Who processes your data
The data controller is MaGa Srl, Via Privata Borghesio 4, 25081 Bedizzole (BS), Italy, VAT and tax code 04391330984, REA BS-611083. On this page "we" means MaGa Srl, the company through which Matteo Gazzurelli works; Matteo answers the requests that come through the site himself.
For anything about your data, write to privacy@gazzurelli.com. We reply within one month.
What this page covers
This page says what data gazzurelli.com collects, why, for how long, who processes it on our behalf and how you can exercise your rights. You can read the site without leaving any personal data: data reaches us only when you use one of the tools described below (statistics with your consent, the AI agent, the forms, the newsletter).
Visit statistics
We use two tools.
Ahrefs Web Analytics counts visits in aggregate (pages visited, country, device, referring page). It loads on every visit, before and regardless of your cookie choice, because the provider states it sets no cookies and keeps no IP address: IP and user agent are used to compute an identifier that is valid for a single day, then discarded. We use it on the basis of our legitimate interest in knowing how many people read the site. Provider: Ahrefs Pte Ltd, Singapore, with data stored in the United States.
Google Analytics 4 starts only if you accept analytics cookies in the banner. Before your choice no Google script is loaded and nothing is sent to Google; if you decline, it stays that way. With your consent, Google Analytics records pages viewed, device, browser, country and, if you use the hours estimator, the "start", "complete" and "filtered" events with the company type, the process you picked, the hours per week, the estimate produced and a random id of the estimator session. Google states that for traffic from the European Union the IP address is used only to derive a location and then discarded. The stream runs with Google Consent Mode: the advertising signals stay denied at all times, because the site runs no advertising. In Google Analytics, event data is kept for 2 months and data tied to the individual user for 14 months; aggregate reports do not expire. Legal basis: your consent, which you can withdraw at any time from "Cookie settings" in the footer. The cookies involved are listed in the Cookies section.
The AI agent
Two tools on the site use a language model (Google's Gemini).
The hours estimator (preview on the home page, full tool on the AI automation page) asks for your company type, the process to automate, the hours per week it takes today and, optionally, your company size. It asks for no name and no email. From those answers we compute a deterministic estimate and the model writes a comment. We store in Firebase Firestore: a random session id generated by your browser, your form answers, the generated reply and the estimate. We do not store your IP address. We do this to check the quality of the replies and improve the tool, on the basis of our legitimate interest. We keep this data for 30 days, then it is deleted.
The terminal chat (matteo mode) answers open questions about Matteo and his work. What you type and the last twenty turns of the conversation are sent to the model to generate the reply; we do not store them. The conversation stays in your browser until you close it. Do not type personal data about yourself or others into the chat: the tool is for questions about Matteo's work. The book command opens Matteo's calendar on Google Calendar, an external service with its own privacy policy.
What Google sees. To generate replies, the content of the conversation (for the estimator: the form answers and the comment; for the chat: the messages) is processed by Google LLC through the Gemini API. Neither your IP address nor the session id is sent to Google. For customers based in the European Union, as MaGa Srl is, Google states that it does not use prompts and replies to improve its products and keeps them for a limited time only for safety checks.
Introduction requests and talk proposals
The "Request an introduction" form collects your name, email, company, a message about what you are working on and the language you filled the form in. The "Propose a talk" form collects name, email, organization or event, topic, whether expenses are covered and, if you add them, event link, date, location and a message. With every request we also store the IP address, to limit abuse and spam and to understand which channel requests come from: we match it with the server logs (kept for 30 days) to find the page through which you arrived on the site and its source (for example a search engine or an AI assistant). Only these derived facts go into our reports, never your IP address or your name.
The request is stored in Firebase Firestore and emailed to Matteo Gazzurelli through Mailgun, with your address set as the reply address. It is used only to answer you and to assess together a possible engagement or talk. Legal basis: the steps needed to answer your request before any contract; for the IP address, our legitimate interest in preventing abuse and in understanding which channel requests come from. We keep the request for 24 months from submission, then delete it; if work starts, your contact details move into the contract records, which follow their own rules. The form has a hidden anti-bot field: if it is filled in, the request is dropped without storing anything.
The Agents in the Room newsletter
If you subscribe we store your email address, the language you chose, the spot on the site you subscribed from, the time of the request, and the IP address of the request. We use a double opt-in: we send you an email with a link and the subscription starts only when you open it; we store the confirmation time, which is the record of your consent. If you do not confirm within 30 days we delete the request. On first confirmation Matteo receives a notification email with your address.
Agents in the Room has no fixed schedule: an issue goes out when there is something from production worth passing on. Legal basis: your consent. Every email contains an unsubscribe link; once you unsubscribe we delete email and IP address and keep for 24 months only an identifier derived from the email, the status and the date, so the same address is not added again by mistake. Subscriber data lives in Firebase Firestore; emails go out through Mailgun.
