Privacy and cookie notice

Who is responsible for your data?

Andrea Virnicchi is the data controller for this project. For privacy questions, requests about your data or newsletter replies, contact virand2010@gmail.com.

Your choices come first

You can browse without accepting analytics or subscribing to anything. Optional analytics starts only after you select Accept in the privacy dialog. To reject it or change your choice, return to the website and use Privacy choices in the footer. Withdrawing consent stops future analytics collection from this browser; it does not automatically erase data already received by Google.

Submitting your email address and giving consent through the newsletter form starts your subscription immediately. No confirmation email is required or sent. Browsing alone never subscribes you.

What we use data for

Delivering and protecting the website

Cloudflare processes connection information, such as IP addresses and request details, to serve the website and protect it against abuse. The application uses hashed identifiers for request limits, and records security and administrator actions. This processing supports our legitimate interest in running a reliable, secure website (Article 6(1)(f) GDPR).

Understanding visits and selected clicks

With your consent (Article 6(1)(a) GDPR), Google Analytics 4 receives visits, browser and device information, approximate geographical areas and selected interactions on the website, newsletter landing page and standalone registration page. These include reading-language, shop-edition and social-network links, sections viewed, opening the website from the landing page, and form views, starts, accepted requests and broad error categories. Signup requests are not a count of unique new subscribers. The embedded form reports these events to its parent page without loading a second Analytics tag.

The site does not request GPS access. Its analytics events exclude email addresses, form contents and administrator activity. Page addresses are stripped of query strings; only predefined source, medium, campaign and placement labels are passed separately. The site's tag disables advertising consent, Google signals and ad-personalisation signals. No analytics tag is included in the administrator area or this privacy page.

The newsletter

Subscribing is optional and based on your consent (Article 6(1)(a) GDPR). We use your email address and selected language to send Whisper news, artwork, chapter updates and event information. We also record subscription status, the source and time of registration, the privacy-notice version and withdrawal records. For new subscriptions, we record the consent given through the form; this does not verify ownership of the email address.

If you also accept optional analytics, predefined campaign labels may accompany a new registration in our private archive so we can compare which campaigns bring subscribers. This association is optional and is not required to subscribe. No email address or subscriber identifier is sent to Google Analytics. Without optional analytics consent, we record only whether the form was on the website or landing page. Administrators can view aggregate registration counts separately from anonymous request-event reports.

When enabled, a welcome email introduces Whisper after a new subscription. Receiving it does not verify ownership of the mailbox or require another action to subscribe. Each newsletter and welcome email includes an unsubscribe link. Addresses previously unsubscribed or excluded from delivery are not automatically reactivated through this form. We retain exclusion records to honour opt-outs and prevent accidental resubscription, relying on our legitimate interest in respecting recipients' preferences. Providing an email address is necessary to receive the newsletter, but not to use the website.

Messages you send to our contact address are used to answer your request. This site does not use your data for automated decisions that produce legal or similarly significant effects.

Cookies and browser storage

• Your privacy choice: stored locally as whisper-analytics-consent-v2 and respected for 180 days. After that, the site asks again. This updated measurement asks visitors using the previous choice version to choose again. Each website address has its own local storage.
• Optional campaign context: after analytics consent, allowlisted labels are kept in this tab’s session storage as whisper-marketing-attribution-v1, for up to 30 minutes, to preserve context while moving between the website and registration form. Rejecting analytics clears this context. If you subscribe with optional analytics consent, the permitted labels can remain with the private registration evidence under the retention rules below.
• Motion preference: stored locally until you change it or clear site data. The light or dark theme is selected through the page URL. The optional soundtrack starts when you choose to play it.
• Optional analytics cookies: Google uses _ga and _ga_<id> to distinguish browsers and sessions. Their default lifetime is up to two years and may be renewed by visits; your browser may shorten it. Rejecting analytics through this site removes the accessible Google Analytics cookies for this site. See Google's cookie documentation.
• Administrator session: the essential whisper_session cookie authenticates administrators for up to eight hours. It is unavailable to page scripts and is not an advertising cookie.

You can also clear cookies and local storage through your browser settings. This removes saved preferences and may sign you out of the administrator area.

How long data is kept

Google Analytics user and event data retention is set to two months, with resetting on new activity turned off. Google applies retention changes after 24 hours and deletes expired data through its monthly process. This setting does not limit the lifetime of standard aggregated reports or the separate browser cookies described above. See Google's retention explanation.

Newsletter subscriptions are used while consent remains valid. Limited consent and exclusion records are kept for as long as necessary to demonstrate consent, honour an opt-out, prevent accidental re-import or address a specific legal claim. Contact correspondence is kept for as long as needed to handle the request and any related dispute.

The application does not automatically delete pending subscriptions, consent records, exclusion records or security logs after a fixed period. Any confirmation records from the earlier registration process are retained separately; an expired legacy link cannot activate a subscription and its expiry alone does not erase its record. Requests to review or erase your data are handled manually through the contact address above. Newsletter withdrawal stops messages; it does not automatically erase records needed to respect that withdrawal.

Service providers and international transfers

Access is limited to the project controller, authorised people helping administer the site and the providers needed for each service:

• Cloudflare: website hosting, security and the private database. The database is configured in the European Union. That location setting applies to the database, not every part of Cloudflare's worldwide service. See Cloudflare's data-location explanation and data-processing terms.
• Google: optional Analytics reports and the Gmail contact inbox. Google explains its use of information from partner websites and international-transfer safeguards.
• Resend (Plus Five Five, Inc.): newsletter delivery. When the welcome email is enabled, a new eligible subscription triggers one welcome message; no confirmation click is needed. It processes recipient addresses, message content and delivery or opt-out information needed for that service. Its data-processing terms describe US processing and Standard Contractual Clauses for applicable transfers.

Using these services can involve processing outside the European Economic Area, including in the United States. The linked provider terms describe safeguards such as Standard Contractual Clauses and, where applicable, adequacy frameworks. You may contact us for information about the safeguards applicable to your data.

Reading platforms, publishers and social networks linked from the site operate under their own privacy notices. Opening their links takes you to those services.

Your rights

Where applicable, you can request access, correction, erasure, restriction and portability of your personal data, and object to processing based on legitimate interests. You can withdraw consent at any time without affecting processing that was lawful before withdrawal.

Write to virand2010@gmail.com. We may need proportionate information to verify a request. You may also lodge a complaint with your local data-protection authority, including Italy's Garante per la protezione dei dati personali.