Privacy & AI Transparency Policy

The Data Controller for this website is Andrea Alberti. For any privacy request or to exercise your rights under Articles 15–22 of the GDPR, you can contact: andalberti99@gmail.com.

• Interaction with an AI System: The floating chat widget (“RAG Assistant — Papers & Blog”) is an automated conversational system powered by Google Gemini generative AI models combined with local Retrieval-Augmented Generation (Okapi BM25F) over Andrea Alberti’s public papers, blog articles, and projects.
• Limitations & Accuracy: All chat replies are synthetically generated by AI. While grounded in verified portfolio documents, responses may occasionally contain inaccuracies or omissions and do not constitute professional or legal advice. Official source links are attached below answers for direct verification.
• Risk Classification: This assistant is a minimal/limited-risk informational tool. It performs no biometric categorization, no emotion recognition, no automated profiling, and no automated decision-making affecting natural persons.

• Do Not Enter Personal Data: Visitors are explicitly asked not to enter personal or sensitive information (names, emails, phone numbers) into the chat.
• Automated Server-Side PII Redaction: As a Privacy-by-Design safeguard, before any prompt is forwarded to the Google Gemini API or logged, a server-side filter automatically scrubs email addresses, phone numbers, Italian tax IDs (Codice Fiscale), and IBANs.
• Anonymous Quality Logs (GDPR Recital 26): To monitor RAG quality and expand covered topics, anonymized questions and answers (stripped of any PII) are recorded in an encrypted serverless database (Upstash Redis) in purely anonymous statistical form. No IP addresses, User-Agents, cookies, or session identifiers are ever stored, making it impossible to link a question back to any identifiable person.
• Ephemeral Anti-Abuse Rate Limiting: To protect against spam and DoS attacks, the server computes a one-way cryptographic hash (SHA-256 with a random in-memory process salt) of the request IP held exclusively in volatile RAM for 60 seconds.

• Contact Form: When you voluntarily submit the contact form, your name, email, and message are processed solely to reply to your inquiry (GDPR Art. 6(1)(b)) via Web3Forms and anti-spam verification by hCaptcha.
• Infrastructure & Sub-Processors: Hosting is provided by Vercel Inc.; AI inference is provided by Google Ireland Ltd. / Google LLC (Gemini API); anonymous quality logging is hosted on Upstash. International data transfers outside the EEA are governed by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs).
• Zero Profiling Cookies: This portfolio does not use advertising, behavioral tracking, or third-party profiling cookies. Only strictly necessary technical storage (such as theme/language preference) is used.

Under the GDPR, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, as well as the right to lodge a complaint with your national Data Protection Authority (in Italy: Garante per la protezione dei dati personali — www.garanteprivacy.it).