Privacy policy

This site is a single page with no accounts, no forms, no newsletter, no analytics and no advertising. It runs no JavaScript and sets no cookies of its own. The sections below describe the little that does happen.

Who is responsible

The controller for the processing described here is Michał Sadurski, owner of RiddlePortal. You can reach us at [email protected].

This site does not sell anything. It describes the books and links to our Etsy shop, which is where any purchase happens and which carries its own seller information.

No Data Protection Officer is appointed; the processing here does not meet the thresholds in art. 37 GDPR.

What is collected

Server access logs. When you open a page, our hosting provider records the request: your IP address, the time, the page or file requested, the referring page, and your browser's user-agent string. An IP address is personal data, so this policy covers it even though we never link it to a name.

Nothing else. We do not use analytics, tracking pixels, embedded video, web fonts loaded from a third party, or social widgets. Downloading a free sample requires no email address and creates no record beyond the access log entry above.

Why, and on what legal basis

Access logs are processed to deliver the site, keep it available, and detect abuse such as denial-of-service traffic. The legal basis is our legitimate interest in operating and securing the service (art. 6(1)(f) GDPR).

How long it is kept

We do not receive, store or have any access to these logs. The site runs on Cloudflare's Free plan, and Cloudflare's raw request logs (Logpush and Logpull) are available only on its Enterprise plan. Nothing about your visit reaches us.

Cloudflare holds that technical metadata at its edge, as our processor, for as long as it needs it to keep the network secure and available. Cloudflare does not publish a fixed period for it, stating that it stores information "for a period of time that is consistent with the business purposes" it was collected for. Those operational and security needs are the criteria; we set no period of our own because we hold no copy.

Who else sees it

The site is built statically and hosted on Cloudflare Pages, a service provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare serves the files and processes the technical metadata described above in its server logs for security, network stability and DDoS protection. It acts as our processor under Cloudflare's Data Processing Addendum, which forms part of its subscription agreement, on the basis of our legitimate interest in hosting a secure and available site (art. 6(1)(f) GDPR).

Cloudflare is based in the United States. Transfers rely on Cloudflare's certification under the EU-US Data Privacy Framework and on Standard Contractual Clauses.

We do not sell, rent or share personal data with anyone else.

Cookies

This site sets no cookies and uses no local storage. Cloudflare may set a strictly necessary cookie, __cf_bm, to tell human visitors from bots; it expires after 30 minutes of continuous inactivity. It carries no advertising or profiling function, so under art. 173 of the Polish Telecommunications Act it does not require your consent, and there is no consent banner to dismiss.

Leaving this site

Our books are sold on Etsy. When you follow a link to Etsy you leave this site, and Etsy becomes an independent controller of whatever it collects, including any purchase you make there. Its handling of your data is governed by Etsy's own privacy policy (opens in a new tab), not this one. We never receive your payment details.

Your rights

Under the GDPR you may request access to your personal data, its rectification or erasure, restriction of processing, or portability, and you may object to processing based on legitimate interest. Where processing rests on consent you may withdraw it at any time without affecting what was done beforehand. Write to the address above and we will answer within one month.

In practice, an access log entry is usually not enough on its own to identify you, so we may need more information before we can act on a request, or may be unable to act on it at all (art. 11 GDPR).

You also have the right to complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl (opens in a new tab).

Automated decision-making

There is none, and no profiling.

Changes

If this policy changes we will update the date at the top of the page.