goes for Google (YouTube) when you start the case study video. OpenAI, which also processes data in the United States, is not a processor: I use it on an individual plan, without a data processing agreement or Standard Contractual Clauses, and it may receive personal data in the cases described in the part on ChatGPT and Codex.

How I use AI

Under Article 50 of Regulation (EU) 2024/1689 (the AI Act) and Italian Law 132/2025, I inform you that this site and the professional work connected to it use AI systems.

Content creation: blog articles, LinkedIn posts and the site copy are produced with the assistance of Claude (Anthropic). Since November 11, 2026 a blog article is published only after my recorded approval; the automations that prepare or update articles leave only drafts. Before that date some articles were published automatically, after automatic checks and without human review before publication.
Social: LinkedIn posts may be written with AI assistance and carry the hashtag #AIAssisted. The automations that generated LinkedIn comments and replies have been stopped since June 30, 2026. The identity and the opinions expressed are mine.
Data analysis: dashboards, reports and SEO analyses are generated automatically by AI agents.
Operational automations: metrics collection, monitoring and the preparation of drafts are handled by automations; since November 11, 2026 the publication of articles and posts requires my approval. The guides in the /risorse section created by the reels automation, with the AI-assisted content badge, were created and published automatically, without human review before publication, until September 15, 2026, and remain online. The automation has been stopped since that date; the site code still allows automatic publication of new guides: before reactivating it I will update this page.

Blog posts for which the level of AI involvement is stated show a visible badge: AI-Assisted (AI supports the creation and a human decides the content; for the /risorse guides created by the reels automation and published automatically until September 15, 2026 there was no approval before publication), AI-Generated (output generated by AI and reviewed by a human), Human-Written (written entirely by a human). Where the badge is missing, the post was written with the assistance of Claude. Since November 11, 2026 every published article is approved by Giovanni Liguori before publication; for articles published earlier, see “Content creation” above.

No decision with legal effects on you, or that significantly affects you, is taken solely by automated means. AI systems are operational support tools, not used for automated decisions under Article 22 of the GDPR. The AI Act self-check does, however, assign leads a segment and a risk level, which I use to prioritize contacts in the CRM, and the data sent to Meta may be used for remarketing: these are forms of profiling, described in their respective sections.

I use ElevenLabs to clone my own voice. Published content that uses the AI-cloned voice is labeled as such, under Article 50(4) of the AI Act and recitals 133-134.

Cookies

The site uses technical cookies needed for it to work, analytics cookies (Google Analytics 4) and marketing cookies (Meta Pixel), the last two only with your consent: before you choose, and if you refuse, their scripts are not loaded. Details in the cookie summary and in the binding cookie policy (in Italian).

Choice of the site language

The site is available in Italian and English. When you open one of the translated pages without having chosen a language, the site uses the country you connect from, derived from your IP address by the hosting platform (Vercel), and the language set in your browser: if you connect from outside Italy, San Marino and Vatican City and your browser is not in Italian, it shows you the English version. This data serves only that choice: the site does not store it, does not link it to you and sets no cookie. Search engines are not redirected.

If you choose a language with the IT/EN switch, the site remembers your choice with the technical cookie lang_pref for 12 months (see the cookie summary). Legal basis: my legitimate interest in showing you the site in a language you understand (Art. 6(1)(f) GDPR) and, for the cookie, your request through the switch.

Security, logs and performance

To protect the site and prevent abuse (repeated requests, automated submissions, attacks), the server processes the IP address and the technical data of each request (page, date and time, browser type). Legal basis: my legitimate interest in the security of the site (Art. 6(1)(f) GDPR). To limit repeated requests the site stores a pseudonymised fingerprint of the IP address (and, in some forms, of the email), computed with a secret key, which deletes itself within an hour (within 24 hours for the site’s assistant, now turned off), unless a section below says otherwise. Technical logs stay with the hosting provider (Vercel) for the period its service provides.

The site measures page performance with Vercel Speed Insights, without cookies and without identifying you (see the processors section). Legal basis: my legitimate interest in keeping the site fast and working (Art. 6(1)(f) GDPR).

Purchases

If you buy a product or service from the site (for example AI Build Day or Claude Mastery), payment is handled by Stripe: I receive your name, email, amount and billing details, not your full card details. Since November 9, 2026, AI Build Day is booked and paid on the Google Calendar booking page, with payment through Stripe (see the Google entry in “Processors and AI providers”). For AI Build Day purchases made through the site up to November 9, 2026, name, email and purchase status are also recorded in my CRM (HubSpot, EU instance). People who buy Claude Mastery are recorded in the contact list on Resend as customers, with product and purchase date, to deliver the product and its updates; there it stays for 24 months from sign-up or from the last recorded interaction, then it is deleted. The newsletter and the welcome email sequence go out from the list only if you have also given the consent described in the section on the newsletter. Only with marketing consent, a purchase completed through the site’s checkout is sent to Meta as described in the section on advertising. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and tax and accounting obligations (Art. 6(1)(c) GDPR). The purchase also appears in the internal acquisition-source analysis log described in the section “Processors and AI providers”, GitHub entry: today with product, amount, date and channel, without name or email. Until November 11, 2026 the log also contained name, email and payment reference, which have been removed and remain in the repository history. Invoices and accounting records are kept for 10 years (Article 2220 of the Italian Civil Code); the other purchase data is kept as long as needed to deliver the product and handle support, refunds or disputes, then deleted.

Providing data and withdrawing consent

Providing your data is optional. In the forms, the required fields are needed to answer your request: without them the request cannot be handled. For a purchase, billing details are required by law. Refusing analytics and marketing cookies does not limit your use of the site.

When processing is based on consent (analytics and marketing cookies, newsletter, guides, invitations), you can withdraw it at any time: for cookies with “Manage cookies” at the bottom of every page, for emails with the unsubscribe link or by writing to me. Withdrawal does not affect the lawfulness of processing before it.

Your rights

Under Articles 15-22 of the GDPR, you have the right to:

get confirmation that I hold personal data about you and access it (right of access, Art. 15);
have inaccurate data corrected or incomplete data completed (Art. 16);
have your data erased (right to be forgotten, Art. 17);
restrict the processing (Art. 18);
receive your data in a structured, commonly used format (right to data portability, Art. 20);
object to the processing (Art. 21);
not be subject to decisions based solely on automated processing (Art. 22).

To exercise these rights, write to giovanni@giovanniliguori.it. I reply within 30 days of receiving the request.

Right to lodge a complaint

You have the right to lodge a complaint with the competent supervisory authority. In Italy, it is the Garante per la protezione dei dati personali (Italian Data Protection Authority), Piazza Venezia 11, 00187 Rome. Website: garanteprivacy.it. Email: protocollo@gpdp.it. Certified email (PEC): protocollo@pec.gpdp.it.

English summary written on November 11, 2026. The Italian text prevails.