The short version:
- No advertising trackers.
- No cookies used to identify you.
- Nothing is sold or shared with anyone for marketing.
- If you fill in the contact form, that information is used to reply to you and nothing else.
On this page:
1. Who is responsible
This site is run by Umberto Pisano, a self-employed composer based in Trevignano Romano, Italy. In data protection terms that makes Umberto Pisano the data controller for anything described here.
The fastest way to reach a human about any of this is hello@umbertopisano.com. It is the same address that answers everything else.
2. Cookies, and why there is no banner
This site does not use cookies to identify, profile or track you, which is why you were not shown a consent banner on arrival. That is not an oversight and it is not a loophole. Consent banners are legally required for tracking that is not strictly necessary, and there is none here to consent to.
One thing is stored locally in your browser: your choice of light or dark theme. It is kept in localStorage under the key theme, it never leaves your device, it is not sent to any server, and it cannot be used to recognise you. Clearing your browser data removes it.
If advertising pixels are ever added to this site, for example when running a paid campaign, a proper consent banner will be added at the same time and this section will be rewritten. One will not happen without the other.
3. What is collected, and when
Just visiting and reading
Nothing that identifies you. This site counts visits using Umami, and the whole reason it was chosen is what it does not do: no cookies, no fingerprinting, no cross-site profiling, no advertising. It cannot follow you anywhere else and it cannot tell one returning visitor from a new one.
What it records is the page you landed on, roughly where in the world the request came from at country level, and whether you pressed play on the demo, dragged the fader, played a track, or sent a message. Those are counted as anonymous totals. There is no way to look up what any one person did, including by me.
Why measure at all: to know whether people reach the music demo and whether it is worth their time. That is the entire purpose, and it is why the list of things measured is six items long rather than everything possible.
Beyond that, everything the page needs, including both typefaces and all the audio, is served from this site itself. Nothing is loaded from anywhere else unless you choose to play the showreel.
Sending a brief through the contact form
What you type: your email address, your message, and the budget range if you pick one. That is used for one purpose: to reply to you and discuss the project. It is not added to a mailing list, because there is no mailing list.
The form is handled by the company that hosts this site, so what you send does not travel through an extra third party on its way to the inbox. It is stored in the site's own form dashboard as well as emailed, so a lost message is not a lost enquiry.
Playing the audio demo
Nothing personal. The audio files are served from this site's own hosting, so pressing play does not tell any third party anything about you.
Watching the showreel
The showreel is a still image until you click it. Only then does YouTube load, and at that point YouTube receives your IP address and may set its own cookies under its own policy. That is the reason for the two step design: nothing reaches YouTube unless you actively choose to watch.
4. The services this site relies on
Running a website means other companies are involved. These are all of them, what each one gets, and why.
Only two of these are involved in simply reading the page. The rest are reached only if you choose to do something.
- Netlify hosts the site and serves it to you. It processes your IP address as a necessary part of delivering any web page, and to block attacks. Netlify is a US company operating under EU approved transfer safeguards
- Netlify Forms, part of the same company, receives the contact form. It sees what you typed and stores it so it can be read and replied to. Because the host handles this, no separate form company is involved
- inbox.eu (Inbokss Ltd, Latvia) provides the email account that receives and stores the resulting conversation. It is an EU company and the data stays in the EU
- YouTube, owned by Google, only after you click to play the showreel
- Umami Cloud counts visits. It receives the page address, the referring page, and your browser and country, and it uses none of it to identify you: no cookie is set and no unique identifier is stored. It is the only company contacted on an ordinary page view besides the host
Every typeface, image and audio file is served from this site itself, never from a third party. Only the host and Umami are involved in simply reading a page. Everything else on this list is reached only if you choose to do something.
Nobody on this list is paid to advertise to you, and none of this data is sold. If a service is added or removed, this list changes with it.
5. How long anything is kept
- Emails and briefs: kept while there is an active conversation or project, and for as long afterwards as tax and accounting rules require. Anything that led nowhere is deleted once it is clearly going nowhere
- Form submissions in the host's dashboard: the same copy of your message, kept on the same basis and deleted at the same time as the email
- Calendar entries: kept as part of the normal calendar record
6. Your rights, and how to use them
If you are in the EU or the UK, the GDPR gives you the right to ask for a copy of what is held about you, to have it corrected, to have it deleted, to object to how it is used, and to receive it in a portable form.
In practice, for this site, that almost always means one thing: you emailed about a project and you would like that correspondence deleted. Ask, at hello@umbertopisano.com, and it will be done within 30 days. There is no form to fill in and no account to log into.
The legal basis for replying to you is that you asked to be contacted. Nothing else here needs one, because nothing else is collected.
If you think your data has been mishandled and raising it directly did not resolve it, you can complain to your national data protection authority.
7. Changes to this page
If what the site does changes, this page changes first or at the same time, and the date at the top moves. There is no version history to consult, and no notification, because nothing here is the kind of promise that should be quietly weakened.