This site is a personal archive of writing. It sells nothing, carries no advertising, and does not make a living from collecting data about the people who read it. It collects one thing — visit statistics — and only if you allow it. This page explains, in plain language, what happens to your data when you visit.
Who is responsible
The data controller is Bruno Mota, the author and owner of this site. For any privacy question, or to exercise the rights described below, write to hi@brunomota.com.
What happens when you read
Until you consent, nothing that identifies you. Reading an article creates no record of you on my side. There are no tracking pixels, no advertising, no profiling and no automated decision-making about you.
The site’s typefaces are hosted on the server itself rather than on Google Fonts, which means opening a page does not send your IP address to a third party. Article images are served from here too. Gravatar avatars are switched off. There is no embedded content from other sites, such as videos or social media posts.
Visit statistics
I use Google Analytics to know how many people read each piece, and which ones are worth continuing. It only counts your visit if you allow it in the banner that appears on your first visit. Before that it sits in denied mode: no cookie is set and no measurement of you is stored. You can confirm it in your own browser — before you accept there is no cookie beginning with _ga.
One honest caveat: Google’s script file is loaded with the page even before you choose — that is how Google’s consent mechanism works, the script has to be present to know that you declined — and that request gives Google your IP address. What does not happen, until you accept, is any cookie or any measurement of your visit.
If you consent, Google Analytics records the page you viewed, the date and time, your device and browser type, an approximate location, and assigns your browser a random identifier so that you are counted once rather than many times. In GA4 properties the IP address is anonymised by default and is not stored. I do not use this data for advertising or remarketing, I do not combine it with anything else, and I make no attempt to identify you from it.
The legal basis is your consent — Article 6(1)(a) GDPR, and Article 5(3) of the ePrivacy Directive for reading from and writing to your device. User-level data is retained for at most 14 months.
On Google’s side the controller is Google Ireland Limited, and data may be transferred to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023; Standard Contractual Clauses apply in addition. That said, a transfer outside the Union is still a transfer, and it is reasonable not to want one: if you would rather it did not happen, decline in the banner and it does not.
How you give and withdraw consent
On your first visit a banner appears where you can accept or decline. Declining is as easy as accepting: the two buttons sit side by side, and choosing nothing counts as declining.
You can change your mind whenever you like, without giving a reason. In the footer of every page there is a Manage consent link that reopens the banner. Withdrawing consent does not make what was collected before unlawful, but it stops everything from that moment on.
If your browser sends a Global Privacy Control or Do Not Track signal, I honour it and do not even ask.
Comments
If you leave a comment, I store what you wrote, the name and email you gave, and your IP address and browser identifier. The IP and browser are used only to detect spam and, if it ever comes to it, to see whether abusive comments keep coming from the same source.
Your name and the text of the comment are publicly visible. Your email is never published or shared with anyone.
The legal basis for this is your consent, given when you submit the form. You can withdraw it at any time by asking me to delete the comment.
Everyone’s first comment is held until I read it. After that, later comments from the same email address appear without waiting.
Spam filtering is done by Antispam Bee, which analyses comments on the server itself. No data from your comments is sent to any external analysis service. Comments identified as spam are deleted automatically after 30 days.
I get an email notification when someone comments. That notification goes to my inbox and contains what you wrote.
Cookies
None of this site’s cookies are advertising cookies. There are two groups.
Essential, set without consent because without them the site does not work or does not do what you asked of it:
cmplz_*— store the choice you made in the banner, so you are not asked again. They last 365 days.pll_language— stores the language you are reading in.- If you comment and tick the corresponding box, your browser stores your name and email so you do not have to type them again. They last a year and you can refuse them by leaving the box unticked. They stay on your device, not on my server.
- Technical cookies from WordPress and the hosting, and — when I log in to administer the site — authentication cookies, which concern only me.
Statistics, set only after you consent:
_ga— distinguishes unique visitors. Lasts 2 years._ga_R1034YG1TP— persists session state. Lasts 2 years.
The complete list, with a description of each cookie, is in the Cookie Policy.
Server logs and hosting
The site is hosted with a web hosting provider, acting as a processor. Like any web server, the hosting keeps technical access logs including the IP address, the date and time, the page requested and the browser used. They exist to keep the service running and to detect abuse, and are kept for the period set by the host, typically a few weeks.
The legal basis is the legitimate interest in keeping the site available and secure. The servers may be located outside the European Economic Area. Where that involves a transfer of data, it rests on the contractual safeguards provided for in the GDPR, in particular the European Commission’s Standard Contractual Clauses.
Sharing on social media
The share buttons at the end of each article are ordinary links, not widgets. Until you click one, LinkedIn, X and Bluesky receive no information about your visit. If you do click, you are then on their site and their privacy policy applies.
The copy-link button works entirely in your browser and sends nothing anywhere.
How long I keep data
- Published comments and the data that comes with them: for as long as the comment is published, or until you ask me to delete it.
- Comments marked as spam: 30 days at most.
- Google Analytics statistics: 14 months at most at user level.
- Server access logs: the period practised by the host.
- Consent and comment cookies in your browser: one year, or until you delete them.
Your rights
Under the General Data Protection Regulation you have the right to ask for access to the data I hold about you, to have it corrected if it is wrong, to have it erased, to restrict or object to its processing, and to receive it in a format you can take elsewhere. You can also withdraw consent at any time, without affecting the lawfulness of what was done before.
Just write to hi@brunomota.com. I reply within one month. There is no charge for this.
In practice, because this site collects so little, almost always the only thing I have about you is a comment you left. Deleting it settles everything. As for the statistics, I have no way of knowing which row is you — if you want out of them, simply withdraw your consent.
If you think I am doing something wrong
Talk to me first, it is quicker. But you also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados, at www.cnpd.pt.
Minors
This site is not directed at anyone under 16 and does not knowingly collect data from minors. If you know that a child has left personal data here, tell me and I will delete it.
Changes
If I change something on the site that alters what is described here, I update this page and change the date below. Last updated: 7 September 2026.