Privacy notice

Last updated: October 2026

Who is responsible

The data controller is Massimiliano Cori (Italy), who runs FloodCost as an independent project. Contact: the contact form.

What we collect

Only what you type in the contact form: your email, the page or place and your message, plus the page you came from. The search box runs in your browser: what you type is not sent to us. If you switch the light or dark theme, your choice is stored in your browser only.

The data on this site

The figures come from FEMA's public OpenFEMA data, which FEMA publishes without names or addresses. We publish only totals and medians of at least 10 policies or claims.

Why

To answer your messages and correct the site. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Who processes data for us

The site and its form are hosted by Netlify, Inc., which stores form data on our behalf and may process it outside the EU with the safeguards required by the GDPR (standard contractual clauses). Netlify keeps technical server logs (such as IP addresses) for security. We do not sell or share your data.

Cookies and visit counter

To count visits we use GoatCounter, a privacy-friendly counter: it sets no cookies and stores nothing in your browser, builds no profiles and does not store your IP address, your full browser signature or any identifier. It keeps only aggregate numbers (page, hour or day, browser, country, screen width) on servers in the European Union and shares nothing with third parties; see GoatCounter's privacy policy. The visit counter uses no cookies; the advertising described below does.

Advertising (Google AdSense)

This site shows ads served by Google AdSense. Google and the advertising partners it works with use cookies and similar technologies (such as advertising identifiers and your browser's local storage) to show ads, limit how often you see the same ad, measure results, prevent fraud and, only if you allow it, personalise ads based on your visits to this and other websites. For these ads Google is an independent controller of the data it collects.

If you are in the European Economic Area, the United Kingdom or Switzerland, a consent message appears on your first visit. It is Google's own certified consent management platform (Google “Privacy & messaging”, certified under the IAB Transparency & Consent Framework): advertising cookies and identifiers are used only with your consent, and you can change or withdraw your choice at any time from the privacy and cookie settings link that the message leaves on the page. If you say no, you may still see ads that are not personalised. The legal basis is your consent (Art. 6(1)(a) GDPR and the ePrivacy rules on cookies).

How Google uses information from sites that show its ads: policies.google.com/technologies/partner-sites. You can turn off personalised ads from Google at any time in Google's ad settings. Google may process data outside the EU with the safeguards required by the GDPR.

How long

Messages are kept for up to 12 months after our last exchange.

Your rights

You can ask for access, correction, deletion, restriction, portability and objection (Articles 15–22 GDPR) and you can complain to the Italian data protection authority (garanteprivacy.it) or the authority where you live. California residents: we do not sell personal information. Personalised Google ads are explained in the advertising section above, and you can opt out of them at any time in Google's ad settings.