Privacy notice
Last updated: 8 November 2026
This notice explains what data we collect when you take part in 40ms, why, and what rights you have, under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR").
1. Controller
Giuseppe Cao, Via della Selva 23, 38123 Trento (TN), P.IVA 02738220223. Contact: [email protected].
2. What data we process
When you buy: email address, order code, pack, amount, chosen minute, date of purchase. Card or wallet details (Apple Pay, Google Pay) are processed by Stripe: we never see them.
When you take part: the photo you upload, the time it was taken and, if you choose, the name or nickname to show in the credits.
When you gift a frame and send it from the site: the recipient's email address, your dedication and the date it was sent. We use the recipient's email only to deliver that code: we don't subscribe them to anything or write to them again. Replies come to you.
When you sign up for updates: email address, language, where you signed up, and the dates of consent and confirmation. Your subscription only counts once you click the confirmation link we send you (double opt-in).
When you write to us or withdraw: the data you send and our exchange of messages.
When you visit the site: technical data such as IP address, browser type and time of request, kept for a few days for security.
3. Photo metadata
Phone photos contain metadata, sometimes including GPS location. The site reads only the date and time the photo was taken, to check your minute. Before sending, your browser removes all other metadata, location included: we never receive or store where you took the photo.
4. Why we process it and on what basis
| Purpose | Legal basis |
|---|---|
| Handling your purchase, your place in the film, your upload and the credits | Performance of the contract (Art. 6(1)(b) GDPR) |
| Publishing the photo in the film and in the project's communication | Performance of the contract and the licence you grant us (Art. 6(1)(b)) |
| Tax and accounting duties | Legal obligation (Art. 6(1)(c)) |
| Site security and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Delivering a gift code by email to the recipient you name | Performance of the contract with the giver (Art. 6(1)(b)) and the recipient's legitimate interest in receiving the gift (Art. 6(1)(f)) |
| Project updates by email, if you ask for them | Consent, which you can withdraw at any time with the link at the bottom of every email (Art. 6(1)(a)) |
Your email and payment details are needed to buy. A name in the credits is optional.
5. People in photos
The rules ask you to photograph what you see, not people. If recognisable people appear, the uploader must have their consent. If you recognise yourself in a project photo and did not agree, write to us: we will remove it.
6. Who we share data with
- Stripe Payments Europe Ltd., for payments, acting as an independent controller under its own privacy policy;
- Cloudflare, Inc., which hosts the site, database and photos, as processor;
- Resend (Plus Five Five, Inc.), the service we use to send confirmations, gift codes and updates, which also keeps the subscriber list, as processor;
- our accountant, for tax duties.
Approved photos and the names chosen for the credits are visible on each frame's public page (for example 40ms.it/f/6317) and become part of the film when it is released. Photos not yet approved are never public. Your email never appears. We sell data to no one.
7. Transfers outside the European Union
Some providers may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework or on the Standard Contractual Clauses approved by the European Commission.
8. How long we keep it
- order data and invoices: 10 years, as required by Italian law (Art. 2220 Civil Code);
- photos used in the film: for the life of the film, which is a permanent work;
- rejected or unused photos, and photos from withdrawn orders: deleted within 30 days of rejection or withdrawal, and in any case within 12 months of the premiere;
- technical logs: 30 days at most;
- email for updates: until you withdraw consent; after you unsubscribe we keep only proof of consent and withdrawal, for as long as needed to show it;
- sign-ups never confirmed: deleted within 30 days;
- a gift recipient's email: together with the order the gift belongs to.
9. Minors
The service is for adults only. A minor can take part only through a parent or guardian, who makes the purchase and the upload.
10. Your rights
You can ask us at any time to access, correct or delete your data, restrict processing, receive it in a readable format (portability), object to processing based on legitimate interest and withdraw consent (Articles 15–22 GDPR). Write to [email protected]: we reply within one month.
A note on deletion: once the film is edited and released, removing a single frame may no longer be possible. In that case we remove your name from the credits and from future versions where technically feasible.
If you believe your data is processed unlawfully you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to the authority in your country.
11. Automated decisions
We make no decisions based solely on automated processing. Photos are reviewed by people.
12. Changes
If we update this notice we change the date above and, for important changes, tell participants by email.