Lorenzo Studio

Privacy Policy

Last updated: 7 September 2026

This policy describes how Lorenzo Studio processes the personal data of people visiting lorenzostudio.info and of people using the site's conversational assistant. It is written against how the site actually works: every service named below is genuinely in use.

Data controller

Lorenzo Studio, Via per Modena 16, 41030 Bomporto (MO), Italy. VAT IT04190000366.

For anything concerning your personal data, write to info@lorenzostudio.info.

What happens if you only browse

This site is static and uses Umami, installed and managed by us at analytics.lorenzostudio.info, to measure visits and essential interactions in aggregate — for example contact clicks and the assistant's outcome. It is configured without profiling cookies or advertising tracking: it receives no message text, email address or conversation transcript.

The hosting and delivery infrastructure (Cloudflare Pages, by Cloudflare, Inc.) records the usual technical logs for every request — IP address, date and time, requested page, browser type — to run the service and protect it from abuse. These are security logs, not a profile of the visitor.

The conversational assistant

The assistant only starts when you open it: while the panel stays closed, no external service is contacted at all.

Once you start a conversation we process the text of the messages you write, the language of the page, your IP address, your browser type, the date and time and — only if you choose to give it — your email address.

Please do not write sensitive data (health, personal beliefs, judicial data), login credentials or other people's personal data in the conversation: we do not need them, and this is not the right channel for them.

Where your messages go

The assistant's replies are generated by a language model that is not ours. This is the full path of every message you write:

  • Your browser sends the message to our endpoint, a serverless function running on the Cloudflare network.
  • The ongoing conversation is held in Cloudflare's temporary storage (Workers KV), so that the server, not the browser, keeps track of the thread.
  • The text of the conversation is forwarded to OpenRouter, Inc., which routes it to the language models.
  • OpenRouter hands the text to the inference provider hosting the model in use at that moment: that provider is what actually generates the reply. The model in use is a Google Gemma model, with an OpenAI model as a backup when the first one is unavailable.
  • The reply travels back the same way and appears in the panel.

What we do not do with your messages

We do not use conversations to train models, and we do not allow third parties to do so. Processing carried out by OpenRouter and by the inference providers remains governed by their own policies, which are worth reading if the subject matters to you.

Your email address is never sent to the model: it stays on our server and is only used to get back to you.

If you leave your email address

When the conversation reaches the point of leaving a contact and you choose to give one, the transcript and your email address are delivered to us through Amazon SES (Amazon Web Services), in the European Frankfurt region, to info@lorenzostudio.info. A copy of the transcript is also sent to the address you provided, so you can keep it. A person from the team replies from there.

If you do not leave an address, no email is sent at all: the conversation stays only in the server's temporary storage and expires on its own. The same is true if you close the panel or leave the page halfway through.

Protection against abuse

Starting a conversation is protected by Cloudflare Turnstile, which checks that there is a person on the other side and not an automated script. Turnstile examines some technical signals from the browser and the IP address; it is not an advertising tracker and it does not reconstruct your browsing across sites.

We also count how many messages come from the same IP address, with an hourly and a daily counter, to keep abuse and costs in check.

Legal bases

  • Technical logs, Turnstile and per-IP limits: legitimate interest in the security and correct operation of the site (Art. 6(1)(f) GDPR).
  • Conversation with the assistant: responding to the request you make by starting it (Art. 6(1)(b) GDPR).
  • Transcript by email and follow-up: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).

How long we keep the data

  • Conversation in the server's temporary storage: at most one hour from the last message, and ten minutes after it is closed.
  • Per-IP counters: at most 24 hours.
  • Email with the transcript received by the team: in our mailbox for as long as needed to handle the request, and in any case no longer than 24 months; the copy sent to the visitor remains in their mailbox according to their settings.
  • Infrastructure technical logs: according to Cloudflare's own retention periods.
  • Aggregated Umami measurement data: according to the instance's retention configuration, for as long as needed for the stated purposes.

Who we share the data with

We do not sell your data and we do not pass it on for third-party marketing. Only the technically necessary parties are involved:

  • Cloudflare, Inc. — hosting, delivery, Turnstile and temporary storage of conversations.
  • OpenRouter, Inc. — routing the messages to the language model.
  • The inference providers selected by OpenRouter to serve the model in use — generating the reply.
  • Amazon Web Services — sending the transcript email to Lorenzo Studio and the address provided by the visitor.

Transfers outside the European Union

Cloudflare, OpenRouter, the inference providers and Amazon Web Services may process data outside the European Economic Area. Those transfers rely on the Standard Contractual Clauses approved by the European Commission and on the further safeguards set out in the respective data processing agreements.

Your rights

You can ask us at any time for access to your data, its rectification or erasure, restriction of or objection to processing, and portability, by writing to info@lorenzostudio.info. We reply within one month.

If you believe the processing of your data breaches the law, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

Updates to this policy

If the services that process the data change — a different model, a different provider, a new tool — this page is updated along with the site. The date at the top is the last revision.