Skip to content
Back to the portfolio

Privacy policy

Privacy and cookies

How personal data is processed on federicomengascini.com: what I collect, for what purposes and for how long.

Updated 16 October 2026Data controller: Federico Mengascini

At a glance

  • No profiling. Only technical or preference cookies (such as the theme): no advertising and no cross-site tracking.
  • Anonymous analytics. Rybbit measures visits in aggregate form and without cookies.
  • Chats are not stored. Conversations with FM Agent do not end up on my servers: the history stays in your browser only.

Data controller

The data controller is Federico Mengascini (Italy), frontend developer and cloud architect, who can be reached at [email protected]. You can write to this address with any request concerning your personal data.

What I process on this site

This portfolio processes only the data it needs to work. In short:

  • Public browsing — site content, projects and public sections. You do not need an account to browse the portfolio.
  • Contact requests — name, email, and optionally company, budget, timeline and message, sent through the contact form or the guided project request in the FM Agent chat. I use them to reply to you and handle the request; together with the request I store a non-reversible identifier derived from your IP address, used only to limit repeated submissions. Emails are sent and received through Resend; if you reply, the conversation can continue by email and is kept together with the request (incoming and outgoing messages, delivery metadata). Legal basis: pre-contractual measures taken at your request and legitimate interest in handling contact requests.
  • Booking a call — from the site and from the FM Agent chat you can open the booking page on Cal.com. This site only reads the public available slots from the server and does not send any of your data to Cal.com. If you book, you enter your name, email and any notes and guests directly on Cal.com, which also processes them under its own privacy policy, and I receive them to organise the call. The video call takes place on Cal Video. Legal basis: pre-contractual measures taken at your request.
  • FM Agent chatbot — the questions you type are processed by OpenAI to generate the answer, as described in the dedicated section. Legal basis: legitimate interest in answering people who ask about my work.
  • Spam protection — the contact form and the chat use Cloudflare Turnstile to block automated traffic. Legal basis: legitimate interest in the security of the site.
  • Operational integrations — Spotify “now playing” and the travel log show data that I choose to publish. They are not used to profile visitors.

I do not sell data, I do not use advertising networks and I do not do remarketing.

Analytics with Rybbit

To understand how the site is used I rely on Rybbit, an analytics system designed to be anonymous and free of tracking cookies. The script is loaded only on the public pages of the site.

The data collected generally covers:

  • pages visited, titles, referrers and UTM parameters;
  • visit information (entry, exit, session length);
  • device type, browser, operating system and screen resolution;
  • country and region temporarily derived from the IP address, without storing the IP;
  • aggregate events, such as submitting a form, opening the chat or a case study and clicks on external projects, without the content of messages or the email address.

Rybbit does not use profiling cookies or localStorage, does not track visitors across different sites and does not collect direct identifiers such as name or email. This is why I do not show a consent banner for analytics: there are no advertising or profiling trackers to accept.

On this site I do not use profiling or marketing cookies. I only use technical tools tied to a choice you make:

  • Theme preference — the site-theme cookie (12-month duration) and the site-theme entry in localStorage, set only if you choose the light, dark or system theme. They are used to show you the site with the theme you picked.
  • Chat history — the fm-agent:conversations:v1 entry in localStorage, holding at most 20 recent FM Agent conversations so that you can pick them up again. It stays on your device only, is not sent to my servers, and you can delete it from the “Previous conversations” panel in the chat or by clearing the site data in your browser.

As technical tools tied to an explicit choice of yours, they do not require prior consent. If I were to add profiling tools in the future, I would update this page and ask for consent where required.

Providers and transfers

To run the site I rely on technical providers that process data only for the service indicated:

  • Hosting and infrastructure of the platform the site runs on;
  • Rybbit — aggregate analytics;
  • Resend — sending and receiving contact emails;
  • OpenAI — generating the FM Agent chatbot’s answers;
  • Cloudflare — Turnstile spam verification;
  • Cal.com — booking and managing calls, including the Cal Video call;
  • Spotify — only for the “now playing” integration shown on the site.

Some of these providers, including OpenAI, Cloudflare, Resend and Cal.com, are based in the United States or may process data outside the European Economic Area. In these cases the transfer is based on the EU-U.S. Data Privacy Framework, for participating providers, or on the standard contractual clauses approved by the European Commission.

Retention

  • Contact requests and email threads — for as long as needed to handle the conversation and any collaboration; you can ask for them to be deleted at any time.
  • Call bookings — on Cal.com, for as long as needed to organise the meeting and any collaboration; you can ask for them to be deleted at any time.
  • Chat history — on your device, until you delete it (at most the 20 most recent conversations).
  • Chat usage limits — counters tied to a non-reversible identifier, which expire automatically within 24 hours.
  • Turnstile anti-spam tokens — valid for a few minutes, used only once.
  • Theme preference — 12 months from your last choice.
  • Rybbit analytics — according to the platform’s retention, in aggregate and anonymised form.

Your rights and contact

You can ask me at any time for access to your data, rectification, erasure, restriction of processing, portability, or object to processing based on legitimate interest, within the limits set by the GDPR.

Write to [email protected]: I reply within one month, as required by the Regulation, and usually much sooner.

You also have the right to lodge a complaint with the competent supervisory authority, which in Italy is the Garante per la protezione dei dati personali.

Updates

I update this policy when the technologies or the ways data is processed change. The date at the top of the page shows the latest revision.

AI chatbot

If you use FM Agent, the text you enter and a limited portion of the conversation are sent to OpenAI to generate the answer. The chatbot only receives public portfolio data and has no access to contacts, emails, the dashboard or administrative content.

Conversations are not saved in the portfolio’s database. I apply temporary limits using a non-reversible identifier derived from your IP address and browser; Redis only keeps the related counters, which expire. OpenAI receives the same pseudonymous identifier for security purposes and the API request uses store: false. Please avoid entering personal or confidential data all the same.

The legal basis is my legitimate interest in answering people who ask about my work. If you send a project request from the chat, that data follows the same rules as the contact form.

So that you can pick a chat up again, the conversation history (questions, answers and cards shown) is saved only in your browser, in this device’s localStorage: it is neither sent to nor kept on my servers. You can delete it at any time from the “Previous conversations” panel in the chat, or by clearing the site data in your browser.

Spam protection with Cloudflare Turnstile

The contact form and FM Agent use Cloudflare Turnstile to tell legitimate requests apart from automated traffic. During the check Cloudflare may process technical data about the browser and the connection, including the IP address, and returns a short-lived security token to the server.

The token is verified by the backend before the message is sent or the chatbot is queried. I use this processing solely for security, abuse prevention and protection of the site’s resources, not for advertising or profiling.

Questions or requests about your data

For access, rectification, erasure or objection to processing, write to [email protected]. I reply within one month, as required by the GDPR.