Privacy

1. Data controller

The data controller is the natural person who personally runs kythealabs.com, reachable at hello@kythealabs.com. Kythea Labs is a project name and not an incorporated company; the controller's full identification details will be published on this page before the public launch.

No Data Protection Officer has been appointed, as the conditions of Article 37 GDPR do not apply.

2. What data we process

The site has no login area and stores no data in a database. The contact form sends to hello@kythealabs.com, through a site function and the controller's email service, the fields you fill in (name, email, optional company, project type, indicative budget, message) together with the IP address you send from, used only to prevent abuse. If automatic sending is unavailable, the form opens a draft in your mail app and nothing is transmitted until you send it yourself.

The hosting service automatically records technical logs (IP address, date and time, requested URL, user agent) needed to run and secure the site.

3. Purposes and legal bases

Answering your enquiry and handling the preliminary contact for a possible engagement: pre-contractual steps taken at your request (Article 6(1)(b) GDPR).

Site security and abuse prevention through technical logs: legitimate interest of the controller (Article 6(1)(f) GDPR).

Compliance with legal obligations and defence of rights in court (Articles 6(1)(c) and 6(1)(f) GDPR).

We do not profile you, make automated decisions or send marketing communications without your consent.

4. Retention

Contact emails are kept for as long as needed to handle the enquiry and in any case no longer than 24 months from the last exchange, unless a contract follows, in which case statutory periods apply.

Technical logs are kept by the hosting provider for the short periods defined in its policies.

5. Recipients

Data may be processed by Vercel Inc. (site hosting and technical logs) and by the email provider of hello@kythealabs.com, acting as processors or independent controllers for their part.

Data is not disclosed or sold to third parties for marketing purposes.

6. Transfers outside the European Economic Area

Vercel is based in the United States: any transfer relies on the Standard Contractual Clauses adopted by the European Commission and on the EU-US Data Privacy Framework, as provided in its data processing agreement. You can ask about the safeguards in place by writing to the address in section 1.

7. Security

The site is served over HTTPS only, uses no third-party scripts and no tracking tools. Email is handled by a provider applying encryption in transit.

8. Your rights

You may exercise at any time the rights under Articles 15-22 GDPR: access, rectification, erasure, restriction, portability and objection. Send requests to hello@kythealabs.com; we reply without undue delay and in any case within one month.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it) or with the courts.

9. Changes

Changes to this notice are published on this page with the date of the last update.