Privacy policy
Last updated: 11 October 2026 · 2026-10-11.1
Behind the scenes. Almost.
I wanted to keep Michela behind the scenes. The GDPR asked for her full name. So much for being mysterious. Here is who runs the site and what happens to your data. We take this part seriously.
Who handles your data
Data controller: Michela Biolcati, acting as an individual, for oliviamcaether.com. Privacy contact: oliviamcaether@gmail.com. Olivia McAether is the project’s name; the controller is the person identified here. This notice is provided under Articles 12 and 13 of Regulation (EU) 2016/679 (GDPR).
When you arrive: technical data
Delivering and protecting pages involves technical data such as IP address, request date/time and URL, browser/device details and error or security information. Purposes: operate the site, solve technical problems and prevent abuse. Legal basis: legitimate interest in site availability and security, limited to necessary data (GDPR Article 6(1)(f)). Technical data is necessary for communication with the site. The controller does not configure a separate browsing-log archive.
When you press play: song previews
Audio previews are requested from Apple servers only when you press play. No Spotify player, account access or playlist connection is loaded. Apple receives technical request data, including IP address and browser information, and may process it under its privacy policy. The site’s purpose is to provide the listening function you requested. Legal basis for technical delivery: legitimate interest in providing that requested feature (GDPR Article 6(1)(f)), without controller-side profiling. Do not press play if you do not want to send Apple the request; you can still use the rest of the site.
TikTok: we ask first
Video posters are images hosted on this site. TikTok players are blocked by default and load only with valid consent and when you choose a video. TikTok receives IP address, device/browser information, request origin and player interactions, and may read or set cookies and identifiers for delivery, personalisation, analytics and advertising under its EEA privacy policy and cookie policy. The site relies on consent for this optional connection (GDPR Article 6(1)(a) and Article 122 of the Italian Privacy Code). Refusal does not prevent browsing, song previews or external links. Acceptance alone never starts a video.
A yes is not a lifetime commitment
Change or withdraw your choice through “Cookie preferences” at the bottom of every page. Switch TikTok off and save to remove open players. Closing an individual video removes that player but does not withdraw stored consent. Withdrawal does not affect earlier lawful processing. This site cannot delete cookies already set on TikTok’s domain: manage them in your browser or through TikTok.
What we remember
Your browser stores olivia_privacy_v2 in localStorage: TikTok consent or refusal, notice version, choice time, expiry and choice method (banner, preferences or video). Duration: six months. This record remains in your browser; the site does not send a copy to a controller database or use it to profile you. Essential preference storage remembers and applies your choice, including refusal, and needs no separate consent for this technical purpose (Italian Privacy Code Article 122(1)). If storage is blocked, the choice applies to the current page only. Clearing it or reaching its expiry causes a new request.
The contact form: a proposal, not a mailing list
Using Contact collects first name, email, subject, message, language and the date/time of your enquiry. Last name is optional. These details are used to reply, consider collaborations and manage correspondence. Each request is stored in a private Google Sheets spreadsheet and emailed to the controller using Google Apps Script and Gmail. First name, email, subject and message are required to submit; browsing does not require the form. Do not include sensitive or unnecessary information. Precontractual enquiries rely on GDPR Article 6(1)(b); general enquiries on legitimate interest in handling correspondence (Article 6(1)(f)); privacy requests on legal obligations (Article 6(1)(c)). This form is not used for marketing or newsletter enrolment. A random request ID avoids duplicates. Abuse prevention uses a technical key derived from the IP address with a secret cryptographic function and temporary counters; they expire within 24 hours and are removed at the next daily cleanup. Plain IP addresses are not stored in the spreadsheet or emails. This protection relies on legitimate interest in security. Form details are kept only in the current page while you type, without browser storage.
If you email us
Emailing oliviamcaether@gmail.com shares your email address, any name you provide, and the message and attachments you choose to send. They are used to answer and manage your request, without automatically adding you to a mailing list. General correspondence relies on legitimate interest in handling enquiries (GDPR Article 6(1)(f)); privacy-rights requests rely on compliance with GDPR obligations (Article 6(1)(c)). Email is handled through Gmail: Google’s privacy policy. Send only information necessary for your enquiry. Without contact details or essential information, we may be unable to respond.
Who receives data
Recipients include the controller; hosting and delivery providers (OpenAI Sites and Cloudflare infrastructure); Apple when you request an audio preview; TikTok when you allow and start a video; and Google for enquiries stored in the private spreadsheet and their emails. Providers may act in different roles, including processors for activities performed for the controller and independent controllers for their own purposes, depending on their services and terms. The controller does not sell browsing data or integrate advertising pixels. Provider notices: OpenAI · Cloudflare · Apple · Google / Gmail, Sheets e Apps Script · TikTok. Disclosure to authorities occurs only as required by law.
How long data stays
Preference storage lasts six months. General correspondence, including form requests and their spreadsheet records, is kept as needed to handle the enquiry, normally no longer than twelve months after closure. Minimal records of privacy-rights requests are kept for twenty-four months after closure to document handling. Longer retention is limited to specific legal obligations or a dispute, for the necessary period. The controller configures no separate log archive or listening history. Infrastructure and external-service retention criteria include service delivery, security, abuse prevention and applicable obligations, under the respective providers’ notices.
International services
The listed providers also operate outside the European Economic Area, including the United States, and may process data in third countries. Safeguards depend on the provider and transfer: adequacy decisions, applicable EU–US Data Privacy Framework certifications, or standard contractual clauses and additional measures. Cloudflare describes relying on the Data Privacy Framework for US transfers and standard contractual clauses in other specified cases in its policy. Apple describes using standard contractual clauses for EEA data, and OpenAI describes adequacy decisions and standard contractual clauses. TikTok describes storage in the United States, Malaysia and Singapore and limited access by other group entities, relying on adequacy decisions or standard contractual clauses in the cases explained in its notice. Google/Gmail’s transfer information is accessible from its privacy policy above. Ask oliviamcaether@gmail.com for information on safeguards relevant to this site and how to obtain a copy.
Share the drama. Leave out the spies.
The Share, Facebook, WhatsApp and Email buttons only open your device’s sharing function, an external service or your configured mail app. The site code loads no social SDK, tracking pixel or player for these buttons, sets no sharing cookies and records neither who shares nor recipients or conversation content. Copy link accesses the clipboard only when requested. The share parameter comes from the preview image and is the same for everyone: it is not a visitor identifier. Choosing Facebook or WhatsApp sends that service the link and technical connection data, processed under its own policy and your account settings. Email prepares the title and link in your mail app; it sends nothing automatically and transmits nothing to this site’s controller. You choose whether, how and with whom to share.
The book, stores and other doors
This site offers a Contact form and has no newsletter form, visitor account or checkout. Book buttons lead to ragahounateoria.it; any signup there is a separate processing activity to be described in that site’s notice. Spotify, Apple Music, iTunes, Amazon Music and TikTok links open external services with their own policies and settings. The controller carries out no visitor profiling or automated decisions producing legal or similarly significant effects.
Your data. Your rights.
Where applicable under GDPR Articles 15–22, request access, correction, erasure, restriction or portability; object to processing based on legitimate interests; and withdraw consent. Contact oliviamcaether@gmail.com. Requests are answered without undue delay, normally within one month; any permitted extension will be explained. Only identity checks necessary to protect your data may be requested. Complain to the Italian data protection authority or the competent authority, including without contacting us first.
When something changes
The version and update date appear on this page. Changes to services or purposes are reflected in the notice; where required, renewed consent is requested before new processing is enabled.