Abuse protection and technical logs
Every request to the forms, the newsletter and the agent passes through a limit of 10 requests per minute per IP address. The counter lives in the server's memory for at most 60 seconds and is never written anywhere. The server (Firebase App Hosting, on Google Cloud) also writes technical request logs with IP address, user agent, page address and time, kept for 30 days and used for security and diagnostics and, for form requests, to understand which channel they come from. Legal basis: our legitimate interest in keeping the site running and protected and in knowing which channels bring requests.
Where the data lives and who processes it for us
The providers that process data on our behalf, as processors (art. 28 GDPR):
- Google LLC (Firebase App Hosting and Cloud Run for the site, in the us-central1 region; Firebase Firestore for stored data, region us-central1 (United States); the Gemini API for the agent; Google Analytics 4 with your consent; Google Workspace for the mailbox that receives the requests). Google LLC is certified under the EU-U.S. Data Privacy Framework; for its cloud services it also applies the European Commission's standard contractual clauses.
- Mailgun Technologies, Inc. (a Sinch company) sends the form and newsletter emails from the mg.gazzurelli.com domain, with processing in the United States. Certified under the EU-U.S. Data Privacy Framework, with standard contractual clauses as a fallback.
- Cloudflare, Inc. runs the DNS of gazzurelli.com and the redirects from the old addresses (ai., matteo., www.): for those requests only, it sees the IP address and the page requested. Certified under the EU-U.S. Data Privacy Framework, with standard contractual clauses as a fallback.
- Ahrefs Pte Ltd (Singapore) for cookie-free statistics, with data stored in the United States. Transfer based on standard contractual clauses.
We do not sell your data and we share it with no one for marketing. We may disclose it only where the law requires it.
For how long
| Data | Retention |
|---|---|
| Ahrefs statistics | aggregates only; the daily identifier expires every 24 hours (provider's statement) |
| Google Analytics 4 | event data 2 months, user data 14 months, aggregate reports without expiry; cookies up to 2 years in your browser unless you clear them |
| Hours estimator | 30 days |
| Terminal chat | not stored by us |
| Introduction requests and talk proposals | 24 months from submission; the email copy in Matteo's mailbox follows the same period |
| Newsletter | while you are subscribed; unconfirmed requests 30 days; after unsubscribing, 24 months of the identifier only |
| Request limit | 60 seconds in memory |
| Server technical logs | 30 days |
| Cookie choice and language | in your browser until you clear them; the choice is asked again after 6 months |
If you do not provide data
No data is required to read the site. Without the form answers the estimator does not run; without name, email and message we cannot answer an introduction request or a talk proposal; without an email we cannot send you the newsletter. If you decline analytics cookies the site works the same way.
Automated decisions
The estimator gives an indicative estimate of recoverable hours, computed with fixed rules from your answers and commented by a language model. Whoever picks "bootstrapped startup" as company type gets a predefined reply, with no estimate and no model involved. In both cases the reply is informational only: it is no offer, binds no one, and no decision about you is taken automatically. A proposal comes only from a conversation with Matteo, under the general terms published at /terms-and-conditions.
Your rights
You can ask at any time for access to your data, rectification, erasure, restriction of processing and portability (arts. 15, 16, 17, 18, 20 GDPR). You can object to processing based on legitimate interest (art. 21). You can withdraw consent whenever you want: for the newsletter with the link in every email, for analytics cookies from "Cookie settings" in the footer; withdrawal does not affect what was done before. Write to privacy@gazzurelli.com: we reply within one month.
If you believe the processing breaches the GDPR you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (art. 77): https://www.garanteprivacy.it/home/diritti/come-agire-per-tutelare-i-tuoi-dati-personali.
Minors
The site is aimed at companies and professionals. We do not knowingly collect data from anyone under 14; if we find we have, we delete it.
Cookies and data stored in your browser
This section follows the Italian Data Protection Authority's cookie guidelines of 10 June 2021.
Technical data, always on. Needed for the site to work, they track nothing and need no consent. They are stored in the browser's local storage (localStorage) rather than as cookies:
| Name | Purpose | Duration |
|---|---|---|
maga.consent | remembers the choice you made in the banner, so we do not ask on every page | until you clear it; asked again after 6 months or when this policy changes |
agent_session_id | random id that links your requests to the estimator and the terminal chat | until you clear it |
Analytics cookies, optional. Set only by Google Analytics 4 and only after you accept in the banner:
| Name | Provider | Purpose | Duration |
|---|---|---|---|
_ga | distinguishes visitors | 2 years | |
_ga_1H5KDY90J1 | keeps the session state | 2 years |
How you choose. On your first visit the banner lets you accept or decline with two buttons of equal weight; closing the banner without choosing counts as declining and the site works the same. Your choice holds for 6 months: during that time we do not ask again, unless this policy changes. You can change it at any time from "Cookie settings" in the footer. You can also delete or block cookies in your browser settings.
Ahrefs Web Analytics uses no cookies and no other identifier stored in your browser (see 4.3).
Updates
When the text changes we publish the new version on this page with the new date at the top. If the analytics cookies change, the banner is shown again.