1. Data Controller
A-Eye Level is a content and advisory platform focused on AI decision clarity for business leaders.
Data Controller:
Ron Gold
A-Eye Level
ron@a-eyelevel.com
As the operator of this website, Ron Gold is the Data Controller as defined by the EU General Data Protection Regulation (GDPR). This means we determine the purposes and means of processing any personal data collected through this website.
Data Protection Officer: No Data Protection Officer (DPO) has been appointed, as the conditions set out in Article 37 of the GDPR do not apply to this website. For any data protection inquiries, contact ron@a-eyelevel.com.
2. What data we collect
Data you provide through our forms:
Newsletter signup form: Email address, and confirmation that you agreed to receive the newsletter.
Contact form: Name, email address, and message content. Netlify Forms, which handles these submissions for us, also records your IP address, the page you came from, and your browser's user agent string alongside the message. It captures those automatically as part of processing the form and filtering out automated spam.
Data collected automatically by our providers:
Server logs: Our hosting provider records standard web server logs, including your IP address and the pages requested. We use these for security, to keep the site running, and as the source for the aggregate traffic counts described in Section 5.
Newsletter platform: When you subscribe, Buttondown records your email address, IP address, referrer information, and the time you subscribed. Buttondown also records which links you click in the emails we send. Section 5 explains this in full.
We do not use advertising pixels, retargeting technologies, or social media tracking scripts. We do not build profiles of individual visitors, and we do not use automated decision-making.
3. Legal basis for processing
Under the EU General Data Protection Regulation (GDPR), we process your personal data based on:
Consent (Article 6(1)(a)): We send the newsletter only to people who asked for it. You give that consent when you tick the box on the signup form and again when you click the confirmation link we email you. You may withdraw it at any time using the unsubscribe link in any issue, or by writing to us. Withdrawing is as easy as subscribing, and it does not affect the lawfulness of anything we did before you withdrew.
Legitimate interest (Article 6(1)(f)): When you send us a message through the contact form, we process your name, email address, and message in order to reply. Our interest is in answering people who write to us, and we consider it one you would reasonably expect when you press send. We also rely on this basis for keeping standard server logs to secure the website. You may object to either at any time under Article 21.
Pre-contractual steps (Article 6(1)(b)): Where your message is an enquiry about working together, we process it to take steps at your request before entering into a contract.
4. How we use your data
Newsletter subscribers: To send you our weekly newsletter, "The 5-Minute AI Decision." Each email includes an unsubscribe link.
Contact form submissions: To respond to your inquiry. We retain messages only as long as needed to address your request.
We do not sell your personal data, and we do not disclose it to anyone for advertising or for their own independent purposes. We do pass it to the service providers listed in Section 5, who process it only on our instructions in order to run this website and deliver the newsletter. That is a different thing from sharing, and Section 5 names every provider involved.
5. Third-party services
We use a limited number of third-party services to operate this website:
Netlify (hosting, form processing, and analytics): Our website is hosted on Netlify, Inc. (USA), and contact form submissions are processed through Netlify Forms, which stores each message together with the sender's IP address, referring page, and browser user agent, and screens submissions for spam. Netlify keeps standard web server logs, which include your IP address and the pages you requested, for a limited period. We subscribe to Netlify Analytics, which builds traffic reports from those same server logs. It works entirely on Netlify's side: it puts no code in your browser and sets no cookies. It reports how many pages were viewed and which ones, which requests returned errors, how much bandwidth was used, roughly which country or region visitors came from, and a count of distinct visitors. That last figure is worked out by counting different IP addresses seen in a day, so an IP address is used to tell visitors apart even though we never see a name or a profile. Reports cover a rolling 30-day window. It does not follow an individual visitor from page to page, and it does not combine what it sees here with any other site. Netlify's privacy policy: netlify.com/privacy.
Buttondown (newsletter service): Newsletter subscriptions are managed by Buttondown, LLC (USA). Under Buttondown's data processing agreement, the data processed includes your email address, IP address, referrer information, and the time you subscribed. Links in the emails we send are routed through a tracking address, which records that a link was clicked. Buttondown uses double opt-in, meaning you must click a confirmation link before you are added to the list. You can unsubscribe at any time using the link in every email. Buttondown's privacy policy: buttondown.com/legal/privacy.
