Privacy notice

Last updated: 18 September 2026

This notice covers every site in the lucalevi project: www.lucalevi.com (books, code, photographs, “about”), way.lucalevi.com (lucalevi’s way, the path of questions) and insurek.lucalevi.com (Insurek, the Swiss health insurance comparison). They are three sites with one controller, and they treat data the same way — which is why there is one notice for all of them.

In two lines

These sites use no cookies, no analytics and load nothing from anyone else’s domain. There is no account to create. The one thing I ask you for is an email address, and only if you want to download the lucalevi’s way method: I ask in a small window that says what it is for, and if you would rather not give it you can download the file anyway. If you then use the method with an assistant, what you write stays between you and that service: none of it reaches me. What you type into Insurek never leaves your browser.

Who is responsible

Luca Iacolettig, a private individual, not VAT-registered. Contact: luca@lucalevi.com

The law requires that someone answer for every site: that someone is me — in technical terms, the data controller. I have not appointed a data protection officer, as none of the cases in Article 37 GDPR applies.

In practice only three things reach me, and all of them are set out below: the technical data the server records when you open a page, the emails you decide to send me, and the email address you may leave in order to download the method.

What happens when you visit these sites

The sites install no cookies of any kind — not technical, not analytical, not for profiling. That is why there is no banner: there is nothing to accept.

Nothing is saved in your browser: no cookies, no local-storage entries, nothing. The language is decided by the address you are reading — www.lucalevi.com/ in Italian and www.lucalevi.com/en/ in English, and likewise for the other two sites — and the language switches are real links that take you to the address of the other language. When you close the page, nothing is left on your device.

The typefaces, the images, the gallery photographs, the premium data Insurek reads and the PDF documents — the books, the thesis, the CV, the method — are all hosted on these same domains. Many sites load their fonts from Google’s servers, which sends your IP address to another company before the page is even visible: that does not happen here. There are no embedded videos, no social buttons, no maps, no analytics of any kind. No data is sent to third parties.

Server logs

As with any website, the provider hosting these pages records technical access data — IP address, date and time, page requested, browser type — needed to run the service and protect it from abuse. Legal basis: legitimate interest in keeping the sites working and secure (Article 6(1)(f) GDPR). This data is not used to profile you and is not combined with anything else; it is kept for the short period the provider allows.

The hosting provider acts as a processor under Article 28 GDPR. The provider in use is Cloudflare, Inc. (Cloudflare Pages), 101 Townsend Street, San Francisco, California, United States.

Downloading the books, the thesis and the CV

The book PDFs, the master’s thesis and the CV download directly: no registration, no email address, and no counting or linking of the download to you. The only trace is the request to the server, in the logs described above. The lucalevi’s way method file is the one exception, and the section below explains how it works.

The personal data in those documents is mine, not yours, and it is there because I put it there: name, email address, education, work history. The CV published on this site carries no telephone number, no home address, and none of the information the GDPR calls “special categories” (Article 9). Anyone who needs those details asks me by email, and I send them myself.

The thesis is published under a Creative Commons Attribution 3.0 Italy licence: it may be downloaded, read and redistributed with attribution. The names of the supervisor and co-supervisors appear in the document because they belong on the title page of a thesis.

The photo gallery

I took the photographs in the gallery and they are served from my own domain. They carry no location data: the metadata (EXIF) is stripped when the images are prepared. There is no face recognition, no tagging, and no record of who looks at what.

If you write to me

If you send me an email, I process what it contains in order to reply. Legal basis: responding to your request (Article 6(1)(b) GDPR). I keep the message as long as the conversation needs it and for a reasonable period afterwards, then I delete it.

I do not use it for anything else and I pass it to nobody. Writing to me subscribes you to nothing: the only list I keep is of the addresses left in order to download the method, and you join it only by ticking a box in that window.

If you leave your email address to download the method

When you click “Download the method” a small window opens and asks for your email address. You are not obliged to give it: the same window carries the link “download without leaving your email”, and the file comes down all the same, whole and no different.

If you do decide to give it, here is everything I store:

• the email address you typed;
• the language you were reading the site in, Italian or English, so I know which language to write to you in;
• the date, which of the two boxes you ticked, and which version of the method you downloaded.

I do not store your IP address, I do not store where you came from, and I use no cookie to recognise you: nothing links that address to how you used the site.

The file downloads straight away, there and then: I do not email it to you, and you have nothing to confirm in order to get it.

