Privacy Policy

This Privacy Policy explains how notraced (“notraced”, “we”, “us”) collects, uses, and protects personal data when you visit notraced.com, read its articles, or use its interactive tools. It is written to satisfy the transparency obligations in Article 13 of the EU General Data Protection Regulation (“GDPR”) and the UK GDPR, and to provide the disclosures that United States consumer privacy laws may require even where those laws do not formally apply to a site of this size.

Short version: we collect the minimum amount of data needed to run the site, we do not sell it, we do not set tracking cookies, the interactive tools run entirely in your browser so your answers never reach our servers, and there is no newsletter or user account so there is no mailing list.

1. Who we are (the controller)

The data controller for the processing described in this policy is Sam Shephard, a natural person publishing notraced at notraced.com as a personal, non-commercial editorial project.

For privacy questions and data subject requests, use the contact page and select the Privacycategory. A substantive electronic contact method is explicitly accepted under the European Data Protection Board's Transparency Guidelines (WP260 rev.01) and the UK ICO's guide to privacy notices. We read contact submissions and respond within one calendar month, as GDPR Article 12(3) requires. If your request is complex we may extend by up to two further months and will tell you within the first month.

If you need to send us postal correspondence, submit a request through the contact page first and we will provide a suitable address by reply. We do not routinely publish a postal address to protect the privacy of the operator.

We have not appointed a statutory Data Protection Officer because we do not meet the thresholds in GDPR Article 37(1). The contact page is the functional equivalent and is the correct first point of contact for any question about your personal data.

2. What data we collect and why

We process personal data in two narrow contexts, both tied to the contact form. Each is described below with the categories of data, the purpose, the legal basis under Article 6 GDPR, and the retention period. There is no analytics platform and no third-party tracking of any kind.

2.1 Contact form submissions

If you send us a message through the contact page, we collect the fields you fill in: the reply-to email address you provide, the category you pick (Privacy, Legal, Editorial, or Other), the subject line, and the message body. We do not ask for your name or any other identifier.

• Purpose: to read your message and reply.
• Legal basis: the performance of pre-contractual steps at your request under GDPR Article 6(1)(b), or our legitimate interest under Article 6(1)(f) in responding to correspondence addressed to us. For requests exercising your GDPR rights (access, erasure, etc.) the legal basis is our legal obligation under Article 6(1)(c) to comply with Chapter III of the GDPR.
• Processor: delivery of the contact form message to our inbox is handled by Resend, Inc., operating under a GDPR-aligned Data Processing Addendum. Resend and its sub-processors (disclosed on its Trust Center) process the message in transit. Some Resend sub-processors are located in the United States; international transfers rely on the EU-US Data Privacy Framework (for transfers to DPF-certified recipients) or on the European Commission's Standard Contractual Clauses.
• Retention: messages are kept only for as long as necessary to handle your request plus a short retention window for audit purposes (typically six months). Privacy-rights correspondence may be retained longer where we have a legal obligation under Article 5(1)(b) to demonstrate compliance with a data subject request.

2.2 Rate-limit protection on the contact API

When you submit the contact form we read the IP address from the inbound HTTP request and check it against an in-memory rate limiter (5 requests per minute per IP). The IP address is held only in the memory of the currently running server process, is never written to disk, is never sent to a third party, and is discarded when the process restarts or after a short window of inactivity.

• Purpose: to prevent automated abuse of the contact endpoint.
• Legal basis: our legitimate interest under Article 6(1)(f) GDPR in operating the site securely. We have balanced this interest against your rights and concluded that a transient, in-memory count of requests from an IP is the least intrusive measure that works.
• Retention: a few minutes at most. The limiter is in-memory only.

3. What we do not collect

The interactive tools on this site — AI Data Flow Checker, AI Act Obligation Scanner, and Privacy Policy Generator — run entirely in your browser. The answers you give to the wizards and the documents the Privacy Policy Generator produces are never sent to our servers. Shareable URLs encode your wizard state in the URL query string itself, which is handled client-side; we do not read, log, or store those URLs. If you do not want your tool state in the URL bar, do not click the share button.

We do not run a newsletter or any mailing list. We do not offer user accounts. We do not run any analytics platform — not Google Analytics, not Plausible, not Fathom, not PostHog, not Umami, not any other. We do not use Meta Pixel, LinkedIn Insight Tag, TikTok Pixel, or any other cross-site advertising or retargeting technology. We do not run affiliate or retargeting pixels. We do not sell, rent, or trade personal data, and we have not done so in the preceding twelve months.

4. Cookies, local storage, and third-party requests

This site sets no cookies of its own. It does not store anything in your browser's localStorage or sessionStorage. The interactive tools encode their state in the URL query string only, which lives in the address bar and nowhere else.

