We collect little — and we'll show you exactly what.
This policy covers ousios.dev, operated by Ousios LLC (the data controller — company details on the legal notice). No accounts, no ad-tech, no data sales. What this site does touch is listed below, completely.
Last updated 12 July 2026 · Contact: kira@ousios.dev
What we collect, channel by channel
1 · Newsletter
If you subscribe, we process your email address to send you the newsletter. The mailing list is operated by MailerLite on our behalf: the signup form posts your email directly to MailerLite — no MailerLite script or cookie loads on this site — and MailerLite records your subscription, including a consent timestamp. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time — every email contains a one-click unsubscribe, and unsubscribing removes you from the list. We never share the list or use it for anything but the newsletter.
2 · Spotlight intake
If you submit a brand for a paid feature, we process what the intake form asks for: brand facts with sources, your contact email, asset links, and — where you include endorsements — the name and quoted words of the person endorsing. Legal basis: steps prior to entering a contract (Art. 6(1)(b) GDPR). Submissions are used solely to verify and build the feature under our sponsored-content policy. If a submission doesn't proceed, we delete it within 30 days of the decision; source material for a published feature is kept for the life of the placement plus 12 months.
3 · AI-assisted tools
Some pages have optional "Run with AI" features (for example the deal-memo tool). When you use one, the text you typed into the relevant fields is sent to our server, which forwards it to Anthropic (the AI provider) to generate the output. Neither we nor our server store it — nothing is written to a database or log. Our server briefly holds your IP address in memory to rate-limit abuse; it is not stored durably. Legal bases: providing the feature you invoked (Art. 6(1)(b)) and our legitimate interest in abuse prevention (Art. 6(1)(f)). With AI features switched off, in-browser tools keep your text on your device only (saved to your browser's localStorage, which the tool's "Clear" button erases).
4 · Analytics
We use Vercel Web Analytics and Speed Insights, which are cookieless — they set no cookies and no cross-site identifiers, and give us aggregate page and performance statistics plus anonymous interaction events (e.g. that someone clicked a contact button, not who). Legal basis: legitimate interest in understanding whether the site works (Art. 6(1)(f)). These run for every visitor.
We also offer Google Analytics 4, which is not cookieless: it sets first-party cookies (_ga and _ga_<id>, kept up to 2 years) holding a random identifier for your browser, and sends your IP address and the pages you view to Google. Because that stores an identifier on your device, we ask first — it loads only if you press Accept, and until then no Google script is requested at all. Legal basis: your consent (Art. 6(1)(a)); you can change your mind any time via analytics settings, which also deletes the cookies. We have switched off Google Signals, ad personalisation, and any advertising use, so the data is used only to count and segment visits to this site.
5 · Purchases & bookings
Checkout for toolkits runs through Gumroad, payments for services through Stripe, and call bookings through Cal.com. Each is an independent controller of the data you give it there (name, email, payment details — we never see your card number), under its own privacy policy: Gumroad, Stripe, Cal.com. We receive from them only what fulfilment needs: your email and what you bought or booked.
6 · Email
If you email us, we process your address and message to reply. Correspondence is kept as long as an ongoing conversation or engagement needs it, then deleted in periodic inbox reviews.
Who processes data for us
| Provider | What it receives | Role · Location | Transfer safeguard |
|---|---|---|---|
| Vercel | Hosting traffic (IP addresses), cookieless analytics | Processor · USA | Data-processing agreement; EU–US Data Privacy Framework / SCCs |
| MailerLite | Newsletter email addresses, consent records | Processor · EU (Lithuania) | Data-processing agreement |
| Anthropic | Text you submit to AI features (not stored by us) | Processor · USA | Data-processing agreement; EU–US Data Privacy Framework / SCCs |
| Formspree | Spotlight intake submissions (when the form is wired) | Processor · USA | Data-processing agreement; SCCs |
| Google (Analytics 4) | IP address, pages viewed, and a cookie identifier — only from visitors who accepted | Processor · USA | Google Ads Data Processing Terms; EU–US Data Privacy Framework / SCCs |
Gumroad, Stripe, and Cal.com act as independent controllers, not our processors (section 5 above). We do not sell personal information to anyone, and no other third party receives it.
Your rights
Under the GDPR (and equivalent laws), you can ask us for access to the data we hold about you, correction, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interest. Where processing rests on consent (the newsletter), you can withdraw consent at any time without affecting past processing.
- How: email kira@ousios.dev with what you'd like. No form, no hoops.
- Verifying it's you: to protect your data from impostors, we act on requests sent from — or confirmed by — the email address the data concerns. Where that's impossible (a lost mailbox, a quote submitted by someone else), we'll agree a simple alternative proof with you rather than refuse.
- When: we respond within one month, as Art. 12(3) GDPR requires.
- What we'll likely say: for most visitors, honestly, "we hold nothing" — there are no accounts and no visitor database. The exceptions are the newsletter list, intake submissions, and email correspondence, all described above.
- Complaints: you also have the right to lodge a complaint with your local data-protection supervisory authority.
US state privacy laws: Ousios LLC is currently below the applicability thresholds of the CCPA/CPRA, the Colorado Privacy Act, and similar state laws. We honor the rights above for everyone regardless of where you live, and we don't sell or share personal information in any state's sense of those words.
This site is not directed at children under 16 and we do not knowingly collect their data.
Changes
When this policy changes, the date at the top changes with it, and material changes get a plain-language note here. The current version always lives at ousios.dev/privacy — and every prior version is preserved in the site's version history, available on request at kira@ousios.dev, so you can see exactly what changed and when.