Privacy policy

This policy explains what personal data we process when you visit El Ciervo Blanco or create a reader account, what we use it for and what rights you have.

1. Data controller

Your data is controlled by El Ciervo Blanco. For any privacy question, write to us at support@elciervoblanco.com.

2. What data we process and why

When you visit the site

Like any website, our servers and content delivery network log technical data about each visit: IP address, browser and device type, the page requested, date and time. We use it to serve pages, keep the site secure, prevent abuse and fix errors. These logs are kept for about 30 days.

To know what gets read, each page counts its visit without cookies and without storing anything on your device. We record the page, the date, the country (worked out by our content delivery network from your IP address, which we do not store), the family of your browser, operating system and device type, and the site you came from (its domain only). To tell visitors apart without recognizing you we use an encrypted identifier that changes every day: the secret that produces it is destroyed the next day, so it cannot be linked to your IP address. The detail of each visit is deleted after 90 days; after that we only keep daily totals.

The site also stores in your browser (using localStorage or sessionStorage, not cookies) your light or dark theme preference and, if you sign in, your session. This data stays on your device; the details are in the cookie policy.

If you create a reader account

• Registration data: your email address and, if you wish, your first and last name.
• Password: handled by Amazon Cognito, which stores it protected by cryptographic functions; we never see or store it.
• Sign in with Google or Apple: we receive your name, your email address (with Apple it may be a private relay address) and an identifier for your account. We never receive your Google or Apple password.
• Two-step verification (optional): your phone number if you choose to receive codes by text message, or the link to your authenticator app if you choose that option.
• Account usage data: sign-up and last sign-in dates, and the one-time codes we send you by email or text message to confirm your identity.

We use this data to create and maintain your account, let you sign in securely, send you the emails it needs to work (verification codes, password recovery, important notices) and protect it from unauthorized access.

If you write to us

If you email us, we use your address and what you tell us only to reply and, where appropriate, to handle your request.

Advertising

We show Google AdSense ads. On pages with ads, Google and its partners may use cookies and similar identifiers, your IP address and data about your browsing to serve ads, cap how often you see each one, measure their performance, prevent fraud and, if you allow it, personalize them based on your interests. Google acts in part as an independent controller of this data; you can read how Google uses information from sites that use its services.

If you visit from the European Economic Area, the United Kingdom or Switzerland, we will ask for your consent, through a Google-certified consent management platform, before using advertising cookies or showing you personalized ads; without it, Google can only show non-personalized ads. You can change your choice at any time from the “Privacy and cookie settings” link shown on pages with ads. Wherever you are, you can turn off personalized advertising in Google’s My Ad Center, aboutads.info or youronlinechoices.eu.

Donations and affiliate links

Donations are made on third-party platforms (such as PayPal or Ko-fi), which process your payment details under their own policies; we never receive your card details and at most learn the name or message you choose to share. When you follow an affiliate link, the destination shop may use cookies to credit the purchase to us; that happens on its site and is governed by its privacy policy.

3. Legal bases

If the General Data Protection Regulation (GDPR) or a similar law applies to you, we process your data on these bases:

• Performance of a contract: to provide the reader account you ask for and make it work.
• Legitimate interests: to keep the site and accounts secure, prevent abuse, reply to your messages and count visits anonymously to know what gets read.
• Consent: for advertising cookies and personalized ads where the law requires it. You can withdraw it at any time.
• Legal obligation: when the law requires us to keep or disclose certain data.

4. Who we share data with

We do not sell your personal data. We only share it with providers that help us run the service:

• Amazon Web Services (United States): hosting of the site and database, account management (Amazon Cognito) and delivery of emails and text messages.
• Google: advertising (AdSense) and, if you choose it, Sign in with Google.
• Apple: Sign in with Apple, if you choose it.
• Text message providers (such as Twilio or local carriers, depending on the destination country): they only receive your number and the code we send you.

We may also disclose data to authorities when a law or a valid court order requires it. Under some U.S. state laws, letting Google use cookies for personalized ads may count as “sharing” data for advertising; you can opt out as explained in the rights section.

5. International transfers

Our servers are in the United States, so your data is processed there even if you visit from another country. For data coming from the European Economic Area, the United Kingdom or Switzerland, we rely on our providers’ safeguards, such as the Standard Contractual Clauses approved by the European Commission or their certification under the EU-U.S. Data Privacy Framework.

6. How long we keep data

• Reader account: for as long as you keep it. If you ask us to delete it, we erase its data within 30 days, except what we must keep by law.
• Technical logs: about 30 days.
• Visit statistics: the detail of each visit, 90 days; daily totals, with no limit (they identify no one).
• Backups: they rotate automatically, and deleted data disappears from them within about 35 days.
• Emails you send us: as long as needed to handle your request.

7. Your rights

Depending on where you live, the law gives you rights such as these:

• to access your data and get a copy of it;
• to correct it if it is inaccurate;
• to ask us to delete it, including your account;
• to object to its processing or ask us to restrict it;
• to receive it in a portable format;
• to withdraw your consent at any time, without affecting what was done before;
• if you live in California or another U.S. state with a privacy law, to know what data we hold, to have it deleted or corrected, and to opt out of its “sharing” for personalized advertising, without being treated differently for doing so.

To exercise them, write to support@elciervoblanco.com from your account’s email address. We may ask you to confirm your identity and will reply within the time set by law (usually one month). If you are not satisfied with our answer, you can complain to the data protection authority in your country.

8. Children

The site is not aimed at children under 16 and we do not let them create accounts. If you believe a child has given us their data, write to us and we will delete it.

9. Security

All connections to the site are encrypted (HTTPS), access to data is limited to those who need it, and you can protect your account with two-step verification. No system is infallible: if we detect a breach affecting your data, we will tell you and notify the authorities where the law requires it.

10. Changes to this policy

If we change this policy we will publish the new version on this page with its date and, if the change is significant and you have an account, we will let you know by email.