Privacy Policy
This policy explains what personal data this website collects, the purposes and legal basis for processing it, who it is shared with, how long it is kept, and the rights available to you under the General Data Protection Regulation (GDPR).
Data controller
The controller responsible for the personal data described in this policy is Arletty Garcia Caraballo.
Personal data collected and legal basis
Comments
When a comment is submitted, the website stores the name entered, the text of the comment, and the time of submission. No email address or account is required. Every comment is held for review before publication. The legal basis is consent (Article 6(1)(a) GDPR), given by submitting the form; consent may be withdrawn at any time by requesting removal of the comment.
Information stored in your browser
The website stores two items in your browser’s local storage: your selected display theme, and a randomly generated token that lets you view your own comment while it is awaiting review. These items remain on your device, are not transmitted to any third party, and are used solely to provide the requested functionality. The legal basis is the website’s legitimate interest in providing core functionality (Article 6(1)(f) GDPR).
Authentication
Sign-in via Google and the associated session cookie exist only for the site operator, for the purpose of publishing and managing content. Visitors are not asked to sign in, and no visitor authentication data is collected.
Abuse prevention
To limit automated comment spam, the website temporarily counts requests per network address in server memory. The IP address is used for this check only, is not written to the database, and is not used to profile visitors. The legal basis is the website’s legitimate interest in maintaining security and availability (Article 6(1)(f) GDPR).
Error monitoring
To detect and resolve technical faults, the website reports application errors to Sentry. This is limited to error reports; there is no performance tracking and no session recording or replay. The legal basis is the website’s legitimate interest in maintaining a functioning service (Article 6(1)(f) GDPR).
Cookies and local storage
The website does not use analytics, advertising, or tracking cookies. The only cookie set is the sign-in session described in section 2, which applies to the site operator only. The local-storage items described in section 2 are strictly necessary to provide the functionality you use. Because no non-essential cookies or similar technologies are used, no cookie-consent banner is presented.
Recipients and processors
Personal data is not sold and is not disclosed for advertising. It is processed on the controller’s behalf by the following service providers, under their respective data-processing terms:
- Railway — hosting, database, and media storage (EU region). Submitted comments are stored here.
- Sentry — error monitoring (EU region), as described in section 2.
- Google — authentication for the site operator only.
International transfers
Data is stored and processed within the European Union / European Economic Area. Where a processor transfers data outside the EEA, that transfer is governed by the safeguards in the relevant processor’s data-processing terms (such as the European Commission’s Standard Contractual Clauses).
Data retention
Comments are retained while they remain relevant to the post on which they appear, and are deleted on request or at the controller’s discretion. The items stored in your browser remain until you clear your browser’s storage. Error reports are retained for a limited period under Sentry’s standard retention. IP addresses used for abuse prevention are held only transiently in memory and are not retained.
Your rights
Under the GDPR you have the right to:
- request access to the personal data held about you;
- request correction of inaccurate data;
- request erasure of your data;
- request restriction of, or object to, processing;
- request portability of data you have provided; and
- withdraw consent at any time, where processing is based on consent.
To exercise any of these rights, use the contact details for the controller in section 1. A request to remove a specific comment is sufficient on its own.
Complaints
If you consider that your personal data has been handled unlawfully, you have the right to lodge a complaint with a supervisory authority. In Norway, this is the Norwegian Data Protection Authority, Datatilsynet.
Children
This website is not directed at children and does not knowingly collect personal data from them.
Changes to this policy
This policy may be updated to reflect changes in the website’s data practices. Material changes will be reflected here, and the “last updated” date above will be revised accordingly.