Data Compliance

• —Data subject rights: Access (export) and erasure run through a self-service flow with email verification, so data is only ever released to the person who controls the address on file. Requests complete well within the one-month GDPR deadline.
• —Erasure with dignity: A submitter whose resource is published chooses: remove the personal details and keep the contribution anonymous, or delete the resource entirely.
• —Lawful bases: Submissions are processed on consent; consent records on legal obligation; security logging on legitimate interest. The privacy policy lists each one.
• —Accountability: Handled requests are logged with type, timestamps, and outcome, without duplicating the requester's data into a new store.

Exercise any of these on the data privacy request page.

Retention windows are enforced by a scheduled job that runs daily, not by manual cleanup:

• —Cookie consent records: deleted after 24 months, prompting fresh consent.
• —Privacy request records: completed and expired requests purged after 30 days.
• —Resource submissions: retained until the submitter requests removal or anonymization.
• —Contact and event-idea form contents: delivered by email; the contact form stores nothing on the server.

• —All traffic is encrypted in transit (TLS); data is encrypted at rest by the database provider.
• —Administrative access requires authenticated sign-in limited to named, pre-authorized people.
• —Public forms are protected by rate limiting, origin checks, and bot honeypots.
• —Consent records store a hashed IP address, never the raw address.

In the event of a personal-data breach, affected people and the relevant supervisory authority are notified within 72 hours, as the GDPR requires.

Personal data touches exactly these providers:

• —Vercel Inc.: Hosting and delivery. SOC 2 Type II; participates in the EU-US Data Privacy Framework.
• —Neon Inc.: Database (AWS us-east-1, Virginia). SOC 2 Type II. Encrypted at rest.
• —Resend: Transactional email delivery (submission confirmations, verification links).
• —Anthropic: AI assistance for the editorial team only, on content submitted for publication. See the AI & Data Ethics statement.

International transfers are governed by Standard Contractual Clauses or the EU-US Data Privacy Framework, as applicable.