Legal
Privacy Policy
How the open-source Externa project (Qiick) processes personal data when you visit the marketing website at externa.qiick.io. Externa is free OSS — this site is not a shop and does not sell products or accounts.
Last updated: 22 September 2026
This page describes current practices for the marketing site. It is not legal advice. Review it before relying on it in production.
1. Controller
The controller for personal data processed via this marketing website is the Externa open-source project under Qiick, maintained by Luca Giardi ("we", "us").
This notice covers a non-commercial marketing site for free open-source software. We are not describing a separate registered trading company here; no VAT number or commercial registered office is listed because this project is not selling goods or services through this website.
Product / brand: Externa Website: https://externa.qiick.io Documentation: https://docs.externa.qiick.io Open-source repository: https://github.com/qiick-io/externa-core Maintainer credit: Luca Giardi (see site footer / LinkedIn link)
2. Data we collect
This marketing website does not require an account and does not offer a contact form.
Depending on how you use the site, we may process: • Technical request data generated by hosting and delivery (for example IP address, user agent, requested URL, referrer, timestamps, and approximate location derived from IP by the host). • Aggregated usage and performance metrics from Vercel Analytics and Vercel Speed Insights (see Analytics). • Information you choose to send if you contact us through external channels (for example GitHub issues or LinkedIn), which those platforms process under their own terms.
We do not intentionally collect special categories of personal data on this site.
3. Analytics
We use the following Vercel packages on this site: • @vercel/analytics (Vercel Web Analytics) — page views and aggregated traffic insights. • @vercel/speed-insights (Vercel Speed Insights) — performance metrics such as Core Web Vitals.
Purpose: understand whether the marketing site works, which pages are visited, and how performance can be improved. Legal basis (GDPR): Art. 6(1)(f) — legitimate interests in operating, securing, and improving a public marketing website.
Vercel describes Web Analytics as privacy-oriented and typically cookieless (no advertising cookies for these tools as configured here). Metrics are processed by Vercel as our processor / service provider. See also International transfers.
4. Hosting and server logs
The marketing site is hosted on Vercel (Vercel Inc.). Vercel may process technical logs and edge telemetry needed to deliver pages, absorb abuse, and keep the service available.
Purpose: hosting, security, debugging, and availability. Legal basis: Art. 6(1)(f) GDPR — legitimate interests in providing a secure public website.
Retention of raw edge/server logs follows Vercel’s product defaults and our operational need; we do not run a separate long-term visitor profile store on this marketing site.
5. Contact forms
This marketing website currently has no contact form and does not collect newsletter sign-ups.
If we add forms later, we will update this policy and, where required, obtain consent or state another legal basis before collecting those details.
6. Third parties and processors
We use service providers that may process personal data on our behalf: • Vercel Inc. — hosting, Web Analytics, Speed Insights. • GitHub, Inc. — if you interact with our public repositories. • LinkedIn — if you follow the footer credit link (that interaction is subject to LinkedIn’s policies).
Documentation at docs.externa.qiick.io may be hosted separately; that property should be covered by its own notices where they differ.
The self-hosted Externa CMS (externa-core) that operators or contributors run on their own infrastructure is outside the scope of this marketing-site policy. Operators of a self-hosted instance are controllers for that deployment.
7. Retention
We keep personal data only as long as needed for the purposes above: • Analytics and performance metrics: retained according to Vercel product retention for Analytics / Speed Insights (aggregated metrics; not used to build advertising profiles on this site). • Hosting / security logs: retained for a short operational window unless a security incident requires longer retention. • Correspondence you send via third-party platforms: retained according to those platforms and our need to respond.
When data is no longer needed, we delete or anonymise it where feasible.
8. Security
We rely on Vercel’s platform controls (TLS in transit, infrastructure hardening) and limit access to project configuration to authorised people. No method of transmission or storage is perfectly secure; please use public channels thoughtfully.
9. International transfers
Vercel and some linked services are based in the United States or may process data outside the EEA/UK. Where GDPR applies, transfers rely on appropriate safeguards such as the EU–US Data Privacy Framework (where certified) and/or Standard Contractual Clauses, as described in the providers’ documentation.
10. Your rights
If you are in the EEA/UK (or another region with similar laws), you may have the right to access, rectify, erase, restrict, or object to processing of your personal data, and the right to data portability, where applicable. You may also lodge a complaint with your local supervisory authority.
To exercise rights relating to this marketing site, contact the project via the public channels in the site footer — GitHub (qiick-io/externa-core) or the LinkedIn credit for Luca Giardi.
We may need to verify your request and will respond within applicable legal deadlines.
12. Children’s data
This marketing site is aimed at professionals and is not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided data via our channels, contact us and we will delete it where required.
13. Changes to this policy
We may update this Privacy Policy when our practices, tools, or legal requirements change. The “Last updated” date at the top will change when we do. Material changes are posted on this page — please check that date when you revisit.
14. Contact
Privacy questions about this marketing website: use the public project channels in the site footer — GitHub (qiick-io/externa-core) or the LinkedIn credit for Luca Giardi.
No Data Protection Officer (DPO) is appointed for this open-source marketing site.
This notice covers the Externa marketing website at externa.qiick.io. Product documentation lives at docs.externa.qiick.io.