There are no third-party JavaScript requests.The site loads its own code from its own origin, and that is it. No analytics beacons, no font CDN, no tag manager, no embedded social widgets. You can verify this with your browser's developer tools Network tab — the only requests you will see are to notraced.com itself.

5. How long we keep data

6. Who we share data with

We share personal data only with the following processors, each under a Data Processing Addendum and each strictly for the purposes described above:

• Resend, Inc. (contact form delivery). Contractually bound not to use your data for any purpose beyond delivering the message to our inbox.
• Vercel Inc. (hosting). Operates the servers that serve this site. Deploys run in the EU region where possible. Vercel processes request metadata (IP, User-Agent, URL) at the network layer in the course of delivering the page to your browser.

We do not share personal data with any advertiser, data broker, or marketing partner. We do not fund the site through data monetisation.

7. International data transfers

Some of the processors above are headquartered outside the European Economic Area. Transfers rely on a combination of:

• adequacy decisions (including the EU-US Data Privacy Framework where the recipient is DPF-certified);
• the European Commission's Standard Contractual Clauses (2021/914) where no adequacy decision applies; and
• additional technical and organisational safeguards such as encryption in transit and at rest, minimisation of the data transferred, and contractual audit rights.

If you are in the United Kingdom, the equivalent UK transfer mechanisms (UK IDTA or the UK Addendum to the EU SCCs) apply.

8. Your rights

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under GDPR and UK GDPR in relation to your personal data:

• Access — obtain confirmation of whether we process your data and a copy of it (Article 15).
• Rectification — correct inaccurate or incomplete data (Article 16).
• Erasure(the “right to be forgotten”) — ask us to delete your data when the legal conditions apply (Article 17).
• Restriction of processing in the circumstances listed in Article 18.
• Portability — receive your data in a structured, machine-readable format or have it transmitted to another controller, where technically feasible (Article 20).
• Objection — object to processing based on our legitimate interest (Article 21). In practice, the only legitimate-interest processing we do is rate-limit protection and aggregated analytics.
• Withdraw consent at any time (Article 7(3)) where we rely on consent. In practice we do not currently rely on consent as a legal basis for any processing, so this right is listed for completeness.
• Complain to a supervisory authority (Article 77). The supervisory authority for our establishment is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données). You can file a complaint at https://www.dataprotectionauthority.be/citizen/actions/lodge-a-complaint. You can also file with the supervisory authority of your habitual residence or place of work.

To exercise any of these rights, use the contact page and pick the Privacy category. We will respond within one month. There is no charge. We may ask for minimal information to verify your identity so we do not disclose your data to the wrong person.

9. US state privacy rights (voluntary disclosure)

As of the effective date above, notraced does not meet the thresholds for direct applicability of the California Consumer Privacy Act (CCPA/CPRA), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, or the Texas Data Privacy and Security Act. We mention these laws anyway because the substance of the rights they grant is something we are comfortable honouring for any US reader who asks:

• Right to know what personal information we have about you and where we got it.
• Right to delete the personal information we hold.
• Right to correct inaccurate information.
• Right to opt out of any sale or sharing of personal information for cross-context behavioural advertising. We do not sell or share personal information for these purposes and have not done so in the preceding twelve months, so there is nothing to opt out of. Our site also honours the Global Privacy Control signal as a valid opt-out even though no sale takes place.
• Right to non-discrimination. You will not receive a different price or a degraded version of the site for exercising any of the above.

To exercise any of these rights, use the contact page and state which right you are exercising. An authorised agent may submit a request on your behalf with signed written proof of authorisation.

10. Children

This site is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has submitted a contact form on our site, use the contact page (Privacy category) and we will delete the record.

11. Automated decision-making

We do not carry out any automated decision-making, including profiling, that produces legal or similarly significant effects. The interactive tools produce general assessments based on the answers you give them and run on your own device; they do not make decisions about you.

12. Security

We apply appropriate technical and organisational measures under Article 32 GDPR, including HTTPS across the whole site (with HSTS preload), a strict Content Security Policy, minimised data collection by design, and contractual data-protection terms with every processor. No system is perfectly secure; in the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours as Article 33 requires, and if the risk is high we will notify affected individuals as Article 34 requires.

13. Changes to this policy

We may update this policy from time to time. The effective date at the top of the page shows when the current version took effect. Substantive changes will be posted at the top of this page for at least 30 days before they take effect. Continued use of the site after a change takes effect means you have read the new version.

14. Contact

All privacy questions, data subject requests, and other correspondence about this policy go through the contact page. Pick the Privacy category so we can route your message correctly.