What this site
knows about you.

01Who is responsible

This site, jasonnellis.com, and its subdomain thefeed.jasonnellis.com are run by Jason Nellis, a private individual based in France. For the purposes of the General Data Protection Regulation (GDPR) and the French Data Protection Act, I am the data controller.

Anything privacy-related goes to hello@jasonnellis.com. I read it personally. Given the scale of what happens here, no data protection officer is required and none has been appointed.

02What I collect, and why

The contact form

When you send a message through /contact, I receive what you type: the topic, your name, your email address, your message, and for speaking enquiries the talk, event, date, format and audience size you fill in.

Purpose

To answer you, and to scope a talk, an engagement or a conversation you asked for.

Legal basis

Steps taken at your request before entering a contract (GDPR art. 6(1)(b)), and my legitimate interest in replying to people who write to me (art. 6(1)(f)).

Where it goes

The form is handled by Netlify Forms, which stores the submission and emails it to my mailbox.

Kept for

Three years after our last exchange, then deleted.

Email

If you write to hello@jasonnellis.com directly, the message is forwarded by ImprovMX to my Google Workspace mailbox. Same purposes, same legal basis and same retention as the form.

Analytics

I use Plausible to see which pages get read. It sets no cookies, does no cross-site tracking and does not fingerprint your device. It records the page URL, the referring site, your browser and operating system family, device type and country. Your IP address and user agent are hashed with a salt that changes every day and are never stored, so no visitor can be identified or followed from one day to the next.

Legal basis

My legitimate interest in understanding what people read (art. 6(1)(f)). Because no personal data is retained, no consent banner is needed.

Where

Plausible Insights OÜ, Estonia. Data is stored in Germany.

On The Feed and Burn Rate a handful of anonymous events are also counted, such as a game being finished or an ending unlocked. None of them carry personal data.

The newsletter

The subscribe box on the writing pages sends your email address straight to Substack, which hosts The Long Yes. Nothing is stored on this site. Substack processes your address on my behalf so I can send you the newsletter.

Legal basis

Your consent (art. 6(1)(a)), given when you subscribe.

Withdraw

Every issue has an unsubscribe link. That removes you from the list. You can also write to me.

Provider

Substack, Inc., United States. See Substack's privacy policy.

Embedded video

Podcast clips on the speaking and podcast pages are embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com). Nothing loads from Google and no cookie is set until you press play. Once you do, Google receives your IP address and handles the playback under its own privacy policy.

Hosting

The site is served by Netlify. Like any web host, Netlify keeps short-lived server logs (IP address, requested URL, time, browser) to keep the service running and to detect abuse. That is a legitimate interest (art. 6(1)(f)). Netlify retains these logs for a limited time under its own policy; I do not access them in the normal course of things.

Storage in your browser

The Feed and Burn Rate remember a few things between visits, such as the endings you have found, whether sound is muted and whether a result was unlocked. This lives in your browser's local storage, never leaves your device and is never sent to me. It is strictly necessary for the feature you chose to use, so it needs no consent. Clearing your browser's site data removes it.

What I don't do

• No advertising trackers, pixels or social media buttons that report back.
• No selling, renting or sharing of your data for anyone else's marketing.
• No profiling and no automated decisions about you.
• No data knowingly collected from anyone under 16. If you think that has happened, tell me and I will delete it.

03Who else handles your data

These companies process data on my behalf. Each one is bound by a data processing agreement and only does what is listed here.

04Transfers outside the EU

Several of those providers are in the United States. Transfers to them rely on the EU-US Data Privacy Framework where the provider is certified under it, and on the European Commission's standard contractual clauses otherwise. Analytics data never leaves the EU.

05How long I keep things

06Your rights

Under the GDPR you can ask me, at any time and free of charge, to:

• Access the personal data I hold about you and get a copy.
• Correct anything that is wrong or incomplete.
• Delete it, unless I have a legal reason to keep it.
• Restrict how I use it while a question is being sorted out.
• Receive the data you gave me in a portable format.
• Object to processing based on my legitimate interests.
• Withdraw consent where consent was the basis, such as the newsletter. Withdrawing does not affect what was done before.

Email hello@jasonnellis.com. I will reply within one month. If the request comes from an address I don't recognise I may ask you to confirm it is yours before sending anything.

Under French law you can also leave instructions about what happens to your data after your death. Send those the same way.

If you think I have got something wrong, you can complain to the French data protection authority, the CNIL: www.cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. If you live elsewhere in the EU you can go to your own authority instead.

07Changes to this policy

If what the site does changes, this page changes with it and the date at the top moves. I don't send notification emails about it. The current version is always the one at jasonnellis.com/privacy.

08Legal notice

Information required under French law (Loi pour la confiance dans l'économie numérique, art. 6-III).