There are two boxes, and you tick them — one, both, or neither:

• a message after a month: a month after the download an automatic message arrives asking how the method went. It sends itself, one day at a time: I do not write it by hand. You need not reply, and it does not arrive a second time;
• news: a few times a year, when there is something new on the site. If paid products or services ever come along, that is where I will say so.

Legal basis: your consent (Article 6(1)(a) GDPR). No box is ticked to begin with, and if you tick neither, the address is not stored at all.

That message is delivered by Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, California, United States), a service that sends email on my behalf: it receives the address, the language and the text of the message, for as long as it takes to deliver it, and Resend keeps its own delivery record, in the United States. Resend too acts as a processor under Article 28 GDPR. Anyone who ticked only this box — not also “news” — is removed from the list as soon as the message has gone out: that address served no other purpose.

I keep the address until you ask me to delete it, and in any case I delete it after three years without contact — unless, as just explained, it has already been removed earlier. Every message I send carries an “unsubscribe” link at the foot: open it and your row disappears from the database at once, no need to write to me. You can also write to luca@lucalevi.com and I will remove it myself. You can withdraw your consent whenever you like (Article 7(3) GDPR): it takes effect at once, and you owe me no explanation.

I do not sell that address, I do not trade it and I pass it to nobody. I do not use it to profile you: there are no categories, no scores, no automated decisions. The list lives in a database hosted by Cloudflare in a European region — the same provider that hosts the sites, acting here too as a processor under Article 28 GDPR. When you type the address, the site checks only that the domain after the at-sign really exists: a technical check against typing mistakes, which says nothing about you and leaves no trace.

The lucalevi’s way method

The method is a text document. You do the path on your own, with the assistant you choose: Claude, ChatGPT, Gemini or another.

What you write in that conversation is handled by that provider under its own terms, not mine: if this matters to you, read them before you start, because some of the questions touch on personal things. I do not receive, see or keep any of those answers. There is no archive of lucalevi’s way.

Insurek

Insurek asks for three things: a postcode, a year of birth, and what you spend on health care in a year — as a band, or as an exact figure if you care to give one. It sends none of them anywhere. There is no form to submit: the calculation happens in your browser, on the spot, using premium data it downloaded from the site the way it downloads an image. Nothing goes into a database, nothing reaches me, and nothing is even kept in your browser: close the page and it is gone.

That includes the health spending band, the one mildly sensitive thing the site asks you for. It is not transmitted, not stored, and not combined with anything.

The premium data comes from the public tables of the Federal Office of Public Health. It is the same for everyone and has nothing to do with you. Insurek sells nothing, refers you to no insurer and earns nothing from what you choose: it does the arithmetic and shows you the result.

Links that lead away

The main site links out to Amazon, GitHub, YouTube and Substack; Insurek links out to GitHub and to Priminfo, the Federal Office of Public Health site the premium data comes from. They are ordinary links: until you click one, those services do not know you are here and receive nothing from me. Once you click, you are on their sites, under their notices, which I do not control. If you open my YouTube channel or subscribe to my Substack, the relationship is between you and them: I see only the figures those platforms show to whoever publishes, not who you are.

Your rights

You can ask me to access your data, correct it, erase it, restrict its use, receive it in a readable format, or object to the processing (Articles 15-22 GDPR). If you left your email address you can also withdraw your consent at any time (Article 7(3) GDPR): the withdrawal takes effect from that moment on and does not undo what was done before. There is no automated decision-making and no profiling.

Write to luca@lucalevi.com: I answer within a month. If you think something is wrong, you can contact the Italian data protection authority, the Garante per la protezione dei dati personali, www.garanteprivacy.it, or the authority of the country you live in.

Transfers outside the European Union

I pass data to nobody. The site pages and the database of email addresses sit on servers inside the European Union: the database is deliberately created in a European region. Cloudflare, Inc. is nonetheless based in the United States and may in some cases reach the data from there. That transfer — covering the technical access logs and the email addresses on the list — takes place under the standard contractual clauses approved by the European Commission (Article 46 GDPR) and the safeguards set out in the contract with the provider.

The automatic message after a month instead passes through Resend — that is, Plus Five Five, Inc., based in San Francisco, California — which keeps your address and the text of the message in its own delivery records in the United States, with no option to keep them in Europe. This transfer, too, rests on the standard contractual clauses (Article 46 GDPR) and on the EU-U.S. Data Privacy Framework, which Resend adheres to.

Children

These sites are not aimed at children under fourteen and do not knowingly collect data from them.

If anything changes

If one day I add a contact form, a paid service or any external tool — a service that sends the emails on my behalf, for instance — this notice will be updated before it goes live, not after. That is what happened with the list of addresses above. The date at the top says when it was last touched.