What this site
knows about you.

01Who is responsible

This site, jasonnellis.com, and its subdomain thefeed.jasonnellis.com are run by Jason Nellis, a private individual based in France. For the purposes of the General Data Protection Regulation (GDPR) and the French Data Protection Act, I am the data controller.

Anything privacy-related goes to hello@jasonnellis.com. I read it personally. Given the scale of what happens here, no data protection officer is required and none has been appointed.

02What I collect, and why

The contact form

When you send a message through /contact, I receive what you type: the topic, your name, your email address, your message, an optional company or organisation and rough budget, and for speaking enquiries the talk, event, date, format and audience size you fill in.

Purpose

To answer you, and to scope a talk, an engagement or a conversation you asked for.

Legal basis

Steps taken at your request before entering a contract (GDPR art. 6(1)(b)), and my legitimate interest in replying to people who write to me (art. 6(1)(f)).

Where it goes

The form is handled by Netlify Forms, which stores the submission and emails it to my mailbox.

Kept for

Three years after our last exchange, then deleted.

Email

If you write to hello@jasonnellis.com directly, the message is forwarded by ImprovMX to my Google Workspace mailbox. Same purposes, same legal basis and same retention as the form.

Analytics

I use Plausible to see which pages get read. It sets no cookies, does no cross-site tracking and does not fingerprint your device. It records the page URL, the referring site, your browser and operating system family, device type and country. Your IP address and user agent are hashed with a salt that changes every day and are never stored, so no visitor can be identified or followed from one day to the next.

On the browser games (The Feed and 80% of Your Comments Are Robots) Plausible also counts a handful of anonymous, aggregate in-game events — that a game started, reached certain weeks, ended, or that someone copied their result to share — so I can see roughly where players stop. These are counts only: still cookieless, still no personal data.

Legal basis

My legitimate interest in understanding what people read (art. 6(1)(f)). Because no personal data is retained, no consent banner is needed.

Where

Plausible Insights OÜ, Estonia. Data is stored in Germany.

On The Feed, Burn Rate and 80% of Your Comments Are Robots a handful of anonymous events are also counted, such as a game being finished, an ending unlocked, or which card and comment option were picked in a week. None of them carry personal data.

Burn Rate results

When you type your own numbers into Burn Rate, the result is saved anonymously so I can publish a yearly report on how long uploads really take. What is saved: platform, format, cadence, hours a week available, hours per production stage, which of those you changed, the verdict and the month. No name, email, channel, IP address or device details are saved with it, and a random code that exists only while the page is open keeps one visit from counting twice. If you leave the prefilled estimates alone, nothing is saved. The rows hold nothing that identifies you, so I treat them as anonymous data, not personal data. They are stored with Netlify.

Podcast updates

The signup boxes across the site — on the writing pages, the homepage, the experiments index, the podcast page and the end of the 80% of Your Comments Are Robots game — send your email address straight to Kit, which holds the Building Value list. Nothing is stored on this site, and no script from Kit runs on these pages — the form posts your address directly and nothing else. Kit processes your address on my behalf so I can tell you when the Building Value podcast is back and send the occasional update. The box at the end of the game also sends four details about the game you just played (the result you got, the weekly hours you picked, how many bait cards you played and your headline type) so I can see which results people sign up from. Apart from that and the anonymous event counts described under Analytics, your game stays in your browser.

Legal basis

Your consent (art. 6(1)(a)), given when you subscribe.

Withdraw

Every issue has an unsubscribe link. That removes you from the list. You can also write to me.

Provider

Kit (Convertkit, Inc.), United States. See Kit's privacy policy.

Embedded video

Podcast clips on the speaking and podcast pages are embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com). Nothing loads from Google and no cookie is set until you press play. Once you do, Google receives your IP address and handles the playback under its own privacy policy. Some short clips are served directly from this site instead; those load from Netlify like any other file and contact no third party.

Hosting

The site is served by Netlify. Like any web host, Netlify keeps short-lived server logs (IP address, requested URL, time, browser) to keep the service running and to detect abuse. That is a legitimate interest (art. 6(1)(f)). Netlify retains these logs for a limited time under its own policy; I do not access them in the normal course of things.

Storage in your browser

The Feed, Burn Rate and 80% of Your Comments Are Robots remember a few things between visits, such as the endings you have found, an in-progress game so you can pick it up where you left off (cleared when the run ends), your last result, a short list of your past runs so the end screen can show the creators you've been, whether sound is muted and whether a result was unlocked. This lives in your browser's local storage, never leaves your device and is never sent to me. It is strictly necessary for the feature you chose to use, so it needs no consent. Clearing your browser's site data removes it.

What I don't do

• No advertising trackers, pixels or social media buttons that report back.
• No selling, renting or sharing of your data for anyone else's marketing.
• No profiling and no automated decisions about you.
• No data knowingly collected from anyone under 16. If you think that has happened, tell me and I will delete it.

03Who else handles your data

These companies process data on my behalf. Each one is bound by a data processing agreement and only does what is listed here.

04Transfers outside the EU

Several of those providers are in the United States. Transfers to them rely on the EU-US Data Privacy Framework where the provider is certified under it, and on the European Commission's standard contractual clauses otherwise. Analytics data never leaves the EU.

05How long I keep things

06Your rights

Under the GDPR you can ask me, at any time and free of charge, to:

• Access the personal data I hold about you and get a copy.
• Correct anything that is wrong or incomplete.
• Delete it, unless I have a legal reason to keep it.
• Restrict how I use it while a question is being sorted out.
• Receive the data you gave me in a portable format.
• Object to processing based on my legitimate interests.
• Withdraw consent where consent was the basis, such as podcast updates. Withdrawing does not affect what was done before.

Email hello@jasonnellis.com. I will reply within one month. If the request comes from an address I don't recognize I may ask you to confirm it is yours before sending anything.

Under French law you can also leave instructions about what happens to your data after your death. Send those the same way.

If you think I have got something wrong, you can complain to the French data protection authority, the CNIL: www.cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. If you live elsewhere in the EU you can go to your own authority instead.

07Changes to this policy

If what the site does changes, this page changes with it and the date at the top moves. I don't send notification emails about it. The current version is always the one at jasonnellis.com/privacy.

08Legal notice

Information required under French law (Loi pour la confiance dans l'économie numérique, art. 6-III).