Privacy notice

Last updated: 2026-10-19.

Who is responsible

The data controller is Stefano Gemello, a private individual, not VAT-registered, trading as Leverlet (leverlet.com). There is no company behind Leverlet. Contact: [email protected].

What we collect and why

• Visit statistics, without cookies. When you open a page we record the page, the time, the campaign tags in the link (utm_*) and a pseudonymous visitor code. The code is a hash of your IP address and browser string with a random key that changes every day and is deleted after two days, so we cannot recognise you on another day and we never store your IP address. Legal basis: our legitimate interest in knowing whether a product is worth building (Art. 6(1)(f) GDPR). Nothing is stored on or read from your device.
• Early access list. If you join, we keep your email address, the product you asked about, the time of your consent and of your confirmation, the campaign tags of the link you arrived from and, if you answer it, your answer to the optional question on the form (for example which plan you would pick). We use it only to tell you about that product's launch. You join only after clicking the link in our confirmation email (double opt-in). If we decide not to build the product, we tell you once and delete your address. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the link in our email or by writing to us.
• Emails you send us. If you write to [email protected], we use your message and address to answer you. Legal basis: our legitimate interest in answering (Art. 6(1)(f) GDPR).

How long we keep it

Each product is tested for demand for at most 7 days, then we decide whether to build it. Early access emails, including sign-ups that were never confirmed, are deleted 12 months after the end of that product's test at the latest; sooner if you ask, or if we decide not to build the product (we email you once to say so, then delete your address). Visit statistics are deleted on the same schedule. Emails you send us are kept as long as needed to answer and follow up.

Who processes it for us

• Cloudflare, Inc. (USA): hosting of these pages, the visit statistics and the early access list (Cloudflare D1 database), the daily key (Cloudflare KV) and the forwarding of emails sent to [email protected] (Cloudflare Email Routing). We asked for the database to be placed in Western Europe; this is a placement hint that Cloudflare follows on a best-effort basis, not a guarantee. Pages and requests are served from the Cloudflare data centre closest to you, which may be outside the EEA. Data processing agreement: cloudflare.com/cloudflare-customer-dpa.
• Resend (Plus Five Five, Inc., USA): delivery of the confirmation email. Emails are sent from Resend's EU region (eu-west-1, Ireland); Resend states that its primary processing operations take place in the United States. Data processing agreement: resend.com/legal/dpa.

We do not sell your data and we do not use advertising trackers on these pages.

Transfers outside the EEA

Both providers are US companies, so your data may be transferred to the United States. Both state in their data processing agreements that they are certified under the EU-U.S. Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023, and both agreements include the EU Standard Contractual Clauses: for Cloudflare as a fallback if its certification lapses, for Resend for transfers outside the EEA. Sources: the two agreements linked above (Cloudflare DPA version 6.4, sections 6.2 and 6.4; Resend DPA, sections 6.2 and 11.1).

Your rights

You can ask for access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest, by writing to [email protected]. You can withdraw consent at any time; this does not affect processing before the withdrawal. You can complain to your data protection authority; in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).