de-universis.com
Privacy policy
Last updated: 20 October 2026
DE-UNIVERSIS is a project by Umberto Cipri, the controller responsible for the processing of personal data described in this policy. “We”, “us” and “our” refer to Umberto Cipri. This page explains what happens to your data when you visit de-universis.com, when you sign up for our announcements and when you write to us.
In short
- The site sets no cookies of its own and runs no analytics, advertising or social media scripts. Its fonts, images and videos are served by the site itself.
- Your email address is collected only if you sign up, and you join a list only after clicking the link in the confirmation email. Signing up is for people aged 16 or older.
- Brevo, the service that sends our emails, records whether you open them and click their links, and links this to your address. We do not use this data, and Brevo has told us it cannot be turned off.
- Cloudflare’s bot check loads only if our server asks for it, when you send the form.
- The past streams are links to twitch.tv: nothing is requested from Twitch until you follow one.
- We never sell your data or use it for advertising.
Who is responsible
The controller is Umberto Cipri, Via Bianca Ceva 12, 20152 Milano, Italy.
For anything about your data, write to contact@de-universis.com.
What we handle, and why
When you visit the site
The site is hosted by Cloudflare. Like any web server, theirs receives your IP address, the kind of browser and device you use, the page you ask for and the time of the request. This is needed to deliver the page and to protect the site from attacks; a limit on repeated requests to the sign-up form also counts requests by IP address. Legal basis: our legitimate interest in a site that works and is safe (Article 6(1)(f) GDPR).
We do not export or read Cloudflare’s records of single requests: in its dashboard we look only at totals, such as the number of requests and the countries they come from. Cloudflare keeps those records as part of the service it provides to us, and the documents it publishes do not say for how long on the plan we use: we are asking Cloudflare, and will write the answer here. The messages of our sign-up server record only the kind of outcome, such as a refused bot check, and not your address.
When you sign up for our announcements
The form asks for your email address and for you to confirm that you are 16 or older, and offers a separate box, unticked, for occasional news. It also has a hidden field that only automated programs fill in: what it contains is used to recognise them, then discarded.
When you send the form, we send one email to the address you entered, asking you to confirm it. Its purpose is to check that the request comes from someone who can use that address and to prevent abusive sign-ups: the legal basis is our legitimate interest in that check (Article 6(1)(f) GDPR). It contains no promotional content. Until you click its link you are on no list, and the request exists only in Brevo’s records of the emails sent (see “How long we keep it”).
When you click the link, you join the list of early access announcements, and the news list too if you ticked the box. We write to you when ORBIS opens its first test and when Demiurge opens to more people and, if you chose so, with occasional news about the project. Legal basis: your consent (Article 6(1)(a) GDPR), which you give by signing up and confirming. So that we can show what you agreed to, Brevo keeps with your sign-up the date you confirmed, the version of the site whose form you used (the text of every version stays in the history of our code), your answer about age and your choice about news. It does not keep the IP address you confirmed from.
You can withdraw your consent at any time. At the bottom of every email we send after you confirm there is a link to unsubscribe, which opens a page of Brevo with one button: pressing it stops all our emails to you, and within a couple of minutes takes you off our lists. To stop only the news and keep the announcements, write to us. If you change your mind after unsubscribing, write to us as well: signing up again is not enough, because Brevo no longer sends you our emails, the confirmation email included. Withdrawing does not affect what was done before.
Our emails contain tiny invisible images, and their links pass through Brevo’s servers. When your email app loads the images of one of our emails, or when you click one of its links, Brevo records it and links it to your address: for each email we sent you, it shows whether it was opened, how many times, and whether a link was clicked. Brevo also keeps the date of the last email you opened, which it says it updates to manage the delivery of emails.
On our side, every setting Brevo offers is at its minimum: your sign-up is recorded as not consenting to tracking, and opens and clicks are set to be anonymous. In the emails we have tested, the confirmation and the welcome, Brevo still links them to your address. Our announcements and news have the same settings, and we will check what Brevo records with the first one we send. This is not a consent we collect, and we do not rely on it: we do not use this data for anything, and we build no profile from it. We asked Brevo to stop it, and Brevo told us it cannot be turned off on any of its plans. If your email app does not load images, opening an email is not recorded; clicking a link still is.
Signing up is for people aged 16 or older: the form asks you to confirm it, and asks nothing else about your age. If we learn that someone younger has signed up, we delete the sign-up.
Giving us your email is up to you. Without it we cannot send you the announcements.
The bot check, when you send the form
Before an address reaches Brevo, our server may ask your browser to show that it is not a bot. Only then does the page load Cloudflare Turnstile, from challenges.cloudflare.com. Turnstile looks at your IP address, your browser and the way it connects, then gives the page a one-time pass, which our server checks with Cloudflare. For that check our server sends Cloudflare the pass alone: not your email address, not your IP address. In our tests, in October 2026, Turnstile set no cookies and saved one item in your browser’s storage.
Legal basis: our legitimate interest in protecting the form, and the people on our lists, from abuse (Article 6(1)(f) GDPR). The item Turnstile saves, as we observed it, serves the check of the sign-up you are sending, which is why we do not ask for consent to it. Cloudflare also uses these signals to improve Turnstile: that use is not needed for your sign-up, and for it Cloudflare is responsible on its own, as its Turnstile privacy addendum explains.
