Privacy notice

This site sells nothing and has no accounts and no forms. We do not advertise, we do not build profiles, and we never sell anyone's data. Four things happen: the site is served to you, we count visits with Google Analytics if you allow it, the engineering video loads if you press play, and we read your email if you write to us. No law or contract requires you to give us personal data. Your browser has to send its IP address for any page to load, but refusing statistics changes nothing else on the site, the video simply stays unloaded if you do not press play, and writing to us is up to you.

The data controller is:

Company

CarbBiome S.r.l.

Registered office

Viale Spartaco Lavagnini 16, 50129 Firenze (FI), Italy

VAT / tax code

07437000487

Email

alon.s@carbbiome.eu

Certified email (PEC)

carbbiome@pec.it

We are not required to appoint a Data Protection Officer, and we have not appointed one. Write to the address above with any question about this notice.

When you open a page, our hosting provider, Lovable, and Cloudflare, which delivers the site for Lovable, receive your IP address, browser type and the page requested. This is how any website works, and we use it only to deliver the site and defend it against automated abuse. The technical cookies this needs are listed under Cookies and browser storage, below.

Lawful basis: our legitimate interest in operating and securing the site, Article 6(1)(f) GDPR.

If you click Accept in the cookie bar, we use Google Analytics to learn how many visits the site gets, which pages are read and how people found us. Until you accept, nothing is loaded from Google and nothing is sent to it. If you click Reject or close the bar, that stays the case.

Once you accept, Google Analytics receives the address and title of each page you open, and the page or link that brought you here. It also receives your browser's language, your browser, operating system and type of device. It records how long each page is in view, whether you scroll almost to the end of a page, and clicks on links to other websites. Like any website, it receives your IP address too. Google says that for visitors in the European Union it uses the IP address only to work out an approximate location, the country and region, and then discards it without storing it. Google Analytics files these records under the random number in its cookie, not under your name, so it can show us the pages one browser viewed. We use the data for totals and trends, not to find out who you are, and we never send Google anything that names you.

Google Ireland Limited provides Google Analytics to us as our processor, under Google's data processing terms, and may use the data only to provide and protect the service. We have switched off the settings that would let Google use it for its own purposes, and all advertising features. We have also switched off Google signals, which would add data about people signed in to a Google account. Google may process the data in the United States through Google LLC, which is certified under the EU-US Data Privacy Framework (see Who else sees the data, below). Google explains how it handles data from sites that use its services at policies.google.com/technologies/partner-sites.

Google Analytics sets two cookies on this site: _ga, which holds a random number used to tell visitors apart, and _ga_ followed by a code for this site, which keeps track of the current visit. We have set both to expire six months after they are first set. Coming back to the site does not extend them.

Lawful basis: your consent, Article 6(1)(a) GDPR, and Article 122 of the Italian Privacy Code (Legislative Decree 196/2003).

You can change your mind at any time with the Cookie settings link at the bottom of every page. Choosing Reject there stops Google Analytics at once and deletes its cookies from your browser, which also cuts the link between your browser and anything collected before.

The walkthrough in the machine section is hosted by Wistia, a provider in the United States. Nothing at all is requested from Wistia while you read the page: the still you see is served from our own domain, and the player only loads when you press play.

If you press play, your browser loads Wistia's player and the video from Wistia's servers. Like any website you visit, Wistia receives your IP address, your browser type and the address of this site, and its servers log the requests needed to stream the video. We have set the player not to track viewers: it sends Wistia no viewing reports and keeps no code that lets Wistia recognise you on a later visit. It stores only the player settings listed under Cookies and browser storage, below. The player also loads code from Sentry, a service Wistia uses to catch errors in its player, so Sentry receives your IP address and browser data, and could receive a technical error report if the player fails. Every page of this site opens with the video unloaded, so to stop, simply do not press play again.

Lawful basis: your consent, Article 6(1)(a) GDPR, and Article 122 of the Italian Privacy Code (Legislative Decree 196/2003).

Technical cookies and storage are the ones the site needs to work, or to give you something you asked for. Under the Italian cookie rules they need no consent. On this site, anything used for statistics runs only with your consent. This is everything the site can store on your device:

cb-consent

This site, browser storage. Remembers whether you accepted or rejected Google Analytics, and when, so the bar does not ask on every page. Technical. Counts for six months, then we ask again. It stays in your browser until you choose again or clear your browser storage for this site.

tsr-scroll-restoration-v1_3

This site, session storage. Remembers how far down each page you were, so the back button returns you to the same place. Technical. Deleted when you close the tab.

