Privacy policy

The short version: I only collect your email (plus proof that you agreed and which link or site brought you) if you choose to subscribe, and analytics (Google Analytics) runs only if you accept cookies. If you decline, no analytics cookies are set. I also keep a simple daily count of how many people arrive through my social-media bio links; it uses no cookies and saves nothing that identifies you.

Who is responsible

H28 is run by Andreas Papadopoulos (self-employed / sole trader), Riga Feraiou 44, Sykies, 56625 Thessaloniki, Greece (the "data controller"). For any privacy request, email info@h28.tech.

What I collect, why, and on what basis

• Your email address - only if you subscribe / request the free PDF. It is stored in my own database (Cloudflare D1), which is the master record, so a signup is never lost. The free PDF is then delivered by an email sent from send.h28.tech through my email-sending provider, Resend, with the PDF as a link; your address is also added to my list in beehiiv for the occasional later email. When you subscribe, I also save how your visit reached H28, so I can see which links and sites bring subscribers: the campaign tags in the link you arrived on (for example "tiktok / social / bio") and just the name of the site that sent you (for example "google.com", never the full page address), or "direct" if neither is known. It is stored with your email in Cloudflare D1 and passed to beehiiv. Unless you accept cookies, it is only kept in the open page while you browse and is never saved in your browser; if you accept, it is also saved in your browser for the current tab only (see Cookies below). Lawful basis: your consent.
• Proof that you consented - at signup I record which version of this consent wording you agreed to, the date and time, and your IP address (stored in my own Cloudflare D1 database). GDPR requires me to be able to show that you gave consent, so I keep this as evidence and use it for nothing else. Lawful basis: compliance with a legal obligation (being able to demonstrate consent).
• Analytics - I use Google Analytics 4 (a Google service). When you accept analytics cookies, it collects usage data (pages viewed, how you arrived on the site, whether you signed up and through which link or site, approximate location derived from your IP, device/browser type) using cookies; I never send it your email address, and the IP is anonymised. It loads only after you accept; if you decline, no analytics cookies are set. Lawful basis: your consent.
• Bio-link visit counts - when you open one of my social-media bio links (h28.tech/365, /ig or /fb), my server adds 1 to a daily total for that link, then sends you on to the free-PDF page. Only the date and the total for each link are kept (for example: 31 October, TikTok bio link, 42 visits). No cookie or other browser storage is used, no script runs for this count, and no IP address, device details or other identifier is saved with these totals, so they cannot identify you. To protect the counter from abuse, Cloudflare briefly uses your IP address to limit how many requests one connection can make in a short time; I do not save it. Lawful basis: legitimate interest (knowing which links bring visitors, and keeping the service secure).
• Server logs - my host (Google Firebase Hosting) keeps basic technical logs (including IP) to deliver the site and keep it secure. Lawful basis: legitimate interest.
• Your IP address at signup - when you submit the form, Cloudflare (which runs the signup service, checks your email domain can receive mail, and passes your signup on) processes your IP to rate-limit abuse and protect the form. The same IP is also kept as part of the proof-of-consent record above. Lawful basis: legitimate interest (protecting the form) and, for the consent record, legal obligation.

Who it is shared with

Only the services that run the site, acting as my processors:

• Cloudflare - runs the signup service and the bio-link visit counter, and stores your email, your consent record and the daily visit totals (Cloudflare D1).
• Resend - sends the delivery email (your free PDF) from send.h28.tech.
• beehiiv - holds the email list for the occasional later email (it no longer sends your PDF), and records whether each email is delivered, opened or clicked, so I can see what readers find useful.
• Google Analytics 4 / Google - analytics.
• Google Firebase Hosting - hosting.

Affiliate partners set their own cookies only after you click through to them - that is covered by their privacy policies, not this one.

International transfers

Some of these providers are based in, or process data in, the United States: Google (Analytics and Firebase), Cloudflare, and Resend. The delivery email can be routed from Resend's EU region (Ireland), but Resend is a US company and may still process some data (such as email logs) in the United States. All these transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

How long I keep it

• Email: until you unsubscribe or ask me to delete it.
• Proof-of-consent record: kept while you are subscribed and for a reasonable period afterwards as evidence that consent was given, and no longer than necessary.
• Unsubscribe record: if you unsubscribe, your signup record is marked do-not-contact so you are never emailed again by mistake. It keeps your email, the proof-of-consent record and how you found H28, and is kept only for as long as needed to honour your choice and to show that consent was given.
• Analytics: per the retention window set in the Google Analytics property (14 months).
• Bio-link visit counts: kept as daily totals only. They contain no personal data, so I may keep them to compare periods over time.

Your rights

Under GDPR you have the right to access, rectify, erase, restrict, object to, and port your data, and to withdraw consent at any time (as easily as you gave it). You can unsubscribe from the link in every email, and change your cookie choice from the "Cookie settings" link in the footer. To exercise any right, email info@h28.tech. You can also lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).

Cookies

• _ga / _ga_<id> (Google Analytics) - analytics - set only after you accept - expires up to ~2 years.
• h28-attr (stored in your browser, current tab only) - remembers which link or site brought you, so a signup can be attributed - set only after you accept - deleted when you close the tab, decline, or open "Cookie settings".
• h28-consent (stored in your browser) - remembers your cookie choice - strictly necessary.

Use "Cookie settings" in the footer to change your choice anytime.

Changes

I may update this policy; the date below shows the last change. Last updated: November 9, 2026.