Privacy Notice
Last updated: 20 October 2026
This notice explains what happens to the information you type into the application form on joinember.it: who holds it, why, who else can see it, and how to get it back or deleted. It also explains the statistics we keep about how the site is used, and how to switch them off. It is written under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The data controller for this website is Federico Galimberti, who runs Ember and its communication channels.
Contact for anything in this notice, including requests to access or delete your data: federico_galimberti@outlook.it
Ember is not a company. It is a non-profit, cost-split project, and there is no commercial use of your data of any kind.
2. What we collect
From applicants, only what you type into the application form, plus one technical field. From every visitor, only the site statistics described at the end of this section.
| Field | Required |
|---|---|
| Name and surname | Yes |
| Age | Yes |
| Where you are based | Yes |
| Email address | Yes |
| Which weeks of February and March could work for you | Yes |
| What rabbit holes you are exploring | Yes |
| What you want to work on at Ember | Yes |
| Why you care about experimenting on it now | Yes |
| A boring or frustrating task you have done | No |
| LinkedIn, X / Twitter, and other links | No |
| LinkedIn URLs of people you nominate | No |
| Your two confirmations (full focus, cost-split) | Yes |
| How you found Ember, and who told you if someone did | No |
| How you reached the site (referral tag in the URL, recorded automatically) | Automatic |
We do not ask for and do not want special category data: health, religion, political opinions, sexual orientation, and so on. Please do not put any of it in the free-text answers.
Our servers also keep standard access logs (IP address, timestamp, browser) for a short period, as any web server does, to keep the site running and to block abuse.
Site statistics. To understand whether the site works, for example how long people stay, which sections they open and where they drop out of the form, we keep a short record of each visit. It contains:
- a random identifier created by your browser (see section 8), and how many times this browser has visited;
- the day and hour of the visit (never the exact time), your country, and whether your device has a touch screen;
- the website you came from (only its name, such as linkedin.com, never the full address) and the referral tag in the link, if any;
- how many seconds you were actively on the page, which sections and buttons you opened, which other websites you clicked through to (only their name), how far you got in the form, and whether you sent it.
We never record your IP address, your full browser details, or anything you type. The identifier is never attached to your application, and we never try to link the statistics to an application or to a person. The statistics are therefore pseudonymous: they describe what a browser did on the site, not whose browser it was.
3. Why we use it, and our legal basis
- To read and evaluate your application, and to get back to you about it. Legal basis: steps taken at your request before entering into an agreement (Article 6(1)(b) GDPR). This is not based on consent, so there is no consent for you to withdraw here. You can ask us to delete your application at any time instead, see section 9.
- To contact people you nominate. Legal basis: our legitimate interest in building the cohort (Article 6(1)(f) GDPR). See section 6.
- To keep the form from being abused by bots and to keep the site secure. Legal basis: our legitimate interest in the integrity of the service (Article 6(1)(f) GDPR).
- To produce aggregate statistics about the site, to improve it and to show partners in aggregate form how it is used. Legal basis: our legitimate interest in understanding whether the site works (Article 6(1)(f) GDPR). We have weighed this interest against yours, and you can ask us for that assessment. You can switch the statistics off at any time, see section 8.
Selection is done by people reading applications. There is no automated decision-making and no profiling within the meaning of Article 22 GDPR.
4. Who else sees it
Your application is read by Federico and, where relevant, by the small group helping to select the cohort. Beyond that, two service providers process the data on our behalf as processors under Article 28 GDPR:
- Netlify, Inc. (United States) hosts the site, runs the function that receives your submission, and stores the site statistics.
- Google Ireland Ltd. / Google LLC stores the applications in a Google Sheet, via Google Apps Script.
Both involve a transfer of data to the United States, carried out under the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
We do not sell your data, we do not share it for advertising, and we do not use it to train AI systems.
Nothing else is loaded from anywhere else. Fonts, images, video and audio are all served from this site, so simply visiting joinember.it does not expose you to any third party.
5. If you are selected
Ember takes place within the institutional activities of Fondazione Albosaggia, which holds the venue for the duration of the project.
