Privacy Policy
Last updated: September 24, 2026
1. Data controller
The data controller for marcello.design is:
Marcello Di Giovanni
Sole proprietorship (Ditta Individuale)
VAT number: IT04237110616
Email: hello@marcello.design
For any privacy-related question or to exercise your data protection rights, you can contact me at hello@marcello.design or use the contact form available on this website.
2. Personal data collected and purposes
Contact form
When you contact me through the website, I may collect:
- your name;
- your email address;
- your company name, if provided;
- the content of your message.
This information is used exclusively to receive, manage and reply to your request and, where relevant, to take steps requested by you before entering into a professional relationship.
By submitting the contact form, you acknowledge that I may contact you using the email address you provided for the sole purpose of responding to and managing your request. Submitting the form does not subscribe you to marketing communications or a newsletter.
You are responsible for ensuring that the information you submit is accurate, lawful and appropriate for the purpose of your request. If you provide personal data relating to another person, you must have the right to do so.
Please do not submit unlawful content, sensitive personal data, confidential third-party information or information that is not necessary for your request.
The contact form uses Framer's native form functionality. Framer processes form submissions on my behalf and provides built-in spam protection and rate limiting. Framer may also process technical information necessary to submit the form securely and prevent spam or abuse.
You can read the Framer Privacy Statement at: framer.com/legal/privacy-statement
Booking a call
The "Book a call" button is a standard external link to my booking page on Cal.com. Cal.com is not embedded in marcello.design.
If you follow the link, you leave this website and interact with Cal.com. When you schedule a call, Cal.com may collect your name, email address, selected date and time, time zone, booking details and any other information you voluntarily provide. I may receive and access this information in order to schedule, confirm and manage the requested meeting.
The information is used only for communications directly related to the booking and does not subscribe you to marketing communications or a newsletter.
Cal.com processes booking information in accordance with its applicable privacy terms and data-processing arrangements. You can read the Cal.com Privacy Policy at cal.com/privacy.
MARC AI chat assistant
This website offers an optional chat assistant called MARC AI, an artificial intelligence (AI) chatbot that answers questions about my work, experience and projects. You are talking to an AI, not to a human, and its answers are generated automatically.
When you use the chat, the messages you type are sent to a third-party large language model provider, which generates the reply and sends it back to the website. This is necessary for the chat to work.
You do not need to register, create an account or provide your name or email address to use the chat, and the chat does not ask you for any of these.
The questions you ask and the answers you receive are logged so that I can review them, check the quality of the assistant's answers, spot mistakes and improve its instructions and the website. Each log entry also includes a randomly generated conversation identifier and basic technical information about the exchange (such as token counts). Logs are not linked to any account, name or email address, and I do not use them to identify you, build a profile about you, send you communications or for advertising. Logs are automatically deleted after 30 days.
To protect the service from abuse and keep it within its usage limits, the chat applies rate limits per conversation and per visitor. For this purpose, your IP address is processed at the moment of the request to generate a one-way (hashed) value used only as a counter for up to one hour; the raw IP address is never stored, is not kept together with the conversation logs described above, and is not used to identify you.
To keep track of the current conversation while the chat panel is open, a randomly generated conversation identifier is stored in your browser's session storage. It contains no personal information, is not linked to your identity, and is automatically cleared when you close the browser tab. Because it is strictly necessary to provide the chat feature you have requested, it does not require prior consent.
Other technical information necessary to deliver and secure the service (for example request logs and security events) may be processed by the infrastructure providers described in "Website delivery and security" and by the AI provider, according to their own policies.
Because you write in free text, you decide what you type. Please do not enter personal data about yourself or others (such as your name, contact details, or sensitive data like health data, political opinions or religious beliefs) or confidential information in the chat. If you do, that content may end up in the anonymous conversations described above. The assistant is designed to answer questions about my professional work: for any request to contact me or to book a call, it will point you to the contact page or to the booking link, which are governed by the sections above.
AI-generated answers may be incomplete or inaccurate. Please do not rely on them as a substitute for information you can verify directly with me.
The AI provider processes chat messages under its own terms and privacy policy: anthropic.com/legal/privacy
Website analytics
This website uses Framer Analytics and Cloudflare Web Analytics to understand aggregate website usage and improve its content, performance and usability.
Depending on the service, technical information such as visited pages, approximate location or country, browser type, operating system, device type, referring page and performance information may be processed.
These services are not used by me to identify individual visitors, create advertising profiles or display targeted advertising. Framer Analytics does not use cookies or generate persistent identifiers. Cloudflare Web Analytics provides privacy-focused aggregate analytics.
More information is available in:
Framer Privacy Statement: framer.com/legal/privacy-statement
Cloudflare Privacy Policy: cloudflare.com/privacypolicy
Website delivery and security
Framer and Cloudflare provide services used to host, deliver, secure and improve the performance of this website.
When you visit the website, these providers may process technical information required to establish the connection, deliver the requested pages and protect the website. This may include IP addresses, browser and device information, requested URLs, timestamps, request logs, security events and diagnostic information.
This processing is necessary for the secure and reliable operation of the website and for detecting and preventing malicious traffic, fraud and abuse.
Password-protected portfolio
The portfolio page is password-protected using Cloudflare.
When you enter the correct password, a strictly necessary authentication cookie may be stored in your browser so that the website can remember that access has been authorised.
This cookie is used exclusively to provide and secure access to the protected portfolio. It is not used for advertising, profiling or analytics and is retained only for the period necessary to maintain the authorised session.
Because this cookie is strictly necessary to provide a feature explicitly requested by the user, it does not require prior consent.
