Last updated: August 5, 2026
Shaped by AI is an independent, non-commercial research project that studies how Generative AI is changing user behaviors, expectations and the practice of UX design. This page explains what personal data the website collects, why it is collected, and what control you have over it.
1. Who is responsible for your data
The data controller for this website is:
Stefano Toffolo Email: [email protected] Website: https://www.shaped-by-ai.com
2. Browsing the site
You can read every page, article and comment on Shaped by AI without creating an account, signing in, or providing any personal information. Signing in is required only if you want to publish a comment.
3. Comments and sign-in with Google
Shaped by AI lets readers comment on articles and discussion pages. Comments are handled by OpenRemark, a self-hosted commenting system that runs on our own instance at comments.shaped-by-ai.com, deployed on Scaleway cloud infrastructure in the European Union. Comments are not delegated to an advertising network or a social platform.
To publish a comment you sign in with a third-party identity provider — Google, GitHub or Discord.
What Google data we request
When you choose to sign in with Google, we request access to your basic profile information only:
| Data | Google scope | Why we need it |
|---|---|---|
| Name | profile | Shown as the author name next to your comments |
| Profile picture | profile | Shown as the avatar next to your comments |
| Email address | email | Identifies your account uniquely, prevents duplicate accounts and spam, and lets us notify you of replies to your comments |
What we do not do
- We do not request or receive access to Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos or any other Google service.
- We do not receive or store your Google password. Authentication happens entirely on Google’s servers via OAuth 2.0.
- We do not sell your personal data, and we do not share it with third parties for advertising, profiling or any other commercial purpose.
- We do not use your data to train AI models.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
What we store and for how long
When you post a comment, our server stores your display name, email address, avatar URL, the text and timestamp of the comment, and the IP address used at the time of posting (retained for abuse prevention and deleted after 90 days). Comments and the profile data attached to them are kept for as long as the comment remains published, or until you ask us to delete them.
Revoking access
You can revoke this site’s access to your Google account at any time from your Google Account permissions page. Revoking access prevents future sign-ins; to also delete comments and profile data already stored, contact us at [email protected].
The comment system is also governed by the Terms of Service for OpenRemark Comments.
4. Newsletter
If you subscribe to the project newsletter, the name, surname, email address and — optionally — company name you enter are sent to MailerLite, our email delivery provider, and used solely to send you updates about the project. We do not use them for any other purpose and we do not pass them to anyone else. Every message includes an unsubscribe link, and you can also ask us to remove you by email.
5. Analytics and cookies
The site uses Google Analytics 4, loaded through Google Tag Manager, to measure aggregate traffic: pages viewed, referring site, approximate geographic location, and similar usage data. These tools set cookies or use similar storage in your browser. We use this data only in aggregate, to understand which research topics readers find useful; we do not use it to identify individual visitors, and we do not run advertising or retargeting on this site.
The comment system may store a session token in your browser to keep you signed in. This is strictly necessary for the comment feature and is not used for tracking.
You can block or delete cookies through your browser settings. Doing so does not prevent you from reading the site, but it may prevent you from staying signed in to the comment system.
6. Legal basis for processing
Under the EU General Data Protection Regulation (GDPR), we process your data on the following bases: consent, which you give when you choose to sign in to comment or to subscribe to the newsletter; and legitimate interest, in keeping the site secure and free of spam and abuse.
7. Your rights
You have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to its processing, and to receive a copy of it in a portable format. To exercise any of these rights, write to [email protected]; we will respond within 30 days. If you believe your data has been handled improperly, you also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
8. Data security and transfers
Comment data is stored on our own self-hosted OpenRemark instance, deployed on Scaleway cloud infrastructure located in the European Union, and protected by encrypted connections (HTTPS) and access controls. Some of our other providers (Google, MailerLite) may process data outside the European Economic Area under the safeguards provided by their own data protection frameworks.
9. Children
This site is aimed at professionals and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. Any change will be published on this page with a new “Last updated” date. Substantial changes affecting how we handle your data will be announced on the site.
11. Contact
For any question about this policy or about your data:
Stefano Toffolo Email: [email protected]