Privacy and cookies

Who handles your data

Your data is handled by Matteo Nesiti and Federico Marchini, who work together under the name Heavy Light.

For anything about your data, write to hello@heavylight.co. The two of us answer, not an automated system.

What we collect, and when

We collect nothing while you read the site, apart from the visit statistics described below. Everything else happens only if you type something.

• Contact form: name, email, company, project type, rough budget and the message you write. It lands in our mailbox.
• Orbit, requesting a site: company name, VAT number, town, sector, current site, your answers to the intake questions, your name, your email and the photos you upload. It is the material we build the site from, not profiling.
• Orbit, the report: the address of the site you ask us to analyse. If you leave an email to get the result, we keep that too.
• Orbit, signing in: your email and a session, handled by Clerk. There is no password to invent: a code arrives.
• Visit statistics: how many people open a page, aggregated and cookie-free. We do not know who you are and we do not follow you across sites.

Why we process it

To answer you and to do the work you ask for: performance of a contract, or of the steps leading up to one. For visit statistics the basis is our legitimate interest in knowing whether the site works.

We do not sell data, we do not use it for advertising and we do not pass it to data brokers. We do no automated profiling that produces effects on you.

How long we keep it

Contact form messages stay in our mail for as long as the conversation needs them, and in any case no longer than two years.

Project data stays for as long as you are a client, plus the ten years Italian law requires for tax and contract documents.

A request that does not become a project is deleted within twelve months.

Visit statistics are not tied to a person, so there is nothing to delete: they are counts.

Who else sees the data

The companies below process data on our behalf, each for one specific piece. This list comes from reading our own code, not from a template: if we add one, it appears here.

• Vercel: hosts the site and runs the code.
• Neon: the database where Orbit requests live.
• Vercel Blob: where the photos you upload end up.
• Clerk: sign-in for the Orbit client space.
• Resend: sends confirmation emails and access codes.
• Microsoft 365: our mailboxes.
• Telegram: when a request arrives, our system sends us an alert containing the company name and the sender's email, so we notice straight away.
• Anthropic (Claude): our internal assistants read working notes to turn them into project files. If you send us data about a company, it can pass through there.
• Vercel: the visit statistics too, cookie-free.

Where it goes

Some of these providers are US-based and may process data outside the European Union. Transfers rely on the safeguards the GDPR provides: standard contractual clauses and, where applicable, Data Privacy Framework certification.

Your rights

You can ask to see the data we hold about you, have it corrected, have it deleted, restrict its use, object to processing, or have it handed to you in a format another company can read.

Write to hello@heavylight.co. We answer within thirty days. If you think we got it wrong you can go to the Italian data protection authority, www.garanteprivacy.it.

Cookies

A cookie is a tiny file a site leaves in your browser to remember something. These are ours, all of them. You will not find a banner asking for consent, and that is not an oversight: we removed Google Analytics precisely so we would not have to ask. What is left is what makes the site work, and that needs no consent.