Privacy Policy.

1. Who is the data controller?

The data controller for personal information collected via this site is:

SKALDOS LTD
Registered in England, company no. 16999133
Contact: contact@skaldos.com

2. What information we collect

We collect three categories of information:

a) Information you give us directly

• Email address if you subscribe to our newsletter (the Almanac). We collect only the email address and the date you subscribed.
• Email content if you contact us at contact@skaldos.com — the contents of your message and your reply-to address.

b) Information collected automatically

• Aggregate analytics: page views, referring URL, country, device type, browser. We use a privacy-respecting analytics service (we plan to use Plausible Analytics, which does not use cookies and does not collect personal data) and do not build user-level profiles.
• Server logs: standard web server logs (IP address, timestamp, page requested) retained for up to 14 days for security purposes (anti-abuse, debugging).

c) Information collected by third parties on our site

• Amazon: when you click an affiliate link to amazon.com, Amazon may set cookies on your device for the purpose of crediting our affiliate account if you make a purchase. Amazon's privacy policy applies once you leave our site.

3. What we don't collect

• We do not use tracking cookies on this site.
• We do not run advertising scripts (no Google Ads, no Facebook Pixel, no programmatic display ads).
• We do not sell, rent, or trade personal information to third parties.
• We do not require account registration, payment information, or any identification beyond an optional newsletter subscription.
• We do not collect or store special-category personal data (health, biometric, political views, etc.).

4. Why we collect it (legal basis under UK GDPR)

• Newsletter subscription — Your consent, given when you submit the subscription form. You can withdraw consent at any time via the unsubscribe link in every email.
• Server logs and aggregate analytics — Our legitimate interest in running a secure website and understanding aggregate readership patterns.
• Email correspondence with you — Necessary to respond to your enquiry; legitimate interest in answering questions.
• Amazon affiliate tracking — A direct relationship between you and Amazon, governed by Amazon's privacy policy. We do not have access to your personal Amazon account or your purchase details beyond aggregate commission reports.

5. Who we share it with

We share personal information only with the following processors:

• Our hosting provider (Vercel Inc., USA) — operates the servers that deliver this site. Standard Contractual Clauses apply for international transfer.
• Our analytics provider (Plausible Analytics, EU-based) — receives only aggregate, non-personal pageview data. No personal information.
• Our newsletter platform (to be confirmed; will be a UK/EU service or a US service with Standard Contractual Clauses) — stores subscriber email addresses for the purpose of delivering the Almanac.

We do not share personal information with any other parties.

6. How long we keep it

• Newsletter subscriptions: Until you unsubscribe, or until you have been inactive (no opens, no clicks) for 24 consecutive months — whichever comes first.
• Email correspondence: Up to 24 months from the date of last reply.
• Server logs: Up to 14 days.
• Aggregate analytics: Up to 12 months in identifiable aggregate form; retained indefinitely in fully-anonymised aggregate form for historical comparison.

7. Your rights (under UK GDPR)

If you are in the UK, the EEA, or another jurisdiction with similar protections, you have the following rights regarding your personal information:

• Right of access — request a copy of the personal information we hold about you.
• Right to rectification — ask us to correct inaccurate personal information.
• Right to erasure — ask us to delete personal information we hold about you (also known as the "right to be forgotten").
• Right to restrict processing — ask us to limit how we use your personal information.
• Right to data portability — request your personal information in a machine-readable format.
• Right to object — object to our processing of personal information based on legitimate interest.
• Right to withdraw consent — at any time, where processing is based on your consent.

To exercise any of these rights, email contact@skaldos.com. We respond within one calendar month. If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. California Consumer Privacy Act (CCPA) — for US visitors

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• The right to know what personal information we collect about you and how we use it.
• The right to request deletion of your personal information.
• The right not to be discriminated against for exercising your privacy rights.

We do not sell personal information as defined by the CCPA, and we have not done so in the preceding 12 months.

To exercise CCPA rights, email contact@skaldos.com.

9. International transfers

Some of our processors (notably Vercel, our hosting provider) are based in the United States. Where personal information is transferred outside the UK or EEA, we rely on Standard Contractual Clauses approved by the relevant supervisory authorities, or other appropriate safeguards permitted under UK GDPR Article 46.

10. Changes to this policy

We may update this policy from time to time, particularly when we add new functionality (for example, when we confirm our newsletter platform choice). Material changes will be reflected in the "Last updated" date at the top of this page, and subscribers will be notified by email before the change takes effect.