root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
root@sparrow:~$ cat privacy.txt

Privacy Policy

Last updated: 27 July 2026

1. Data controller

  • Legal name: Roberto Bou Poveda, trading as “The Hack Sparrow” (sole trader / autónomo under Spanish law — not a separate registered company)
  • Tax ID (NIF): 46991671A
  • Address: Calle Unic nº 7, 25798 Calbinyà, Les Valls del Valira, Lleida, Spain
  • Business activity: subscription-based cybersecurity education content
  • Contact: support@thehacksparrow.com / thehacksparrow.com/contact

Required under the GDPR and Spain's LSSI. This section cannot be left as placeholders once the site accepts real payments.

2. What data we collect

DataWhenWhy
Email addressSign-up / sign-inSole login credential (magic link) and billing contact
NameSign-up (optional)Displayed to you in your own account
IP address → country & regionEvery sign-up and every magic-link sign-inOur platform (Ghost) automatically sends your IP address to a third-party lookup service to resolve a country/region, which is then stored against your account. This happens automatically and cannot currently be turned off from our settings. We do not display individual members' country or IP publicly — see Section 4.
Newsletter subscription & open/click activityOnly if you opt in at sign-up or in your accountSend you new-content emails; measure whether they're opened/clicked, so we know what's worth sending. You can unsubscribe or turn this off any time.
Payment detailsWhen you subscribe to Root AccessProcessed entirely by Stripe — we never see or store your card number.
Contact-form submissionsWhen you use /contact/Name, email and message are relayed to our support inbox to answer you.
  • Performance of a contract — account creation, authentication, and delivering the membership you subscribed to.
  • Legitimate interest — fraud and abuse prevention (spam-protection checks on the contact form, basic geolocation), and keeping the service running securely.
  • Consent — the newsletter. It is opt-in only: nothing subscribes you automatically, and you can withdraw consent at any time from your account.
  • Legal obligation — tax and accounting records for paid subscriptions.

4. Who we share data with

We don't sell your data. It is shared only with the service providers that make the site work, each acting under its own agreement with us:

ProcessorWhat forWhere
StripePayment processing. Stripe acts as our data processor for your payment details; Roberto Bou Poveda remains the merchant of record and data controller for the sale itself — see our Terms of Service, Section 10United States, with EU standard contractual clauses (SCCs) as Stripe's standard safeguard — [confirm against Stripe's current Data Processing Agreement]
MailgunTransactional email (magic links) and newsletter deliveryEU region (our account is configured on Mailgun's EU infrastructure specifically for this reason)
CloudflareDNS, CDN/reverse proxy in front of the whole site, and Turnstile spam protection on the contact formGlobal network — Cloudflare is a US company; transfers rely on Cloudflare's SCCs — [confirm current DPA]
Hetzner Online GmbHHosts the server this site runs onHelsinki, Finland (EU/EEA)
geojs.ioResolves your IP address to a country/region at sign-up (see Section 2) — invoked automatically by our platform software, not something we configured directlyNot currently verified by us — flagged for legal review before launch
Gravatar (Automattic)If you have a Gravatar account linked to your email, your avatar is fetched from Gravatar to display in your account page. We send a one-way hash of your email, not the address itself.United States

5. Cookies

We do not run analytics or advertising cookies of any kind on this site today. The only cookies in use are strictly necessary ones, exempt from consent under EU ePrivacy rules because they exist solely to provide a feature you directly requested:

  • A session cookie, set only once you log in as a member, so the site remembers you're signed in.
  • Cloudflare Turnstile may set a security cookie when you submit the contact form, to confirm you're not a bot.

If we ever add analytics or marketing cookies, we will add a proper opt-in consent banner before doing so — not an "accept" banner for cookies that are already running.

6. How long we keep data

We keep account data for as long as your account is active. If you delete your account, we remove personal data within a reasonable period, except where we're legally required to keep billing records (typically several years, for tax purposes).

7. Your rights

Under the GDPR you can ask us to: access the data we hold on you, correct it, delete it, restrict or object to processing, and receive a copy in a portable format. Where processing is based on consent (the newsletter), you can withdraw it at any time. To exercise any of these, contact us at support@thehacksparrow.com. You also have the right to lodge a complaint with the Spanish data protection authority (AEPD, aepd.es) or your own country's equivalent.

8. Age

This site is not directed at anyone under 18. We do not knowingly collect data from minors.

9. Changes to this policy

We'll update this page as the site changes, and notify you by email of any material change.

10. Contact

thehacksparrow.com/contact or support@thehacksparrow.com.