Privacy

This page explains what happens to your data when you visit adan.cloud or subscribe to my newsletter, No Hype, No Fear.

Who's responsible

Adan Álvarez, Barcelona, Spain. Email: [email protected].

What I collect when you subscribe:

your email address;
the role you choose, if you choose one (it's optional);
the page you signed up from;
when you signed up, confirmed and, if it happens, unsubscribed;
which version of this page you agreed to.

Amazon SES, which sends the emails, also tells me if an email to you bounces, or if you mark one as spam.

Why, and on what basis:

To send you the newsletter, and one welcome email when you join. The basis is your consent (GDPR Art. 6(1)(a)), which you give by confirming through the link I email you.
To prove you agreed, and to respect it if you unsubscribe. I keep a record of when you subscribed and unsubscribed. The basis is my legitimate interest (Art. 6(1)(f)) in being able to show that I had your consent and respected its withdrawal (Art. 5(2) and 7(1)).
The role and the page you signed up from are used only in totals, to understand who reads the newsletter and which pages bring readers. The role is optional, so its basis is your consent; for the page, it's my legitimate interest in knowing what brings readers. I don't use either to profile you.

What I don't do:

No tracking pixels and no click tracking in the emails: I don't know whether you open them or what you click.
No selling, renting or sharing your data, and no advertising.
No profiling and no automated decisions about you.

Who processes it for me:

Amazon Web Services (Amazon Web Services EMEA SARL) stores the list and sends the emails, from its EU region in Ireland.
Cloudflare delivers the website and forwards email sent to [email protected] to my mailbox.
Google (Gmail) hosts that mailbox, so your replies and any email you send me are stored there, under Google's terms.

AWS and Cloudflare work for me under their standard data processing agreements. All three are part of US groups, so your data may be accessed from outside the European Economic Area. Where that happens, it's covered by the EU–US Data Privacy Framework (for companies certified under it) and by the European Commission's Standard Contractual Clauses.

How long I keep it:

Sign-ups that are never confirmed: the confirmation link expires after 48 hours, and the sign-up is deleted with it.
Subscribers: until you unsubscribe.
After you unsubscribe (or your address bounces, or you mark the newsletter as spam), I stop emailing you straight away. I keep your address and the record of your consent and withdrawal for 3 years, only to prove consent and to make sure you're never emailed again by mistake. Then it's deleted automatically.
If someone else typed in your address and you never confirmed, it's deleted when the link expires. If an email to it bounced or was marked as spam, it's deleted after 30 days.
Amazon SES's suppression list keeps addresses that bounced or marked an email as spam, so they're never emailed again. I remove yours if you ask me to delete your data.
Backups of the list are kept for 35 days, so anything deleted is gone from them within 35 days.
Technical logs of the newsletter's servers are kept 90 days. They never contain your email address, only a keyed code that can't be turned back into it.

Automatic deletion can run up to a few days after the times above.

Unsubscribing: every email has an unsubscribe link, and your email app's unsubscribe button works too. You can also reply and ask.

Questions and feedback

Some editions ask a question, and every edition asks "Was this edition useful?". Answering is optional and anonymous.

What's stored: your answer, the comment if you write one, which edition and question it was for, and when.
What isn't stored: your name, your email, or anything that links your answer to your subscription. The answer buttons in the email carry no reader ID, and the part of the link that says which answer you picked (after the "#") never reaches the server.
Stopping repeat votes: to count one answer per person, per question, per day, the server keeps a one-way code made from your IP address, the question and the day, with a secret key. It isn't your IP address, it changes every day, and it expires after 26 hours. Your IP address itself is never stored.
Comments are kept for 1 year, then deleted automatically. I read them to make the newsletter better, and I may quote one in a later edition, anonymously: comments have no name attached, and I leave out anything that could identify someone. Please don't put personal details in them.
Results are published only as totals, for example "62% said more than an hour".
Basis: my legitimate interest (Art. 6(1)(f)) in knowing what readers think, with answers kept anonymous and to a minimum.

The website

adan.cloud sets no cookies and runs no analytics or tracking scripts. Fonts and images are served from the site itself.
Like any website, the services that deliver it (Cloudflare and Amazon CloudFront) process your IP address to send you the pages and to protect the site from attacks. They may keep it in short-lived technical logs, under their own retention. I don't use these logs to identify or follow visitors.
If you switch between light and dark mode, your choice is stored in your browser only (localStorage), and never sent anywhere.

On LinkedIn

If you follow the newsletter on LinkedIn, or message me there, LinkedIn handles your data under its own privacy policy. I don't get your email address from LinkedIn.

Your rights

You can ask me to see, correct, delete or export your data, and to restrict or object to how I use it. You can withdraw your consent at any time; that doesn't affect what happened before. Email [email protected] and I'll answer within one month.

If you think I'm not handling your data properly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos.

Changes

If this page changes, I'll update the date at the top. If the change matters for subscribers, I'll tell you in the newsletter.