The streams, and our pages elsewhere
The row of past streams shows pictures saved on our site, and we do not embed Twitch’s player. Each stream is a link, marked “Watch on Twitch · external site”, that opens twitch.tv in a new page. Until you follow a link, these pictures cause no request to Twitch. When you follow one, you leave our site, and Twitch processes data about your visit under its own privacy notice and cookie notice.
The links to our pages on Instagram, TikTok, Spotify, Twitch and LinkedIn work the same way: nothing is loaded from those sites until you click, and from then on their own policies apply.
When you write to us
Email sent to contact@de-universis.com is forwarded by Cloudflare Email Routing, which does not keep its content, to a personal Gmail account, where Google stores it under its terms for personal accounts. We use your address and what you write only to answer you. Legal basis: our legitimate interest in answering (Article 6(1)(f) GDPR) and, when you exercise your rights, our legal obligation to reply (Article 6(1)(c) GDPR).
How long we keep it
- The early access list: until you unsubscribe, or until we have sent its second announcement. Then the list has done its job: we delete it, and with it every sign-up that is on no other list.
- The news list: until you unsubscribe, or until we have sent no news for 12 months. We check every three months, so the list is emptied within 15 months of the last news, and every sign-up left on no list is deleted.
- A sign-up you never confirm: it exists only in Brevo’s records of the emails sent. Each record is deleted one month after its email, and the deletion can take up to three more days. If you sign up again, the new confirmation email has a record of its own, with its own month.
- Brevo’s records of the emails we send you (when each one was sent and delivered): one month after each email, plus up to three days for the deletion. Brevo keeps no copy of the emails we have sent since 19 October 2026, before the sign-up opened to the public; the few earlier ones were tests sent to ourselves.
- After you unsubscribe: you leave our lists, and for 12 months a minimal record stays in Brevo, blocked so that none of our emails reaches you: your address, the date you unsubscribed, what you had agreed to (the date you confirmed, the version of the form, your answers about age and news) and the date of the last email you opened, which Brevo does not let us clear. It is there to respect your choice and to show what you had agreed to. After 12 months it is deleted, together with the history of opens and clicks that Brevo keeps with it; whether a copy of that history stays in Brevo’s other systems is one of the questions we are asking Brevo. Your address and the date you unsubscribed stay a little longer on Brevo’s list of blocked addresses: we remove them every three months, so within 15 months of your unsubscribing. If you ask us to delete your data sooner, we delete your sign-up at once. The entry on the list of blocked addresses stays until the same removal, because it is what keeps our emails from reaching you again; Brevo’s records of the emails already sent to you go one month after each email, as described above; and whether a copy of the history of opens and clicks stays in Brevo’s other systems is, here too, one of the questions we are asking Brevo.
- An address blocked for another reason, such as a report of spam or an email that could not be delivered: it is not removed automatically. We review these cases by hand every three months.
- Your emails to us: we delete each conversation at the first check, every three months, after 12 months have passed since its last message, so within 15 months of our last exchange. A request that is still open, or disputed, is kept apart for as long as it needs.
- Cloudflare’s records of your visits: see “When you visit the site”.
Who else handles your data
These providers handle your data to run the site, each with providers of its own (sub-processors) listed in its documents:
- Cloudflare, Inc., United States: the hosting, the network in front of the site, the sign-up server, the bot check and the forwarding of contact@. It works on our behalf under its data processing agreement, apart from the uses it describes as its own, such as improving Turnstile. Privacy policy.
- Brevo SAS, France: the email lists, the confirmation email and the emails we send. It works on our behalf under the data processing agreement attached to its terms. Privacy policy.
- Google: the personal Gmail account where messages to contact@ arrive. Privacy policy.
We share your data with anyone else only if the law requires it.
Transfers outside the European Union
Cloudflare and Google are based in the United States and may process data there. Both are listed under the EU-U.S. Data Privacy Framework, which the European Commission recognises as giving adequate protection, and Cloudflare’s data processing agreement adds the standard contractual clauses approved by the Commission. Brevo stores the data in the European Union, in France and Belgium. Some of the providers and group companies that Brevo lists in its data processing agreement are in the United States and in India, and can access the data from there: Brevo covers these transfers with the standard contractual clauses and, for some of them, with the Data Privacy Framework.
Cookies and your browser’s storage
de-universis.com sets no cookies and saves nothing in your browser. It uses no analytics, advertising or social media scripts, and its fonts are served by the site itself. This is why there is no cookie banner.
One outside service may write in your browser, and only if our server asks for it when you send the sign-up form: Turnstile, with one item in storage, used for the bot check. You can delete it at any time from your browser’s settings.
Your rights
You can object at any time to the use of your data for direct marketing, which includes our announcements and news, without giving a reason. For processing based on our legitimate interests, you can object on grounds relating to your particular situation. You can withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal.
You can exercise your rights of access, rectification, erasure, restriction and, where the applicable conditions are met, portability. Write to contact@de-universis.com. We respond without undue delay and within one month of receiving your request. Where necessary because of the complexity or number of requests, we may extend this period by a further two months: we will tell you within the first month and explain why.
If you think your data is handled wrongly, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority of the EU country where you live or work.
We make no automated decisions about you.
Changes to this policy
If what we do with your data changes, this page changes first, with a new date at the top. If a change affects the people on our lists, we tell them by email.