ImprovMX (email forwarding): Emails sent to our domain address are forwarded via ImprovMX, which processes only the metadata necessary to forward the message. ImprovMX states that data for its EU customers is stored in French datacenters. ImprovMX's privacy policy: improvmx.com/privacy.
All fonts are self-hosted on our own domain. No external font services are used. We do not use any third-party advertising or tracking services.
6. Cookies and tracking
This website does not set first-party cookies, third-party cookies, or any form of local storage for tracking purposes.
Our hosting provider (Netlify) may use strictly necessary technical cookies for load balancing and security purposes. These are exempt from consent requirements under the ePrivacy Directive as they are essential for the website to function. They do not track your behavior.
We do not run any analytics or measurement script in your browser. We do not use advertising pixels, retargeting technologies, or social media tracking scripts, and no behavioral data is collected as you browse this website. All fonts are self-hosted on our domain, so loading a page makes no request to any outside service.
Our hosting provider keeps standard server logs, described in Section 2. Those are records the server makes of requests it receives, not tracking placed on your device.
If we introduce cookies or client-side tracking in the future, we will update this policy and our Cookie Policy, and implement a cookie consent mechanism before any tracking begins.
7. International data transfers
Some of your data is transferred to and processed in the United States. The safeguard differs by provider, so we set each one out rather than claiming a single mechanism for all of them.
Netlify, Inc. (USA): Netlify's data processing agreement relies on the EU-US Data Privacy Framework, with the European Commission's Standard Contractual Clauses applying as a fallback if that framework ceases to be available.
Buttondown, LLC (USA): Buttondown's data processing agreement incorporates the Standard Contractual Clauses issued by the European Commission under Implementing Decision (EU) 2021/914.
ImprovMX: ImprovMX states that data for its EU customers is stored in French datacenters, so email forwarding does not involve a transfer outside the EEA.
These arrangements are made under Chapter V of the GDPR. If a provider changes its transfer mechanism, we will update this section.
8. Data retention
Newsletter subscribers: We retain your email address, and the subscription details described in Section 5, until you unsubscribe or ask us to delete them. We do not ask for your name.
Contact form submissions: We retain messages, and the IP address, referrer and user agent stored with them, for up to 12 months after your inquiry is resolved, then delete them. Submissions caught by the spam filter are deleted without being read.
Server logs: These sit with Netlify rather than with us, and Netlify sets how long they are kept. It does not publish a retention period for site traffic logs, so we do not state one here rather than quote a figure we cannot stand behind. The Netlify Analytics reports built from them cover a rolling 30-day window.
9. Your rights under GDPR
Where the GDPR applies, you have the following rights regarding your personal data. We extend the same request process to every newsletter subscriber and website visitor, wherever you are, so far as it is reasonably practicable:
Right of access (Article 15): Request a copy of the personal data we hold about you.
Right to rectification (Article 16): Request correction of inaccurate data.
Right to erasure (Article 17): Request deletion of your personal data.
Right to restrict processing (Article 18): Request that we limit how we use your data.
Right to data portability (Article 20): Receive your data in a structured, machine-readable format.
Right to object (Article 21): Object to processing based on legitimate interest.
Right to withdraw consent: Withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.
Right not to be subject to automated decision-making (Article 22): We do not use automated decision-making or profiling that produces legal or similarly significant effects.
To exercise any of these rights, contact us at ron@a-eyelevel.com. We will respond within one month of receiving your request, as required by Article 12(3) of the GDPR.
10. Right to lodge a complaint
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.
As this website is operated from France, the relevant supervisory authority is:
CNIL (Commission Nationale de l'Informatique et des Libertés)
3 Place de Fontenoy, TSA 80715
75334 Paris Cedex 07, France
www.cnil.fr
11. Children's privacy
This website is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will delete it promptly.
12. Security
We protect your data using industry-standard security measures including HTTPS/TLS encryption, HTTP security headers (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options), and limited data collection practices. However, no method of electronic transmission or storage is 100% secure.
13. Changes to this policy
We may update this privacy policy to reflect changes in our practices or legal requirements. The effective date at the top of this page indicates when the policy was last revised. For material changes that affect how your personal data is processed, we will provide notice on this website before the changes take effect.
Questions about this policy? Contact ron@a-eyelevel.com.