Muretto Box Virtuale · privacy

How we handle
your data.

Reading the site and saving experiments in your browser need no account. This notice explains what changes when you write to us or choose to synchronise private experiments with an account, and what remains in the retired championship archive.

Last updated: 13 October 2026.

Who is responsible

The data controller is Tommaso Ieri, VAT number IT07555030480. For anything about your data, write to privacy@murettobox.com.

What we process, why, and for how long

Personal account

Data
Your email address, stored encrypted (AES-256-GCM) and looked up through a keyed fingerprint, never in clear; the date the account was created.
Legal basis
The service you ask for (Art. 6(1)(b) GDPR).
Kept for
Until you delete the account.

Signing in

Data
A one-time sign-in link and your session, each stored only as a fingerprint, and the session cookie sid.
Legal basis
The service you ask for (Art. 6(1)(b) GDPR).
Kept for
15 minutes for the link, 30 days for the session.

Private experiments

Data
The experiments you choose to synchronise: their names and dates, Grand Prix, session, drivers and laps, Replay strategy inputs, saved Live moments, source and model revisions, and any saved results. Synchronisation is optional; these records belong to your account and do not enter a public standings table.
Legal basis
The service you ask for (Art. 6(1)(b) GDPR).
Kept for
Until you delete the experiment or account. A removed experiment’s identifier stays until account deletion to stop an older device copy from restoring it. Account deletion removes its private experiments but leaves browser copies: you can remove those separately from My experiments or clear this site’s browser storage.

Profile and championship archive

Data
The profile name, country and favourite driver you choose (the country is never derived from your IP address); existing championship plans, original submission receipts, pre-qualifying forecasts, verdicts and points. The championship is retired: no new entries or verdicts are produced. Historical records retain their original rules and status, including public names, countries and points where previously published.
Legal basis
The service you ask for (Art. 6(1)(b) GDPR).
Kept for
The season’s results archive. If you delete the account, your entries stay in the archive without your name, shown as a deleted player.

Protection against abuse

Data
A salted fingerprint of your IP address and a keyed fingerprint of your email address, never the addresses themselves, to limit repeated requests.
Legal basis
Our legitimate interest in keeping the service available (Art. 6(1)(f) GDPR).
Kept for
One hour.

Reports

Data
If you use the report form: the type of report, your message, the page you came from, your screen size and browser name, and your email address only if you leave it so that we can reply. The report reaches us by email.
Legal basis
Our legitimate interest in fixing the site (Art. 6(1)(f) GDPR).
Kept for
One year.

Emails to privacy@murettobox.com

Data
What you send: your address and the other addresses in the message, the subject, the date, the text, any attachments and the result of the checks on the sender’s authenticity. Resend receives the email and our server forwards it to the controller’s mailbox, with your address as the reply address; files that mailbox would refuse, such as programs, are listed instead of forwarded. Our database keeps only the message’s technical identifier, so that it is not forwarded twice. Emails to the site’s other addresses are received in the same way and are not forwarded.
Legal basis
Answering a request about your data is a legal obligation (Art. 6(1)(c) and Art. 12 GDPR); for any other message, our legitimate interest in replying (Art. 6(1)(f) GDPR).
Kept for
30 days at Resend, 35 days for the identifier. In the controller’s mailbox, as long as needed to handle your request and to show that it was handled.

Visit counts

Data
How many times pages are opened each day: whole numbers only, with no cookie, no identifier and no IP address.
Legal basis
Our legitimate interest in knowing how much the site is used (Art. 6(1)(f) GDPR).
Kept for
Aggregate counts only: nothing refers to a person.

Who else handles the data

Three providers process data on our behalf, under data processing agreements:

The controller reads and answers the emails to privacy@murettobox.com from a Gmail mailbox, provided by Google LLC (United States).

These are US companies, so data can be transferred to the United States. The safeguards are the EU-US Data Privacy Framework, to which Google LLC also adheres, and the European Commission’s standard contractual clauses included in the providers’ agreements.

What stays in your browser

The site saves a few technical choices in your browser. They are not used to follow you, so there is no consent banner:

There is no analytics, advertising or third-party tracking, and the fonts are served by this site.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. You can delete your account yourself from My experiments · account, or write to privacy@murettobox.com. You can also lodge a complaint with the Italian data protection authority, garanteprivacy.it.

Age and what is required

You must be at least 14 to create an account. An email address is needed only for the account: without one you can still read the site, experiment with Replay, compare laps and save experiments in your browser.

If this notice changes, the date at the top changes with it.