Privacy Policy
Last updated: November 10, 2026
1. Data controller
NFW Web Studio is a brand shared by three independent professionals. For the data you give us on this website the data controller is Samuele Gobbo, VAT IT05167900231, Via Enrico Toti, 12, 37057 San Giovanni Lupatoto (VR), Italia. Contact for any question about your data and to exercise your rights: privacy@nfw.run. The other two members of the studio access the data only as persons authorised by the controller, under written instructions.
When we build or run something for a client (a website, a Chase chatbot), the client is the controller of its visitors' data and we act as its processor under a written agreement. This notice covers nfw.run only.
2. What data we collect, why, and on what basis
| Where | Data | Purpose and legal basis | Kept for |
|---|---|---|---|
| Contact form, emails to us | Name, email, message, service and priority you choose | Reply to your request and prepare a quote: precontractual measures (art. 6.1.b GDPR) | 12 months, then deleted automatically |
| Quote request sent by an AI assistant (our MCP server) | Name, email, message and service that you give your assistant and it passes on to us. We store no IP address for it | Reply to your request and prepare a quote: precontractual measures (art. 6.1.b GDPR). The assistant shows you this notice first and sends nothing until you confirm you have read it | 12 months, then deleted automatically |
| Browsing statistics, cookieless mode (PostHog), the default and what applies if you reject | Page views, a daily rotating hash, browser and device type, errors. Nothing is stored on or read from your device | Improve the site: legitimate interest (art. 6.1.f). The site has no switch to turn this counting off: you can object by writing to us (point 5) | 14 days, then deleted |
| Browsing statistics, full mode (PostHog), only if you click Accept | Everything above, plus a random identifier kept in a first party cookie and in local storage of your browser (so returning visits and sessions are recognised), and which elements you click and where on the page (heatmaps). No name or email is ever attached, session recordings stay off and what you type into fields is never captured | Your consent (art. 6.1.a), which you can withdraw at any time from the Cookie preferences link in the footer: choosing Reject deletes the cookie and brings you back to cookieless mode | 14 days, then deleted. The cookie lasts 12 months or until you reject |
| Free SEO audit | The web address you scan, your IP address (kept only as a keyed hash, never as the address, to rate limit scans and stop abuse; when the scan comes through our MCP server, your API key stands in for it and we read no IP address) and, only if you ask for the report by email, your email and your consent | Run the scan (art. 6.1.b). If you ask for the report by email, your consent to marketing emails from us (art. 6.1.a) is the condition for that delivery: the report stays visible on the audit page without it, and you can withdraw at any time | Scan results of public sites: kept indefinitely, they describe public information. Your email: until you unsubscribe or ask for deletion |
| API key of our MCP server (needed to use it) | The key, a keyed hash of the random identifier held in a technical cookie of your browser (the identifier itself is not stored), the dates it was made and last used. When you make a key we read your IP address once, only to cap keys at 3 per network per day, and our backend keeps a keyed hash of it, not the address. Using the key reads no IP address, and the audit service limits you by the key | Give you an audit allowance of your own and stop abuse: legitimate interest (art. 6.1.f). You can object at any time | Deleted automatically after 1 year without use |
| Usage statistics of the audit (PostHog) | For each audit request: that it was made, refused, started, finished or its report emailed, whether it came from the website, the MCP server or the API, and an identifier computed from your IP address (or your API key) and the date, which changes every day, so it cannot follow you from one day to the next. It is never your IP address or your key, and no profile is built | Know how much the free audit is used and when it hits its limits: legitimate interest (art. 6.1.f). You can object at any time | Kept in our analytics tool as counts of events; the identifier is useless the day after |
| Chase chatbot demo | The messages you write, a session identifier, your IP address (to limit abuse) | Answer your questions and show how Chase works (art. 6.1.b). We save the conversation so the site owner can read it | 12 months by default, shorter if the site owner chooses so |
| Booking a call (Calendly) | What you enter on Calendly | Schedule the call (art. 6.1.b) | Calendly keeps it under its own policy |
Data from the contact form and from requests sent by an AI assistant is never used for marketing, profiling or sold. Providing it is optional, but without it we cannot reply. In the audit, giving your email is optional: without it you simply read the report on the audit page. No decision about you is taken by automated means, and nothing here is profiling.
