Privacy and cookies

Last updated: 2026-08-02.

This notice explains which personal data we process through this website, for which purposes and by which means. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

1. Data controller

The data controller is:

Matteo Donati mat.donati@gmail.com

For any request concerning your data you can write to noreply@mdphoto.info.

2. What data we collect

• Contact form: nickname, email address and the text of the message you send us.
• User account: email address, password (stored only in hashed, non-reversible form) and verification and approval status.
• Private galleries: the email address of the person the gallery is intended for, the photographs depicting them and the preferences they express (selected photos).
• Technical data: IP address, date and time of the request, requested page and user agent, recorded in the server logs and used for security and to rate-limit abusive access attempts.
• Statistical data: page views and interactions with the site, collected through Google Analytics only if you consent.

3. Purposes and legal bases

• Replying to messages sent through the contact form — legal basis: responding to your request (Art. 6(1)(b) GDPR).
• Managing your account and access to restricted areas — legal basis: performance of the requested service (Art. 6(1)(b) GDPR).
• Delivering photographs and collecting selections in private galleries — legal basis: performance of the contract or collaboration agreement (Art. 6(1)(b) GDPR).
• Keeping the site secure, preventing abuse and retaining technical logs — legal basis: legitimate interest in protecting our systems (Art. 6(1)(f) GDPR).
• Measuring how the site is used, in aggregate form — legal basis: your consent, which you may withdraw at any time (Art. 6(1)(a) GDPR).
• Automatically screening photographs uploaded to the public area and drafting the descriptions of photo shoots with the help of an artificial intelligence system — legal basis: legitimate interest in publishing appropriate content (Art. 6(1)(f) GDPR).

4. Cookies and similar technologies

• Technical cookies and storage: session cookies for authentication, CSRF protection, your light/dark theme preference and the choice you make on this banner. They are necessary for the site to work and require no consent.
• Statistics cookies: Google Analytics 4, installed only after you press “Accept”. If you reject, the script is not even loaded and no data leaves your browser.

Your preferences

5. Who we share data with

Data is never sold or disclosed to third parties for marketing purposes. It is processed on our behalf by the following providers, appointed as data processors:

• The provider hosting the server this site runs on (hosting and data storage).
• The email provider used to send verification, password reset and notification messages.
• Anthropic PBC (United States), for the automatic screening of uploaded public photographs and for assisted drafting of shoot descriptions. Photographs in private galleries are never sent to this service.
• Google Ireland Ltd., for website usage statistics, only with your consent.

Some of these providers may process data outside the European Economic Area. Where that happens, the transfer relies on the standard contractual clauses approved by the European Commission or on another appropriate safeguard under Chapter V GDPR.

6. How long we keep data

• Contact form messages: up to 24 months from the last exchange.
• User accounts: for as long as the account stays active; deleting it removes the data.
• Private galleries: for the agreed duration of the project, and in any case until removal is requested.
• Technical logs: up to 12 months.
• Statistical data: according to the retention set in Google Analytics, in any case no longer than 14 months.

7. Your rights

At any time you may request access to your data, its rectification or erasure, restriction of processing, portability, and you may object to processing based on legitimate interest (Arts. 15-22 GDPR). Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.

To exercise these rights write to noreply@mdphoto.info. We will reply within one month.

If you believe the processing infringes the GDPR you may lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

8. Use of artificial intelligence

The site uses an artificial intelligence system in two places: to automatically flag public photographs that require restricted display, and to prepare a draft of the photo shoot descriptions. Published texts are always reviewed and approved by a person before they appear on the site. No decision producing legal effects, or similarly significantly affecting you, is taken by automated means. Photographs uploaded to private galleries are never submitted to any artificial intelligence system.

9. Changes to this notice

This notice may be updated: the version published on this page is always the one in force.