Privacy notice
Version 2026-09-10
FSPitside is run by two former Formula Student members. This notice explains what we collect, why, and how to make us delete it. It covers the whole site, including the waiting list.
Who is responsible
FSPitside has two joint data controllers: Lorenzo Dello Iacovo, Via Traversa Eurialo 12, 80124 Naples, Italy, and Antonio Longobardi, Corso Garibaldi 208, 80055 Portici, Italy. Reach either of us at [email protected], or by post at the addresses above.
What we collect, and why
If you join the waiting list
| What | Why | Legal basis |
|---|---|---|
| Email address | To tell you once, when the platform opens | Your consent |
| Team name, country, role | To know which teams are interested and where they are | Your consent |
| A one-way hash of your IP address | To show that a consent was genuinely given, and to stop abuse | Our legitimate interest in a working service |
The hash cannot be turned back into your IP address. We do not store the address itself.
If you create an account
| What | Why | Legal basis |
|---|---|---|
| Your real name and email address | To run your account. Real names are required because the platform does not allow anonymous contributions | Performing our agreement with you |
| Your password, hashed with Argon2id | To let you log back in | Performing our agreement with you |
| Profile details you choose to add: pseudonym, bio, links, skills | To show them on your public profile | Your consent, withdrawable by deleting them |
| Your CV, if you upload one | Only visible according to the setting you choose. The default is private, and companies never see it unless you say so | Your consent |
| What you post, upload, list and rate | To run the platform. Most of it is public by design | Performing our agreement with you |
| Session records, including IP address and browser | To keep you logged in and to investigate abuse | Our legitimate interest in a secure service |
When you simply read a page
We count page views, on our own server, to know which parts of the platform are worth the work we put into them. There is no third party involved, no cookie, and nothing stored in your browser.
| What | Why | Legal basis |
|---|---|---|
| The page path, without anything after the question mark | To know which pages get read | Our legitimate interest in knowing what to build |
| The site you arrived from, domain only | To know where people hear about us | Our legitimate interest in knowing what to build |
| A one-way fingerprint of your IP address and browser, salted with a secret that changes every night | So one person reading six pages counts as one visitor and not as six | Our legitimate interest in a meaningful count |
The nightly salt change is the point of the whole design: within a day two visits can be told apart, and from one day to the next nobody, us included, can join them up. Your search terms never leave your browser, because only the path is sent and never the query. Pages behind the login, such as your notifications or your settings, are not counted at all. If your browser sends Global Privacy Control or Do Not Track, we count nothing. We keep these rows for 400 days and then delete them.
What we do not do
- We do not sell or rent your data to anyone.
- We do not run advertising or tracking cookies at this time. If that ever changes, we will ask you first and this notice will say so. The page counting described above uses no cookie and no identifier that survives the night, which is why this site has never asked you to accept anything.
- We do not profile you automatically or make automated decisions about you.
- We do not give recruiters your CV unless you have set it to be visible to them.
Who else sees your data
We use a small number of suppliers, each acting on our instructions under a data processing agreement:
| Supplier | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Servers and database | Germany |
| Cloudflare | Domain, network and uploaded files | EU region |
| Resend | Sending email | EU / USA under standard contractual clauses |
How long we keep it
- Waiting list: until the platform opens and we have written to you, or until you ask us to remove you, whichever comes first. We delete the whole list within three months of launch, and a scheduled job removes anything older than eighteen months regardless.
- Account data: for as long as your account exists.
- After you delete your account: your personal details are erased. Posts and resources you published stay up with your name replaced by “deleted account”, because removing them would gut conversations other people took part in.
- Moderation records: kept for two years, because we have to be able to explain why we removed something.
- Sessions: thirty days, or until you log out. We store a one-way hash of your IP address, never the address itself.
- Notifications you have read: ninety days. Unread ones stay until you read them.
- Reports you sent us: one year after we close them.
- Export and deletion requests: one year after we complete them, so we can show we answered within the legal deadline.
These periods are enforced by a job that runs every night, not by hand.
Your rights
Under the GDPR you can ask us to:
- give you a copy of everything we hold about you
- correct anything wrong
- delete your data
- stop or limit how we use it
- hand your data over in a portable format
- withdraw a consent you gave, which does not undo what was lawful before
Write to [email protected] and we will answer within thirty days. Account holders can also export and delete everything themselves from account settings.
If you think we have handled your data badly, you can complain to your national data protection authority. In Italy that is the Garante per la protezione dei dati personali.
Cookies
We set two cookies, both strictly necessary, so we do not ask for consent for them:
- fsps_session keeps you logged in. Thirty days.
- fsps_preview runs only while the site is closed, to let the people building it see it. Thirty days.
We also store one thing in your browser’s local storage: fsps-theme, which remembers whether you chose the light or the dark theme. It is written only if you press the theme switch, it never leaves your device, and clearing it just puts the site back to following your system setting.
Nothing at all is stored on your device until you log in or press that switch. Fonts are served from our own server, so opening the site contacts nobody but us: no analytics, no advertising, no third party of any kind. That is why there is no consent banner: there is nothing to consent to.
If we ever add advertising or analytics, a consent banner will appear before a single one of those is set, and you will be able to say no.
Changes
If we change this notice in a way that matters, we will tell account holders by email before it takes effect. The version number at the top changes every time.