Privacy in plain English.

1. The TL;DR.

This site collects: anonymized analytics (Plausible — no cookies, no fingerprinting), your email onlyif you opt into the newsletter, and the contact form fields you submit if you submit them. That's it. I don't run Facebook, TikTok, or LinkedIn pixels. I don't load Google Tag Manager. I don't sell, rent, or barter your data.

2. What I collect.

Three categories, all opt-in or anonymized:

• Analytics (anonymized). Page URL, referrer, country, screen size, browser. Aggregated by Plausible Analytics on EU servers. No personal identifiers.
• Newsletter (opt-in). Email address. Stored in Buttondown. You explicitly subscribe; one-click unsubscribe at the bottom of every email.
• Contact form (opt-in). Name, email, company, and the message you write. Sent to my inbox. Stored in my email client.

3. How it's used.

Analytics are used for one purpose: deciding what to write next. Newsletter emails are used to send the newsletter. Contact form submissions are used to reply to you and, if relevant, to send a follow-up SOW. None of these are used for retargeting, profiling, or sold to anyone.

4. Sharing & vendors.

The vendors involved in running this site, and what each one sees:

• Plausible Analytics — anonymized page-view stats. EU-based.
• Buttondown — newsletter delivery. Sees the email addresses of subscribers only.
• Cloudflare— DNS & CDN. Sees standard server logs, retained 7 days.
• Fastmail — my inbox. Sees the contact form submissions.

I have data processing agreements (DPAs) with each. Nobody else sees anything.

5. Cookies & tracking.

This site sets zero third-party cookies. The only first-party storage is a localStorage key remembering whether you've dismissed the cookie banner — which I don't have one of, so the key doesn't get set either. Plausible doesn't use cookies. There are no fingerprinting libraries. There is no GTM container.

6. Your rights.

Under GDPR, CCPA, and most of the alphabet of privacy regulations, you have the right to:

• Know what personal data I have on you (the answer is almost always “nothing”)
• Get a copy of it
• Have it corrected if it's wrong
• Have it deleted (also called “right to be forgotten”)
• Opt out of any further communication, instantly, with one click

To exercise any of these, email privacy@yerainabreu.com. I respond within 5 business days.

7. Retention.

Newsletter emails: kept until you unsubscribe, then deleted within 30 days. Contact form submissions: kept in my inbox for the duration of any related engagement, plus 24 months for tax-record purposes, then deleted. Analytics: aggregated anonymous data is kept indefinitely; nothing in it can identify you.

8. Security.

This site is served over HTTPS, sits behind Cloudflare with DDoS protection, and has no admin login on the public domain. Newsletter and form data are encrypted in transit and at rest. I use a password manager, hardware 2FA, and full-disk encryption on every device. I am not SOC 2 certified — I'm one person; the audit cost would be more than the website earns.

9. Contact.

Privacy questions or requests: privacy@yerainabreu.com. Postal address: Yerain Abreu LLC, PO Box 318, Mount Vernon, WA 98273, USA.

10. Changes.

If this policy changes materially, I'll post the diff at the top of this page and email anyone on the newsletter. The “last updated” date above is the truth.