Small site, small data footprint

Who is responsible

David Nathanson, based in Sweden, is the data controller for zerotoquad.com and the Zero to Quad publication list. Questions or rights requests can be sent to davidjnathanson@gmail.com. No data protection officer has been appointed because this small publishing project does not carry out processing that requires one.

When you browse

Vercel hosts the site and provides Web Analytics. Analytics records aggregate page-view information such as the page, referrer, approximate location, browser, operating system and device type. Vercel says the product uses no third-party cookies, does not tie an event to a person or retained IP address, and discards its temporary visitor-session hash after 24 hours. The site sends page views, not custom events containing names, email addresses or form contents. Aggregate results are used to understand which free pages are useful, not to build advertising profiles.

Read Vercel's Web Analytics privacy and compliance documentation. Like any web host, Vercel may also process ordinary request and security information, including an IP address and device/request details, to deliver and protect the site. To the extent this technical processing involves personal data, the purpose and lawful basis are the controller's legitimate interests in operating, securing and measuring a public website. Data is retained only for the provider's operational, security and aggregate-reporting periods.

When you join the email list

The signup sends your email address, plus a short source label for the signup page, to Kit. It is used for the promised email when the book is published; Kit may first send a confirmation message. Every sent email provides an unsubscribe route. The downloads remain available if you do not join.

The lawful basis for publication-list email is your consent. You can withdraw it at any time by unsubscribing or contacting the controller; withdrawal does not affect processing that was lawful beforehand. Supplying an address is optional. If you do not, the only consequence is that you will not receive the publication email.

Kit acts as processor for subscriber data and receives ordinary request details such as an IP address and device/browser data as described in its Data Processing Addendum. An address remains in the list until you unsubscribe or ask for its deletion, subject to a minimal suppression record needed to honour an unsubscribe request.

When you make contact

Emailing the author provides the address, message and attachments you choose to send. Those are used to answer the message, verify a correction, manage a review request or fulfil a privacy request. Email is processed by the sender's provider and Google/Gmail.

The lawful basis is the legitimate interest in responding to the correspondence and maintaining an accurate publication, or a legal obligation where the message is a data-protection request. Messages are optional and are kept only while needed for the conversation, correction record, review relationship or legal obligation.

Recipients and international processing

Personal information is not sold. It is shared only with the service providers needed for hosting and analytics (Vercel), list management and email delivery (Kit), direct correspondence (Google/Gmail and the sender's provider), or when disclosure is legally required.

Those providers may process data in the United States and other countries outside the EEA. Kit describes its use of the EU-US Data Privacy Framework and, where required, EU Standard Contractual Clauses in its DPA. Vercel describes its international-transfer safeguards in its privacy notice.

Your choices

Depending on the processing and applicable law, you can ask for access, correction, deletion, restriction or a portable copy of your personal data; object to processing based on legitimate interests; and withdraw mailing-list consent at any time. There is no automated decision-making or profiling with legal or similarly significant effects. Send a request to davidjnathanson@gmail.com. Identity may need to be verified before acting on it.

You may also complain to the Swedish Authority for Privacy Protection (IMY) or the supervisory authority where you live or work. These rights have legal exceptions, so the response will explain any limit that applies.