No sale of data. We do not sell data to third parties: not the audits you request on our website or through our MCP server, not quote requests, not API keys. Everything is stored on our servers in the European Union and stays there.
Requests through AI assistants. Our MCP server lets an AI assistant (such as ChatGPT or Claude) pass a request for a quote to us on your behalf. It does so only if you asked to be contacted: before sending anything the assistant must show you this notice and the sentence "I've read the Privacy Policy and understand my data will only be used to answer this request", and we store nothing until you have agreed. The assistant and its provider are independent controllers of your conversation with them, under their own privacy notices: we do not control what you tell the assistant and receive only the fields it sends us after you agree. Give only your own details. A request from the same email address is accepted once an hour, and we count requests by their time, not by IP address, and the audit tools by API key.
Websites our scanner visits. Our scanner, NFW-Audit, reads public pages of the websites it is asked to audit and of the businesses in our periodic studies, and stores the measurements, not the content. If you own a site, you can ask us to stop and to delete what we stored, and to exclude it from any commercial contact from us, by writing to audits@nfw.run with the domain, or by adding a rule to your robots.txt: see the scanner's page. We do not make public audits of adult, gambling or similar sites; the check compares the site's domain name with lists of such sites and asks two public family-safe DNS services (Cloudflare Families and CleanBrowsing) about it, and reads the labels the site declares about itself; those services see the domain name, not who asked. An audit of such a site is refused and stores no result.
Audit data. The scan results describe public websites and we may keep, publish and reuse them. We keep the email addresses given with marketing consent and use them for our own commercial communications only: we do not pass them to third parties for their own marketing.
The browser extension. The NFW Audit extension reads only the address of the tab you are on, and only when you click its icon. It sends that address (reduced to the site's homepage) to our audit service, as the form on the audit page does, and shows the result. If you ask for the report by email, it sends the address you type, with the same two consents as the form. Its history, your choices and the scan in progress stay in your browser and are never sent to us; it reads no other tab, page content or browsing history, and uses no cookie of ours. Removing the extension deletes them.
3. Who receives your data
- Vercel (hosting, functions in Frankfurt, Germany, privacy notice) and Supabase (database for contact requests, EU, privacy notice): processors.
- PostHog (statistics, EU servers, reached through our own address on this domain): processor. It runs cookieless by default and sets its cookie only if you accept; no session recordings.
- Telegram: we receive an anonymous notification that a form was sent or that an AI assistant passed on a request, saying which of the two, never its content.
- Our servers for audits and Chase (Germany and the EU): our own infrastructure.
- Calendly: an independent controller if you book a call, see its privacy notice.
- AI providers: Chase writes its replies with artificial intelligence models reached through OpenRouter. We only route to providers that keep no copy of the conversation (zero data retention) and do not use it to train models. They may run outside the EEA, for example in the United States, under the safeguards in point 4.
The updated list of processors is available on request.
4. Transfers outside the EEA
Our data is stored on servers in the European Union. Some providers belong to groups based in the United States (for example Vercel) and may access data from there: this happens under the EU-US Data Privacy Framework or standard contractual clauses. OpenRouter, through which Chase reaches its AI models, is not certified under that framework: our data processing agreement with it incorporates the European Commission's standard contractual clauses (controller to processor). One of the three members of the studio works from the United Kingdom and can read requests sent to us: the United Kingdom is covered by an EU adequacy decision (renewed by the European Commission in December 2025, valid until 27 December 2031), so no further safeguard is needed.
5. Your rights
- Access, rectification and erasure of your data.
- Restriction of and objection to processing. The site no longer offers a switch to turn the cookieless counting off, so to object to it (art. 21 GDPR) write to us at the address below and we will look at your request.
- Data portability.
- Withdrawal of consent at any time, where processing relies on consent, for example the statistics cookie, from the Cookie preferences link in the footer.
- Complaint to the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).
Write to privacy@nfw.run. We answer within one month.
6. Cookies and similar technologies
See the Cookie Policy for the full list of what the site stores on your device.
7. Children
The studio addresses businesses. If you are under 14, do not use the contact form, an AI assistant to contact us or Chase without a parent: in Italy a child under 14 cannot consent alone to the use of online and AI services.
8. Changes to this notice
We update this notice when something changes. The date at the top of the page shows the latest version.