Privacy Policy

TLDR;

I collect email addresses and first names, and only from people who hand them to me. I use them to send my newsletter, the book discount code, and any resource you signed up for. I don't sell them, I don't pass them to advertisers, and I don't track you around the internet. If your browser asks not to be tracked, I listen.

The rest of this page is the detail: what I hold, why, for how long, and what you can do about it.

Who is responsible

Ines Akrap

c/o POSTFLEX PFX-421-810

Emsdettener Straße 10

48268 Greven

Germany

hello@inesakrap.com

I'm the controller for everything described here.

Writing to me

The address above is my business address. Post sent there is received and digitised by Postflex GmbH, Emsdettener Straße 10, 48268 Greven, who make it available to me. They act as my processor under a data processing agreement per Art. 28 GDPR and handle your letter only on my instructions.

Your name, return address and whatever you wrote therefore pass through them before they reach me. Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in being reachable by post at a business address.

Email doesn't work that way. hello@inesakrap.com arrives in my inbox and nobody else's. If you're sending something personal, please use it.

Sending something physical? Please email me first. Parcels aren't accepted at that address.

The email list

What I collect: your email address and your first name.

Why. There's one list. It carries my newsletter, the discount code for Building the Sustainable Web, and resources like the Monday morning workbook. Whichever of those brought you in, you're on the same list and you get the newsletter too. The forms say so before you sign up.

Legal basis: your consent, Art. 6(1)(a) GDPR.

Confirming it's you. Double opt-in. You enter your address, I email you a link, and nothing happens until you click it. Don't click and you hear nothing from me. I delete unconfirmed addresses at least once a month.

Proving you agreed. I log the time you signed up, the time you confirmed, the IP address you confirmed from, and which form you used. The law requires me to be able to show that you consented and to what. Legal basis: Art. 6(1)(c) GDPR.

How long. Until you unsubscribe. Then I delete your address, apart from the consent log above, which I keep for three years after unsubscription.

Leaving. Every email has an unsubscribe link. One click, no questions. Or email me. Unsubscribing doesn't make the earlier emails unlawful.

Who processes it. Kit, Inc., 750 W Bannock St #761, Boise, ID 83701, USA, under a data processing agreement per Art. 28 GDPR.

Kit is based in the United States, so your address is transferred outside the EU. Kit is certified under the EU–US Data Privacy Framework, and Standard Contractual Clauses per Art. 46 GDPR apply in addition. US authorities may in principle be able to access data held there.

Statistics

I use Plausible Analytics to see how many people visit and which pages they read.

Plausible sets no cookies and stores nothing on your device, so there's no banner on this site asking you to agree to tracking. It doesn't follow you across websites, doesn't build a profile, and doesn't collect anything that identifies you. What I get is counts: pages, referrers, countries, rough device types.

Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in knowing whether anything I publish is read. You can object to processing on this basis at any time, though there's nothing here I could tie back to you individually.

The analytics script is served from this site. Event data is processed by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia, via their cloud API. All data is hosted in the EU on EU-owned infrastructure.

The site itself

Hosting. This site runs on Cloudflare Workers. Cloudflare processes each request and sees your IP address, the page requested, and information about your browser in transit. This is necessary to serve the site and protect it from abuse. I do not store server access logs separately.

Cloudflare also runs security services that may challenge suspicious traffic to protect the site from bots and attacks. These may set a cookie cf_clearance) on your device. This cookie is strictly necessary for security and requires no consent under § 25(2) TDDDG.

Host: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, acting as processor under Art. 28 GDPR. Cloudflare is based in the United States. Cloudflare is certified under the EU–US Data Privacy Framework, and Standard Contractual Clauses per Art. 46 GDPR apply. US authorities may in principle be able to access data processed there.

Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in operating and securing the site.

Cookies. This site uses one cookie: inesakrap_prefs_v1, which stores your display preferences (theme, enhancement level). It is a functional cookie strictly necessary to deliver the page as you configured it and requires no consent under § 25(2) TDDDG. Cloudflare may set an additional security cookie as described above. There are no analytics cookies, advertising cookies, or tracking cookies of any kind. That's why there's no consent banner.

Fonts. Served from my own server. Nothing loads from Google.

Do Not Track and Global Privacy Control. If your browser sends a Do Not Track (DNT) or Sec-GPC signal, this site respects it. Analytics are disabled entirely for your visit.

Embedded videos

Some pages include YouTube videos. YouTube is operated by Google.

Nothing loads from Google until you ask it to. You see a still image with a play button, and only when you click does the video load. If you never click, YouTube learns nothing about you.

Once you click, YouTube receives your IP address, information about your browser and device, and the fact that you watched this video here. If you're signed into a Google account, it can link the view to that account. What Google does with that is governed by Google's privacy policy and is outside my control.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG, given by clicking to load the video. The rest of the page works whether you do or not.

Loading a video transfers data to Google in the United States. Google LLC is certified under the EU–US Data Privacy Framework.

Recipient: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA.

What I don't do

I don't sell your data. I don't give it to advertisers. I run no advertising cookies and no tracking pixels. I don't profile you, and nothing about you is decided automatically.

Three parties see anything at all when you visit: Cloudflare, which processes every request in transit to serve and protect the site; Plausible, which receives anonymous page-view events; and YouTube, but only if you choose to play a video. If you join the email list, Kit processes your address as described above. That's the complete list.

Your rights

Under the GDPR you can ask me to:

• Tell you what I hold about you (Art. 15)

• Correct it (Art. 16)

• Delete it (Art. 17)

• Restrict what I do with it (Art. 18)

• Send it to you in a portable format (Art. 20)

• Stop processing based on legitimate interest (Art. 21)

• Withdraw consent at any time, effective going forward (Art. 7(3))

Email hello@inesakrap.com. No form, no process. The law gives me a month and it won't take that long.

If something's wrong

Tell me and I'll fix it: hello@inesakrap.com.

You can also contact a data protection authority, and you don't need to go through me first. You can choose the authority where you live, where you work, or where you think the problem arose. Mine is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

Doing that doesn't stop you raising it with me as well.

Do you have to give me anything?

No. Nothing on this site requires your email address. Without it I can't send you the code, the newsletter or the resources, and that's the only consequence.

Changes

If any of this changes, I'll update the page and the date at the top. If the change is significant and you're on the list, I'll email you rather than quietly editing a page nobody re-reads.