3. Legal bases for processing
Personal data is processed on the following legal bases:
- Contact requests: processing is necessary to respond to your request or take steps at your request before entering into a contract, under Article 6(1)(b) GDPR.
- General communications and relationship management: my legitimate interest in responding to messages, managing professional communications and protecting my legal rights, under Article 6(1)(f) GDPR.
- MARC AI chat assistant: my legitimate interest in offering visitors an interactive way to learn about my work, in keeping the service secure and within its usage limits, and in logging conversations for a limited time to review, troubleshoot and improve the assistant's answers and the website, under Article 6(1)(f) GDPR. Use of the chat is optional.
- Website analytics: my legitimate interest in understanding aggregate website usage and improving the website, under Article 6(1)(f) GDPR.
- Website delivery, security and abuse prevention: my legitimate interest in operating and protecting the website securely and reliably, under Article 6(1)(f) GDPR.
- Protected portfolio: my legitimate interest in controlling and securing access to confidential professional materials, under Article 6(1)(f) GDPR.
- Legal and administrative obligations: compliance with applicable legal obligations, under Article 6(1)(c) GDPR, where relevant.
Booking requests made through Cal.com are processed to take steps at your request before entering into a possible professional relationship, under Article 6(1)(b) GDPR, and to manage the requested meeting.
4. Whether providing data is required
Providing information through the contact form is voluntary.
However, fields marked as required are necessary to process your request. If you do not provide them, I may be unable to reply.
Using the MARC AI chat is entirely optional. You can browse the whole website without using it.
Information requested directly by Cal.com is subject to Cal.com's own requirements and privacy policy.
5. Data retention
Contact requests and related correspondence are generally retained for no longer than 24 months after the last relevant communication, unless a longer period is necessary for an ongoing professional relationship, to establish or defend legal claims, or to comply with a legal obligation.
Contact-form correspondence and booking-related communications may be received and stored in my Gmail account and are retained in accordance with the retention periods described above, unless longer retention is required for an ongoing professional relationship, legal obligations or the establishment or defence of legal claims.
Form submissions are processed through Framer and delivered according to the destination configured for the native form. Any information retained by Framer is handled according to Framer's applicable terms, data-processing arrangements and retention policies.
Where a communication results in a contractual or professional relationship, relevant administrative, contractual and accounting information may be retained for the period required by applicable law.
MARC AI conversation logs (questions, answers, the conversation identifier and basic technical information) are retained for no longer than 30 days, after which they are automatically deleted. The hashed value derived from your IP address, used only for rate limiting, is retained for up to one hour. The conversation identifier stored in your browser's session storage is cleared when you close the browser tab. Any information retained by the AI provider or by the infrastructure providers used to deliver the chat is handled according to their own terms and retention policies.
Technical and security information is retained according to the operational and security requirements and applicable policies of Framer and Cloudflare.
The authentication cookie for the protected portfolio is retained only for the duration configured for the authorised session.
Booking information is retained for the time necessary to organise and manage the requested meeting and any resulting professional communication, subject to the applicable Cal.com account settings and retention arrangements.
6. Recipients and service providers
Personal data may be processed by service providers used to operate this website and provide its features, including:
- Framer, for website hosting, delivery, native contact-form processing and analytics;
- Cloudflare, for website security, network delivery, protected access, web analytics and for running and storing data of the MARC AI chat service;
- Cal.com, for providing the external appointment-scheduling service;
- Anthropic, for generating the replies of the MARC AI chat assistant;
- Google, for receiving, storing and managing contact-form correspondence and booking-related communications through Gmail.
These providers process data according to their respective roles, contractual obligations and privacy policies.
Personal data may also be disclosed where required by law, a court order or a competent public authority.
I do not sell personal data and do not use it for targeted advertising.
7. International data transfers
Some service providers, including the provider of the MARC AI chat assistant, may process personal data outside the European Economic Area.
Where required, international transfers are protected through an adequacy decision adopted by the European Commission, Standard Contractual Clauses or another safeguard recognised under the GDPR.
Further information about the transfer mechanisms used by each provider is available in their respective privacy policies.
8. Your rights
Subject to the conditions and limitations established by the GDPR, you have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete data;
- request deletion of your personal data;
- request restriction of processing;
- receive personal data you provided in a structured, commonly used and machine-readable format, where applicable;
- object to processing based on legitimate interests;
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
- lodge a complaint with a competent supervisory authority.
To exercise these rights in relation to processing carried out through marcello.design, contact hello@marcello.design. I may request additional information where reasonably necessary to verify your identity.
MARC AI conversation logs are not linked to any account, name or email address of yours. For this reason, to give effect to an access, correction or deletion request concerning a specific conversation, I may ask you for enough detail (such as the approximate date and time, and the content of your message) to locate it within the 30-day retention period.
Requests concerning data processed directly through Cal.com or by the AI provider may also need to be addressed to those providers.
You may lodge a complaint with:
Garante per la protezione dei dati personali
garanteprivacy.it
If you live in another EEA country, you may also contact the data protection authority in your country of residence.
9. Automated decision-making
Personal data collected through marcello.design is not used for automated decision-making or profiling that produces legal or similarly significant effects.
The MARC AI chat assistant generates informational answers automatically, but it does not make decisions about you, does not evaluate you and does not produce legal or similarly significant effects.
10. External links
This website may contain links to third-party websites and services. When you follow an external link, the third party's own terms and privacy policy apply.
I am not responsible for the content or privacy practices of third-party websites.
11. Changes to this Privacy Policy
This Privacy Policy may be updated when the website, its services or applicable legal requirements change.
The updated version will be published on this page together with its revision date.
