1 · Data Controller
The data controller is NEXILICA SRL, an Italian limited liability company, registered office at Viale Ciro Menotti 83, 41121 Modena (MO), Italy. VAT number and tax code IT04179460367.
Privacy queries and data-subject requests: info@nexilica.com · certified email (PEC) nexilica@trustpec.it. NEXILICA SRL has not appointed a Data Protection Officer (DPO) — the company is below the GDPR Art. 37 thresholds — so all requests are handled directly by the data controller.
2 · Categories of personal data
We collect the minimum data needed to run this website and the upcoming waitlist:
- Technical cookies and server logs: IP address, user agent, timestamps, requested URL, response codes. Collected by Cloudflare (our hosting and edge provider) for delivery, security, and abuse prevention.
- Cookie consent state: first-party
localStorageentries managed by the Silktide Consent Manager (stcm.testhive_consent.*) store your choice per category, so we don't ask again on every page. - Consent audit log: whenever you make a choice in the consent banner, we record one row in our Cloudflare D1 database (table
consent_records) containing your choices, the page you were on, the timestamp, and a SHA-256 hash of your IP + User-Agent (never the raw values). This is the GDPR Art. 7 "demonstrability" backstop — we can prove which categories were granted at which moment, without holding any identifier in cleartext. - Analytics data (Google Analytics 4): loaded only after you accept analytics cookies in the consent banner. Collects anonymised page views, session duration, device class, and approximate country. IP anonymisation is enabled (
anonymize_ip: true) and Google Consent Mode v2 is wired so your choice is signalled to Google in real time. - Waitlist email address: when you submit the waitlist form, your email is stored in our Cloudflare D1 database to contact you at launch. We also store a SHA-256 hash of your IP address and User-Agent (never the raw values), salted with a rotating secret, used only to detect duplicate signups and to enforce a per-IP rate limit. No third-party processor is involved in this step.
- Font resources: Inter, Space Grotesk and JetBrains Mono are self-hosted on this domain via the
@fontsourcepackages. No Google Fonts CDN call is made and no IP is exposed to third parties for fonts.
3 · Purposes and legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Serving the website, security, abuse prevention | Legitimate interest (Art. 6.1.f) |
| Storing cookie consent state | Legal obligation (ePrivacy + GDPR consent record) |
| Analytics on aggregate site usage | Consent (Art. 6.1.a) |
| Waitlist registration and launch notification | Pre-contractual / consent (Art. 6.1.a, 6.1.b) |
| Abuse prevention on the waitlist endpoint (rate limit, dedup) | Legitimate interest (Art. 6.1.f) |
4 · Retention periods
- Server logs (Cloudflare): rolling 30-day window for raw logs, longer for aggregated security telemetry.
- Cookie consent: 12 months, then re-prompted.
- Consent audit log: 24 months (aligned with the GDPR Art. 7 demonstrability window).
- Analytics: maximum 14 months (GA4 default we will adopt).
- Waitlist email: until launch + 6 months, or until you ask us to remove it, whichever is sooner.
5 · Sub-processors and international transfers
We use third-party processors that may transfer your data outside the European Economic Area. Each is bound by a Data Processing Agreement and, where applicable, EU Standard Contractual Clauses (SCCs).
- Cloudflare, Inc. (US) — hosting on Cloudflare Workers + Workers Assets, edge delivery, DDoS protection. SCCs in place.
- Google LLC / Google Ireland Ltd. — Google Analytics 4 only, loaded lazily after explicit analytics consent. SCCs in place. (Fonts are self-hosted, no longer a Google touchpoint.)
No data is sold to third parties, ever.
6 · Your rights
Under GDPR Articles 15–22 you have the right to:
- Access your personal data we hold
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict processing in specific circumstances
- Portability: receive your data in a structured, machine-readable format
- Object to processing based on legitimate interest
- Withdraw consent at any time (does not affect processing already carried out)
To exercise any of these rights, write to info@nexilica.com. We respond within 30 days. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at garanteprivacy.it.
7 · Cookies
Detailed cookie list, durations, and purposes are in our Cookie Policy. You can re-open the consent banner at any time from the "Manage cookies" link in the footer.
8 · Changes to this policy
We will publish any material change on this page and update the "Last updated" date at the top. For substantial changes affecting how we use your data, we will also re-prompt for consent where required.