__cf_bm

Cloudflare, the network that delivers the site. Helps tell people apart from automated abuse; scripts cannot read it. Technical. Expires after about thirty minutes.

__dpl

Lovable, our hosting provider. Holds only a code for the version of the site you are being served, so that every page of your visit comes from the same version. Technical. Expires after a day.

_ga, _ga_…

Google Analytics, only if you accept. Tells visitors and visits apart for our visit statistics. Expires six months after it is first set.

wistia, wistia-video-progress-…

Wistia, the video player, browser storage. Set only when you press play, as part of that choice. The first remembers the player's settings: the connection speed it measured, when the video was last loaded and played, and that viewer tracking is off. The second records how far into the video you got, with a random code for that one viewing. Neither holds a code that lets Wistia recognise you on a later visit, and neither is used for tracking. Both stay until you clear your browser storage for this site.

You can also delete or block cookies in your browser's settings. Blocking the technical ones may stop parts of the site from working.

The contact buttons on this site open a small panel showing our email address. You can copy it, or start a message in Gmail, Outlook or your own email program. If you choose Gmail or Outlook, that provider handles your message under its own terms. The panel itself stores nothing. If you have accepted visit statistics, Google Analytics counts a click on the Gmail or Outlook button, as it does any click on a link to another website. Nothing you write reaches us until you send an email. If you write, we receive your name, your email address and whatever you choose to tell us. We keep the correspondence while the conversation is live, and afterwards for as long as we may need it to establish or defend a legal claim. Our email is hosted on Google Workspace.

Lawful basis: steps taken at your request before entering a relationship, Article 6(1)(b) GDPR, or our legitimate interest in replying to correspondence, Article 6(1)(f) GDPR.

Only the providers we use to run the site, each with its own privacy notice. Lovable hosts the site (lovable.dev/privacy). It relies on providers of its own, such as Cloudflare, which delivers the site (cloudflare.com/privacypolicy). Google provides our visit statistics, if you allow them (policies.google.com/privacy). Wistia plays the video, if you press play (wistia.com/privacy). Wistia in turn uses Sentry to catch errors in its player (sentry.io/privacy). Google Workspace hosts our email (cloud.google.com/terms/cloud-privacy-notice). They act on our instructions. Some of them also use the data for purposes of their own, such as security, and decide how to do so as independent controllers. We do not share data with anyone else.

Some of these providers are in the United States, or use providers there, so data may be transferred outside the European Economic Area. Google LLC, Cloudflare, Inc., Wistia, Inc. and Functional Software, Inc., which runs Sentry, are certified under the EU-US Data Privacy Framework, which the European Commission has found to give adequate protection (Implementing Decision (EU) 2023/1795). Lovable is based in Sweden. For its own providers outside the European Economic Area, it uses the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914). You can ask us for a copy of the safeguards that apply.

Security and delivery records are kept briefly by our providers, typically days to a few months. Google Analytics deletes the visit records filed under the random number in its cookie once they are 14 months old. It runs this deletion once a month, so it can take a few weeks longer. Our standard reports keep only totals, such as visits per page or per country, with no such number in them. If you press play, Wistia and Sentry keep the logs of those requests for the periods set in their own privacy notices, listed under Who else sees the data, above. Your cookie choice counts for six months, and then we ask again. It stays in your browser until you choose again or clear your browser storage. Email correspondence is kept for the life of the relationship and for the period in which a claim could still arise. We do not keep anything else, because we do not collect anything else.

You may ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where processing rests on consent, you can withdraw that consent at any time without affecting what came before; for visit statistics, use Cookie settings at the bottom of every page. Write to alon.s@carbbiome.eu and we will answer within one month.

Your right to object: where we rely on our legitimate interest, to serve and secure the site and to answer email, you can object at any time on grounds relating to your particular situation. Write to alon.s@carbbiome.eu. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend a legal claim.

If you think we have handled your data badly, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority where you live.

If we change how this site handles data, we will update this page and the date at the top. This notice is also published in Italian.