Short version: your email, and what you read.

Who I am

Unmodeled is a personal newsletter written by me, Rafael Jiménez, based in Spain. I decide how your data is used (I'm the data controller). Write to me about anything on this page at rafa@unmodeled.com.

I'm also the founder of Sealmetrics. Unmodeled is separate: I don't share subscriber data with Sealmetrics or with anyone else, and I don't sell it.

What I collect

• Your email address and your newsletter status (pending, active, unsubscribed).
• Dates: when you signed up, confirmed and, if you do, unsubscribed.
• Where the signup came from: the form and page you used, the referring website (domain only, never the full address) and any campaign tags (utm_*) in the link you followed.
• What you read while signed in: which pieces you open, and clicks on links to Sealmetrics.
• Newsletter delivery: whether each issue was delivered, bounced or marked as spam.

Why, and on what legal basis

• Sending you the newsletter and giving you access to subscriber content: your consent (art. 6.1.a GDPR), which you give by confirming your email through the link I send. You can withdraw it at any time by unsubscribing.
• Understanding which research is useful (what subscribers read, where signups come from): my legitimate interest (art. 6.1.f GDPR) in deciding what to research and write next. It's limited to the data listed above, never used for advertising, and you can object by writing to me.

What I don't collect

No advertising cookies, no third-party trackers, no fingerprinting, no IP addresses stored, no names. Fonts are self-hosted. Emails contain no tracking pixels and links aren't rewritten, so I don't know whether you opened an email or clicked a link in it.

Cookies and browser storage

If you sign in, a session cookie keeps you signed in. It's strictly necessary for the access you asked for. Visitors who aren't signed in get no cookies. While a tab is open, the site keeps a random session id and the campaign tags you arrived with in your browser's session storage; both disappear when you close the tab.

Who processes it for me

• Supabase — database and sign-in. Data stored in the EU (Ireland).
• Vercel — website hosting. Server functions run in the EU (Dublin).
• Resend — email delivery, from the EU (Ireland) region.

Each one acts as a processor under a data processing agreement. Vercel and Resend are US companies, so some data may be accessed from the United States; those transfers rely on the EU–US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise.

How long I keep it

• Your subscriber record: while you're subscribed or have an account. If you ask me to delete it, it's deleted.
• Reading and signup events: 25 months, then deleted.
• Signups never confirmed: deleted after 30 days.
• If you unsubscribe, I keep your email marked as unsubscribed so I don't write to you again by mistake.

Your rights

Unsubscribe from any email in one click, or from your account page. You can also ask me to access, export, correct or delete your data, to restrict its use, or object to it: write to rafa@unmodeled.com from the address you subscribed with, and I'll answer within one month. If you think I've handled your data badly, you can complain to the Spanish data protection authority, the AEPD.