If your application is successful, your name, contact details and stay dates are passed to Fondazione Albosaggia, which becomes an independent data controller for participation, safety and insurance purposes. At that point you will be asked to sign a separate participation form, which carries its own privacy notice covering the emergency contact, any allergies you choose to declare, and photo and video consent.
Selected participants also get a private briefing area on this site, opened with their email address. What they fill in there, and the date of their last visit to it, is stored in the same Google Sheet as the selected applications.
If you are not selected, nothing is passed to anyone.
6. People you nominate
The form lets applicants nominate other people by pasting their LinkedIn URL. If someone nominated you, here is what you need to know, as required by Article 14 GDPR:
- We hold the LinkedIn URL that was submitted, and the fact that someone suggested you.
- We use it for one thing only: to reach out and invite you to apply. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
- Tell us to delete it and we will, immediately and with no questions asked. You can object at any time under Article 21 GDPR.
- If you never apply, the nomination is deleted along with everything else, as described in section 7.
If you are the one nominating, please only nominate people you would be comfortable telling that you did.
7. How long we keep it
- Applications that are not selected, and nominations: deleted within 12 months of the end of the cohort you applied for.
- Applications that are selected: kept for 24 months from the end of the cohort, in line with the participation form, so that we can handle insurance and any follow-up.
- Server access logs: kept for a short period by our hosting provider, then discarded.
- Site statistics: the random identifier is removed from each visit record 25 months after the visit. What remains (day, country, time on page, sections opened) is no longer linked to any browser and is kept as anonymous statistics.
You do not have to wait for these deadlines. Ask us and we will delete your data sooner.
8. What your browser stores
This site uses no advertising, no third-party cookies and no third-party analytics. Nothing here needs your consent, so there is no banner to dismiss.
These things are stored locally in your own browser:
- A draft of your application, in local storage, so you do not lose your answers if you close the tab by accident. It is cleared when you submit. You can clear it yourself at any time by clearing site data in your browser.
- A referral tag, in session storage, if you arrived through a specific link. It records which route brought you here and disappears when you close the browser. It is sent with your application if you submit one, and recorded in the site statistics.
- A random identifier for the site statistics described in section 2, in local storage. It is a random number that says nothing about you, and it only lets us tell a returning visitor from a new one. It is replaced with a new one 13 months after it is created, even if you keep coming back. It is used on this site only, by us only, and only to count visits in aggregate.
- A statistics off flag, in local storage, only if you switch the statistics off, so that we remember your choice.
- For selected participants who open the briefing area: their email address, packing list and travel choice, in local storage, so that they stay signed in and find their list again. Signing out removes the email address. Clearing site data removes everything.
The draft, the referral tag, the statistics off flag and the briefing items are strictly necessary for something you asked for. The identifier is used only for first-party aggregate statistics, which the Italian data protection authority treats in the same way as technical cookies (Garante, cookie guidelines of 10 June 2021). None of them requires consent.
You can still say no to the statistics. If your browser sends a Global Privacy Control signal, we treat it as a no automatically.
Statistics are only collected while JavaScript is on.
9. Your rights
Under Articles 15 to 22 GDPR you can ask us to:
- give you a copy of the data we hold about you (access);
- correct anything that is wrong (rectification);
- delete it (erasure);
- pause our use of it while something is being sorted out (restriction);
- object to processing based on legitimate interest, including nominations (objection);
- receive your data in a portable, machine-readable format (portability).
The site statistics are not linked to your name, so we cannot find your visits from your name or email (Article 11 GDPR). We can find them from the identifier in your browser, shown at the end of section 8: send it to us and we will give you a copy of those visits or delete them. Copy it before switching statistics off, because switching off deletes it. To stop future visits from being recorded, switch statistics off in section 8 or clear the site data in your browser.
Write to federico_galimberti@outlook.it. We answer within 30 days, and in practice much sooner: this is a small project, not a support queue.
If you think we have handled your data badly, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, at www.garanteprivacy.it, or to the authority in the EU country where you live.
10. Changes to this notice
If this notice changes in a way that matters, we will update the date at the top of this page. If the change is significant and affects people who have already applied, we will email them.