Privacy Policy
Last updated: September 2026
1. Data Controller
The Data Controller is Francesca Maffei, independent professional (P.IVA / VAT number 03209820640), based in Italy. For any request regarding the processing of personal data, please write to francesca.maffei@outlook.com. No Data Protection Officer (DPO) has been appointed, as it is not required for the scale of processing carried out.
2. Data processed
This website and the software tools described below process three distinct categories of data.
2.1 Website navigation data. maffeiperformance.com is a static website: it does not use cookies, analytics tools, tracking pixels, or contact forms. However, as with any website, the hosting infrastructure (Vercel Inc.) collects certain data during normal operation that is implicitly transmitted through the use of Internet communication protocols: IP address, browser type, requested pages, date and time of the request, response codes. This data is processed solely for technical purposes (service delivery, security, abuse prevention) and is not retained beyond the time necessary for these purposes.
2.2 Data processed via the Google Ads API and Meta Marketing API. As part of her professional activity managing advertising campaigns on behalf of clients, Francesca Maffei uses software tools (including an AI assistant, see section 5) that connect, via OAuth2 authorization granted directly by the account owner, to the official Google Ads and Meta Marketing APIs. The operations actually performed include: creating, editing, activating and pausing campaigns, ad groups and individual ads; managing budgets, bidding strategies and keywords (including negative keywords); reading performance metrics. Every campaign created is set to paused by default and must be explicitly activated. See sections 8 and 9 for details, including the exceptions where these tools process personal data of third parties.
2.3 Client data. As part of professional relationships, Francesca Maffei processes contact and billing data provided directly by clients: name, email, phone number, company name, VAT number, and data required for invoicing.
3. Purpose and legal basis
Navigation data (2.1) is processed on the basis of the Controller's legitimate interest in the correct functioning and security of the website (Art. 6(1)(f) GDPR).
Campaign configuration and management data (2.2: structure, budget, keywords, creative content, aggregated performance metrics) does not normally constitute personal data of third parties: for this data, no legal basis under Art. 6 GDPR applies, and Francesca Maffei simply processes it within the scope of the professional engagement given by the client. Where processing involves personal data of third parties (for example, customer lists uploaded to build custom audiences, or conversion data linked to individual identifiers), Francesca Maffei acts as data processor under Art. 28 GDPR on behalf of the client: the legal basis for that processing is determined by the client as data controller, not by Francesca Maffei, and providing notice to the data subjects of that data is the client's responsibility. These cases require a specific agreement between the parties (see also section 9).
Data under 2.3 is processed for the performance of the contract with the client and for compliance with accounting and tax obligations (Art. 6(1)(b) and (c) GDPR).
4. Retention
Navigation data is not retained beyond the technically necessary period (typically a few days, per the hosting provider's policies), except where needed to investigate unlawful activity.
Campaign data obtained via the Google Ads and Meta Marketing APIs (point 2.2), when saved as exports and analyses for audit, reporting, and historical performance comparison purposes, is stored in local archives accessible only to the Controller for the duration of the professional relationship with the client and, afterward, archived for the purpose of documenting her professional activity, with no predetermined automatic deletion date. Anyone entitled to request deletion may do so following the procedure in section 7.
Data under 2.3, when relevant for accounting and tax purposes (e.g. invoices), is retained for the period required under Italian law (currently 10 years, Art. 2220 of the Italian Civil Code), regardless of the duration of the professional relationship.
5. Disclosure and recipients
Navigation data may be processed by the hosting provider (Vercel Inc.) acting as data processor.
Data under 2.2 and 2.3 is not disclosed to third parties for independent purposes. The software tools used, including the AI assistant (Claude, provided by Anthropic) that supports Francesca Maffei's professional activity, process such data solely to perform the requested tasks, acting as service providers subject to their own terms and data security measures.
6. International data transfers
Website hosting (Vercel Inc.), the advertising platforms (Google, Meta), and the AI assistant used (Anthropic) are based in the United States and may therefore involve data transfers outside the European Economic Area. In such cases, the transfer takes place on the basis of the safeguards adopted by each provider under its own terms of service, such as the Standard Contractual Clauses approved by the European Commission. A copy of the applicable safeguards can be requested by writing to francesca.maffei@outlook.com.
7. Data subject rights and deletion requests
Data subjects have the right, within the limits and conditions set out in the GDPR, to exercise the rights provided for under Articles 15-22: access, rectification, erasure, restriction, objection, data portability, and, where processing is based on consent, withdrawal of consent. To exercise these rights, or to request deletion of data retained under section 4, simply write to francesca.maffei@outlook.com: the request will be handled within 30 days, except for data that must be retained due to legal obligations (e.g. accounting data, section 2.3) or for which the request should be directed to the client as data controller (personal data processed as processor under section 3). It is also possible to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it) or with the supervisory authority of your own country of residence.
No automated decision-making or profiling is carried out on the data processed.
8. Specific use of the Google Ads API
The software tools used access, via OAuth2 authorization granted by the account owner (Francesca Maffei herself for her own accounts, or the client for their own), the data of the authorized Google Ads account, to perform the operations described in section 2.2. Use of this data remains strictly limited to the practices described in this policy. Authorization credentials (OAuth2 tokens) are provided as environment variables at startup, are not otherwise saved to disk, logged, or transmitted to third parties other than those listed in section 5. Access can be revoked at any time by the account owner through their Google Account settings.
9. Specific use of the Meta Marketing API
Similarly, the software tools access, via authorization granted by the Business Manager owner, the data of authorized Meta advertising accounts: creative content, campaign metadata, and aggregated performance metrics. These tools are not consumer-facing and, as a rule, do not collect data from end users (Facebook/Instagram users who view the ads), except in the cases described in section 3 (for example, uploading customer lists for custom audiences, or conversion data with individual identifiers), which occur only on the client's specific instructions and under a dedicated agreement. Outside of these cases, data is not shared with third parties. Access can be revoked at any time by the Business Manager owner.
10. Changes to this Privacy Policy
The Controller reserves the right to modify this Privacy Policy at any time, providing notice through publication on the website. In the event of material changes to how data is processed via the Google or Meta APIs, affected data subjects will be informed before such changes take effect.