Legal
Privacy and cookies
Last updated:
Two things here: what I do with your data if you get in touch, and what cookies this site uses. Same approach for both: the minimum, with real names and real deadlines, and no analytics cookie without your consent. The little that gets measured without cookies before you decide is in here too, by name.
Your data when you write to me
This first part isn't about cookies. It's about what happens to your data if you get in touch, by email or from this site. It's the information required by article 13 of the General Data Protection Regulation.
Who the controller is
Francisco Javier López Martínez, in Valencia, Spain. There's no company behind this site: it's personal, and I write and maintain it myself. For anything to do with your data you can write to me.
What data I process, and what for
Whatever you give me when you write: your name, your email address and whatever you say in the message. I use it only to read you and reply. No mailing lists, no profiling, no automated decisions, no advertising.
On what legal basis
Your own initiative. Writing to me is the step before a possible working relationship, so the legal basis is the pre-contractual measures of article 6(1)(b) of the GDPR. That's why there's no box to tick before sending: the processing starts because you decide to write.
Who else sees it
Nobody else reads your message. The only company involved is Google, which hosts the mailbox (Gmail) and acts as processor. That means an international transfer of data to the United States, covered by the EU to US Data Privacy Framework, which Google has joined. I don't pass your data to anyone for commercial purposes.
How long I keep it
Your message stays in the mailbox for as long as the conversation makes sense, and at most one year from the last email. After that I delete it, unless there's a legal obligation to keep it.
What rights you have
You can ask me for access to your data, for it to be corrected or deleted, and you can also object to the processing, restrict it, or ask for it back in a portable format. Just write to the address at the end of this page. And if you think I've got it wrong, you can complain to the Spanish Data Protection Agency.
What cookies are
Cookies are small files a site stores in your browser. Equivalent technologies are also used, such as the browser's local storage (localStorage). Some are essential for the site to work; others, like analytics, are only used if you allow them.
What this site uses
Here's the detail of what may load, grouped by category:
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
flm-consent | franciscolopez.es | Stores your cookie choice so you're not asked again. | Persistent | Necessary |
flm-consent-seen | franciscolopez.es | Marks that you've already been counted as having seen the notice, so you're not counted twice. | Persistent | Necessary |
Container (GTM) | Manages the loading of the other tags. Stores no data on its own. | — | Necessary | |
_ga | Google Analytics | Distinguishes users in aggregate to measure site usage. | 2 years | Analytics |
_ga_* | Google Analytics | Keeps the measurement session state. | 2 years | Analytics |
_clck | Microsoft Clarity | Identifies the browser across visits to link your recorded sessions and heatmaps. | 1 year | Analytics |
_clsk | Microsoft Clarity | Connects multiple page views into a single recording session. | 1 day | Analytics |
“flm-consent” and “flm-consent-seen” are kept in the browser's local storage (localStorage); they're technically not cookies, but they're listed here for transparency. No marketing or advertising cookies are used today.
Legal basis
Necessary cookies load so the site can work and need no consent. Analytics cookies are only written with your prior consent, which you can give, deny or withdraw at any time without affecting how the site works. What gets measured without cookies before you decide is right below.
What gets measured before you decide, and it's three things
The first is a counter: I count that you've seen this notice and what you chose. Aggregate, the first time and only once per browser, and Upstash holds it. It stores no IP address, no cookies and nothing that could identify you: three numbers going up. That's why I don't ask your permission for it, because there's no personal data to process.
The second one does process data, and I'd rather explain it plainly: [Vercel Web Analytics](https://vercel.com/legal/privacy-policy), which counts the pages people visit. It uses no cookies and stores nothing on your device, but to avoid counting you twice on the same day it derives a temporary identifier from your IP address and your browser. That identifier is regenerated daily and the IP is not kept. What comes out of it is the country, the kind of device and the page viewed; nothing that points at you.
The third is [Google Analytics](https://policies.google.com/technologies/partner-sites), and it's the one I least expected to find: Google's container loads with the page, so it sends a visit ping before you've decided anything. Without your permission it goes with no cookies and stores nothing on your device, and every page load counts as a brand new visitor, so it doesn't link this visit to any earlier one of yours. What comes out of it is the page you're looking at, the basics about your browser and your IP address, which Google uses to work out the country. Only if you accept are the cookies that do recognise you between visits written, and only then does Clarity load.
And the awkward part, which I'd rather say myself: this site makes a point of asking everyone for permission, and the last two don't ask. The law doesn't require it (with no cookies and nothing stored on your device, the prior-consent rule of article 22.2 of the Spanish LSSI doesn't apply, and the legal basis is my legitimate interest under article 6.1.f of the GDPR in knowing how many people read this), but it's an exception to my own standard, not to the rule. The reason is that I want to know how many people read this, and a measurement that only sees the ones who accept can't tell me. If you're not comfortable with it, write to me and I'll stop counting you: it's the right to object listed above and I honour it without asking why.
How to manage or withdraw your consent
The first time you visit, a notice lets you accept, reject or choose by category. You can change your choice, including analytics, at any time from the button below:
You can also block or delete cookies from your browser settings.
Third parties
The analytics is provided by Google (Google Tag Manager and Google Analytics) and Microsoft (Clarity), which process data under their own policies. Clarity only loads with your consent; Google also sends, without it, the cookieless visit ping explained above. You can read them at Google's privacy policies and at Microsoft's privacy statement.
Embedded video
The INDYA and TheTool deep-dives embed a video hosted on YouTube. It does not load on its own: until you press play, the page shows a still image served from this domain and makes no request to Google. Once you press play, the video loads from youtube-nocookie.com (YouTube's domain that does not write advertising cookies) and Google's terms and privacy policy apply from that point on.
Data retention
Your consent choice is stored in your browser until you change it or clear the site data. Aggregate analytics data is retained by Google according to the property settings (by default, a maximum of 14 months at user level).
Changes to this policy
I'll update this page whenever the tools the site uses change. The date at the top reflects the latest revision.
Contact
If you have any questions about this policy or want to exercise your data protection rights, email me at franciscojavier.lopezmartinez@