Privacy

01Who is responsible

The publisher of this site is the controller for the personal data described here. Correspondence about data protection goes to legal@invisiblecouncil.com.

This channel is published without a named author or company. The premise is a room with no host, and a byline would put one in it. The rights the GDPR grants are honoured for every visitor, wherever they are, rather than only where a law compels it.

02What is collected when a page is read

Nothing that identifies a reader. The pages are static files served from Cloudflare's network. Cloudflare processes the connection - IP address, user agent, the requested URL and a timestamp - as an inherent part of delivering and protecting the site, and retains that connection data for a short period for security and abuse prevention.

Audience measurement, where enabled, uses Cloudflare Web Analytics. It sets no cookie, stores no device identifier and builds no cross-site profile. The lawful basis is legitimate interest in knowing whether the site works and is read.

Google Analytics, where enabled, does set cookies and does send data to Google in the United States. It runs only for a visitor who has agreed to it, on the basis of that consent and nothing else, and the agreement can be taken back at any time from the cookies page. A visitor who refuses is measured by nothing: the tag is not loaded rather than loaded and told to be quiet.

No advertising network, no social pixel, no session-replay tool and no A/B testing service is present on any page. Where Google Analytics runs, its advertising features are switched off and stay off - ad storage, ad user data and ad personalisation are denied permanently rather than tied to the visitor's answer, because this site sells no advertising and has no use for the permission.

03Fonts and images

Both typefaces are served from this domain. No request is made to a font CDN, so no visitor's browser announces itself to a third party in order to render text.

Episode thumbnails are loaded from YouTube's image host (i.ytimg.com) when an episode list is displayed. No video player is embedded, and YouTube sets no cookie for an image request. Following a link to an episode opens YouTube, at which point YouTube's own privacy policy governs.

04The contact form

The name, address, reason, subject and message submitted through the form are used to reply and for nothing else. They are delivered to a single mailbox and stored there.

The lawful basis is the steps taken at the sender's request before entering into a contract, or legitimate interest in answering correspondence. Messages are retained for as long as the exchange remains live and for up to twenty-four months afterwards, then deleted.

The form carries a hidden field that a person cannot fill in and, where configured, a Cloudflare Turnstile check. Turnstile is a privacy-preserving alternative to a CAPTCHA: it sets no tracking cookie and does not profile the visitor.

Nothing submitted through this form is used to build a mailing list, and no address entered here receives anything but a reply.

05The list

An address left in the subscription form is used to say that a new episode is published, and for nothing else. No name is asked for and none is stored.

The lawful basis is consent, and the consent is proved rather than assumed: nothing is sent to an address until a link in a message to that address has been followed. An address that is never confirmed is never written to and is deleted.

The list is held in a Cloudflare D1 database in the European Union, and a copy of each confirmed address is held by Brevo, which sends the messages. Every message carries a link that removes the address, and following it takes effect immediately.

The list is never sold, never rented and never used for anything but the announcement it was left for.

06The private room

Entering a passphrase sets one cookie recording that the door was opened. It is strictly necessary for the feature to function, contains no personal data beyond that fact, and expires when the session ends or after thirty days, whichever comes first.

No account is created and no profile is kept.

07Where the site is served from

Cloudflare, Inc. delivers this site from a global network, so a request may be served from and processed in any country. Those transfers are covered by the European Commission's standard contractual clauses.

No personal data is sold, and none is shared with any third party for that party's own purposes.

08Rights

Access, rectification, erasure, restriction, portability and objection may be exercised at any time by writing to legal@invisiblecouncil.com. A request is answered within thirty days.

A complaint may also be brought to the supervisory authority of the country of residence.

09Changes

A material change to this notice is published here with a new effective date. Nothing is applied retroactively to data already collected under an earlier version.