Privacy Policy

The data controller is Daniele Cappello, curator of the Museum of Synthetic Voices. The controller is responsible for decisions regarding the purposes and methods of data processing.

The processing of your personal data is based on different legal grounds, depending on the specific purpose:

• Account registration and content access
  Art. 6.1.b GDPR Performance of a contract to which the data subject is party. Registration is necessary to provide you access to the museum's reserved content.
• Comment publishing
  Art. 6.1.b GDPR Performance of the requested service. Commenting is a feature you choose to use.
• Support and donations (Stripe Checkout)
  Art. 6.1.b GDPR Performance of a service requested by the data subject. Payment processing is handled by the payment provider.
• Aggregate browsing analytics (Cloudflare Web Analytics)
  Art. 6.1.f GDPR This website uses Cloudflare Web Analytics, a privacy-friendly web analytics service that does not use cookies, does not track users across sessions, and does not collect personally identifiable data. Only aggregate browsing data is processed (pages visited, country, device type, referrer). The legal basis is the legitimate interest of the Controller in improving the service.
• Content access logs
  Art. 6.1.f GDPR Content access logs (content_access_log) are retained for a maximum of 90 days; IP addresses are anonymised after 30 days. The legal basis is the legitimate interest of the Controller in the security and proper functioning of the service.

We only collect data strictly necessary to provide you with the museum's services. We apply the data minimization principle required by GDPR.

• Email address — For authentication and service communications
• Password hash — Your password is never stored in plain text
• Registration date — For administrative purposes
• Expressed consents — Cookie preferences stored locally in the browser
• Comment content — Only if you choose to use this feature
• Support messages — Optional text attached to donations

• Account access — Authentication and session management
• Reserved content — Unlocking multimedia archives and premium features
• Comment system — Allowing you to participate in discussions
• Project support — Managing donations and receipts via Stripe
• Personalization — Remembering your preferences (language, theme, audio)
• Service communications — Important notifications about your account

We do not sell or share your data with third parties for commercial purposes. Data is processed exclusively for the purposes stated above.

Some technical services may process data on our behalf: Supabase (authentication and database) and Stripe (payments). We do not store card payment data.

Some data may be retained longer for legal obligations or for the protection of rights in court, in accordance with legal requirements.

GDPR guarantees you a series of rights that you can exercise at any time by contacting us at the email address provided.

For any request regarding the processing of your personal data, you can contact us directly. We will respond within 30 days of receiving your request.

Pursuant to art. 28 GDPR, the Controller relies on the following data processors (sub-processors) to deliver the museum's services:

• Supabase Inc. — Database, user authentication, edge functions. User access data and user-generated content (comments, preferences) are stored and processed through the Supabase infrastructure.
• Cloudflare Inc. — Website hosting (Cloudflare Pages), CDN, DDoS protection, privacy-friendly web analytics. Cloudflare Web Analytics does not use cookies and does not collect personally identifiable data.
• Stripe Inc. — Payment processing and donation management. This service is currently disabled; no payment data is being collected or transmitted at this time.
• esm.sh — CDN service for loading JavaScript libraries required for authentication functionality. It does not collect personal data beyond the IP address transmitted with the HTTP request. Infrastructure: global.

Each processor operates under a dedicated Data Processing Agreement that governs its obligations and safeguards pursuant to art. 28 GDPR.

Some of the services we rely on are headquartered in the United States of America. The transfer of personal data to such third countries takes place in compliance with Chapter V of the GDPR and on the basis of the following safeguards:

These transfers are carried out on the basis of one or more of the following safeguards:

• EU adequacy decisions, where applicable to the destination country.
• Standard Contractual Clauses (SCC) pursuant to art. 46(2)(c) GDPR, as approved by the European Commission.
• EU-US Data Privacy Framework for services whose provider is certified under that regulatory framework.

The Data Controller is not required to appoint a Data Protection Officer (DPO) under art. 37 GDPR, as it does not carry out large-scale processing of special categories of personal data nor regular and systematic monitoring of data subjects.

For any data protection enquiries, please contact the Controller at: