In short
- This site has no accounts, forms, newsletter, comments or advertising.
- Visits are measured in two ways: anonymous, cookie-free counts through Vercel Web Analytics, and Google Analytics, which sets cookies only if you accept.
- Google Analytics cookies stay off until you choose. You can change your choice at any time with the “Cookies” link in the footer.
- Personal data is not sold, and it is not used for advertising, profiling or automated decisions.
Who is responsible
The controller of the personal data described here is Patricio Maffei Gaido, based in Buenos Aires, Argentina. Questions, requests and complaints about privacy can be sent to patricio@maffeigaido.com.
This notice is written to meet the information duties of the EU General Data Protection Regulation (GDPR) and the UK GDPR, the ePrivacy Directive (2002/58/EC, article 5(3)) on cookies and similar technologies, and Argentina’s Personal Data Protection Law No. 25.326 and its regulations. The same practices apply to every visitor, wherever they live.
What is processed, why and on what basis
Server logs
The site is hosted by Vercel Inc. When you request a page, the hosting infrastructure processes your IP address, the requested address, the date and time, browser and device information (user agent) and the referring page. This is needed to deliver the site and keep it secure and available. Legal basis: legitimate interest (GDPR article 6(1)(f)). I do not use these logs to identify or profile visitors, and Vercel keeps them only for a limited period under its own terms.
Anonymous audience statistics (Vercel Web Analytics)
To see which pages are read, the site uses Vercel Web Analytics. According to Vercel, it does not use cookies: visitors are told apart by a hash created from the request, which is discarded after 24 hours, so it cannot follow a person across days or across sites. Each page view records the date and time, the page address, the referrer, approximate location (country and region), operating system, browser and device type, and is used only for aggregate statistics. It stores nothing on your device and is not tied to an IP address or an identifiable person, so it runs without a consent prompt. Legal basis: legitimate interest. See Vercel’s description.
Audience statistics with your consent (Google Analytics)
If you accept, the site uses Google Analytics 4 (measurement ID G-DSWEW10X4Z) to measure visits in more detail: pages viewed, time on page, how you arrived, clicks on PDF downloads, on external links and on the email address, use of the seizure calculator (the substance, form and method chosen, not the values entered), approximate location, browser, device and language, linked to a random identifier stored in cookies. According to Google, Google Analytics 4 does not log or store IP addresses. The data is used only to understand how the site is read. It is not used for advertising, remarketing or personalised ads; advertising storage and personalisation are denied by default. Legal basis: your consent (GDPR article 6(1)(a) and ePrivacy article 5(3)). Event-level data is kept in Google Analytics for no more than 14 months.
If you decline, or make no choice, the Google tag is not loaded at all: no cookies are set and nothing is sent to Google. Those visits are simply not counted by Google Analytics (Vercel Web Analytics, described above, still counts them anonymously).
Preferences stored on your device
The site stores two items in your browser’s local storage: your cookie choice (pmg:consent, kept for 12 months and then asked again) and, if you use the language switch, your language preference (pmg:lang). Neither is sent to a server or used for tracking.
Messages you send me
If you email me, I process your email address, your name if you give it, and the content of your message, to read and answer it. Legal basis: legitimate interest in answering you or, if you ask for something such as a CV, steps taken at your request. I keep correspondence for as long as needed to deal with it and for ordinary record-keeping, and delete it on request unless the law requires me to keep it. My email is hosted by Google.
What the site does not do
- It has no user accounts, forms, comments or newsletter.
- It does not show advertising, and does not sell personal data or share it for cross-context behavioural advertising.
- It does not profile visitors or take automated decisions about them.
- It embeds no third-party widgets, maps, video players or web fonts: fonts, images and scripts are served from this site itself, apart from the Google and Vercel tools described above.
Cookies and similar technologies
| Name | Set by | Purpose | Duration | Needs consent |
|---|---|---|---|---|
| _ga | Google Analytics | Distinguishes visitors with a random identifier | 2 years | Yes |
| _ga_DSWEW10X4Z | Google Analytics | Keeps the state of a visit (session) | 2 years | Yes |
| pmg:consent (local storage) | This site | Remembers your cookie choice | 12 months | No: needed to honour your choice |
| pmg:lang (local storage) | This site | Remembers the language you chose | Until you clear it | No: you asked for it |
Google may change the names or durations of its cookies; the current list is in Google’s documentation.
Your choices
- Use the “Cookies” link in the footer of any page to accept or decline Google Analytics cookies, or to change an earlier choice. Declining is as easy as accepting, and it deletes the Google Analytics cookies this site has set.
- You can delete cookies and local storage in your browser settings at any time.
- Google offers a browser add-on that disables Google Analytics on every site.
Who receives data
| Provider | Service | Data |
|---|---|---|
| Vercel Inc. (United States) | Hosting and Vercel Web Analytics | Server logs; anonymous page-view data |
| Google LLC and affiliates (United States) | Google Analytics (with consent); email | Analytics data described above; email messages |
| Squarespace, Inc. (United States) | Registration and DNS of the domain maffeigaido.com | Domain name queries; no page content |
For hosting, statistics and email these providers act on my behalf as processors; for their own purposes they act as independent controllers under their own policies (Vercel, Google). I do not share personal data with anyone else, except where the law requires it.
International transfers
I am based in Argentina, which the European Commission recognises as providing an adequate level of data protection. The providers above process data mainly in the United States and other countries. For transfers from the European Economic Area, the United Kingdom and Switzerland, they rely on the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) where they are certified, and otherwise on the European Commission’s Standard Contractual Clauses. Vercel states that it is certified under the Data Privacy Framework.
How long data is kept
- Server logs: a limited period set by Vercel.
- Vercel Web Analytics: the visitor hash is discarded after 24 hours; only aggregate statistics remain.
- Google Analytics: event-level data for no more than 14 months; cookies as listed above.
- Cookie choice: 12 months, then asked again.
- Correspondence: as described under “Messages you send me”.
Your rights
Under the GDPR and the UK GDPR you have the right to access your personal data, have it corrected or erased, restrict or object to its processing (in particular where it rests on legitimate interest), receive it in a portable format, and withdraw your consent at any time without affecting what was done before.
In Argentina, Law 25.326 gives you the right to access your data free of charge at intervals of no less than six months, and to request its rectification, updating or erasure. I answer access requests within ten calendar days and rectification or erasure requests within five working days. The Agencia de Acceso a la Información Pública, as the supervisory authority of Law 25.326, is empowered to handle complaints from people whose rights have been affected by breaches of the data protection rules (argentina.gob.ar/aaip).
To exercise any right, write to patricio@maffeigaido.com. The service is free; I may ask you to confirm your identity, and I reply within one month. Analytics data is pseudonymous, so I can only find it if you give me the identifier in your _ga cookie.
You may also complain to a data protection authority: in the EU, the authority of your country (list); in the United Kingdom, the Information Commissioner’s Office; in Argentina, the AAIP. I would appreciate the chance to address your concern first. Where US state privacy laws apply to you, I do not sell personal information or share it for cross-context behavioural advertising, and requests to know, correct or delete are handled in the same way.
Security
The site is static: it has no database, user accounts or forms. It is served only over HTTPS with HTTP Strict Transport Security, and a Content Security Policy and other security headers limit which scripts and connections its pages can use. No system is perfectly secure; if a breach affecting your personal data occurred, I would notify you and the authorities as the law requires.
Children
The site is aimed at adults interested in research and policy writing. It is not directed at children, and I do not knowingly collect their personal data.
Changes to this notice
I update this page when the site’s practices or the law change; the date at the top shows the latest revision. If a change materially affects how analytics works, I will ask for your choice again.