Privacy policy
Last reviewed
Draft: this page is waiting for a final review and may change.
This policy explains what data TheEspressoMachine.com handles and why. The short version: we have no forms, no accounts and no newsletter, so we do not ask for your name, email, phone number or any application details. We do not store or log any IP address, raw or hashed. The only exception to this is our staff and admin sign-in page, where after repeated failed sign-in attempts, further tries are blocked for up to 30 minutes, and this never applies to ordinary visitors, clicks, or forms. We never store the IP address itself, only a salted one-way hash of it, which is never written to logs, and the records are deleted within 30 minutes.
Who is responsible
The controller is Dominet BV, Panamalaan 7D, 1019 AS Amsterdam, the Netherlands (KvK 75389517). We follow the EU General Data Protection Regulation (GDPR).
What we handle
- Server logs. Our host (Vercel) processes technical data such as IP address, browser type and the page requested, to deliver and protect the site. The host keeps its logs for a short period and does not use them to identify you. We do not store or log IP addresses ourselves.
- Partner link clicks. When you click a link that starts with /go/, we log the partner, the page and button the click came from and the time. Advertising click IDs in that log are masked. These records contain no IP data and go to a shared click database run by Dominet BV. We filter bots using other signals, not IP addresses.
- Analytics, only if you accept. With your consent we use Google Analytics 4 to count visits and see which pages help. Without consent, Google tags set no cookies. See our cookie policy.
Legal bases
Server logs and click logs: our legitimate interest in running a secure site and being paid by partners. Analytics cookies: your consent, which you can withdraw at any time ().
Who receives data
Our hosting provider Vercel, Dominet BV for the shared click database, and Google if you accept analytics. Vercel and Google may process data outside the United States and the EU under standard contractual clauses. We do not sell data and we do not pass personal data to the providers we write about.
Your rights
You can ask for access to, correction or deletion of personal data we hold about you, object to processing, and complain to the Dutch Autoriteit Persoonsgegevens. Because we hold almost no personal data, there is usually nothing to look up. Requests can be sent by post to the address above.
Changes
We will update this page when our practices change and show the new review date at the top.