Privacy policy
Last updated: 20 September 2026
This is a small personal website. It runs no analytics, shows no advertising, and sets no cookies of its own. This page explains the few places where personal data is involved.
Who is responsible
Ben Curtis is the data controller for this website. You can reach me through the contact form.
The contact form
If you use the contact form, it collects your first name, last name, email address and your message, so that I can read and reply to it.
The form is handled by a small piece of software running on Cloudflare, which forwards the message straight to my email inbox. Your message is not stored in a database and is not passed to any form service, marketing tool or third party. It exists in my inbox and nowhere else.
Legal basis: my legitimate interest in answering people who choose to write to me (GDPR Article 6(1)(f)).
How long: messages stay in my email for as long as they are useful for the conversation, and are deleted when they are not. You can ask me to delete yours at any time.
The newsletter
My newsletter is published on Substack. The “Subscribe Here” button on this site is a plain link to Substack’s own signup page. Nothing is loaded from Substack until you click it.
If you subscribe, you do so on Substack’s site, and your email address goes to Substack, not to this website. Substack is responsible for that data as its own controller, under its own privacy policy, and you can unsubscribe from any email it sends you.
Cookies
This website sets no cookies of its own, loads nothing from third parties, and has no analytics, tracking or advertising software on any page. That is why there is no cookie banner: there is nothing to ask you about.
One cookie can be set by the hosting itself, for security:
| Cookie | Set by | Purpose | Lasts |
|---|---|---|---|
__cf_bm | Cloudflare | Telling real visitors apart from bots | 30 minutes |
It is strictly necessary for the site to work safely, is not used to track or profile anyone, and does not require consent.
If you follow a link to Substack or to any other site, that site’s own cookies and privacy policy apply there.
Hosting and server logs
This site is hosted by Cloudflare. Like any web host, Cloudflare processes the IP address of anyone who visits, in order to deliver the page and to protect the site from attacks and abuse. An IP address counts as personal data under the GDPR.
Legal basis: legitimate interest in running the site securely (GDPR Article 6(1)(f)). Cloudflare acts as a processor on my behalf, under its own data processing terms.
Links to other sites
This site links to Substack, and to my other sites bencurtisart.com and notesinspanish.com. Once you follow a link, that site’s own privacy policy applies, not this one.
Your rights
Under the GDPR you have the right to ask me for a copy of any personal data I hold about you, to have it corrected or deleted, to restrict or object to how it is used, and to receive it in a portable form. There is very little to hold — in practice this means any email you have sent me.
To exercise any of these, just ask. If you are not happy with how I respond, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), or to the authority in your own country.
Changes to this policy
If this site starts doing something new with personal data — analytics, for instance — this page will be updated before that happens, and the date at the top will change.