How SeeIndie handles your data — what's collected, the services used, transfers outside the EU, and your rights. No ads, no trackers by default.
Last updated: 29 September 2026 · Controller: Isabella-Viktoria Quilez
This page explains what personal data SeeIndie processes, why, and on what legal basis — and the rights you have over it. It applies to seeindie.com and to our profiles on other platforms. In keeping with how the rest of the site works: plain language first, the formal detail underneath.
The short version. SeeIndie is a small, one-person publication. There are no ads, no affiliate links and no advertising trackers. Analytics that use cookies or session recordings (Microsoft Clarity, Google Analytics) only run after you consent. The data that is processed is the ordinary minimum needed to serve pages, run the newsletter, answer messages and keep the site secure — nothing is sold, ever.
At a glance
Run by Isabella-Viktoria Quilez (contact and Impressum below).
Always processed: your IP address and server log data, so pages load and stay secure.
Only with consent: analytics (Microsoft Clarity and Google Analytics) and embedded YouTube videos.
If you choose to: newsletter sign-up and the contact form.
Your rights: access, correction, deletion, portability, objection, and a complaint to a supervisory authority.
As the controller, this is the person who decides why and how your personal data is processed. This notice serves both the EU GDPR and the Swiss FADP; for readability the GDPR's terms are used throughout, but the FADP's meanings still apply within its scope.
What's processed, and why
Depending on how you use the site, the following categories of data may be processed:
Category
Examples
Why
Usage data
Pages viewed, time on page, device and browser type
Provide the site; understand what's useful (cookie-free page statistics for every visit; Clarity and Google Analytics only after consent)
Log data
IP address, access times, requested files, referrer
Deliver pages; keep the server stable and secure
Contact data
Email address, and any name you give
Reply to messages; send the newsletter you asked for
Content data
The text of a message you send
Handle your enquiry
Meta / comms data
Timestamps, identifiers
Security, and proof that consent was given
Legal bases (GDPR)
Processing rests on one of these, named again at each service below:
Consent — Art. 6(1)(a): analytics, embedded YouTube, and the newsletter.
Contract / pre-contract — Art. 6(1)(b): handling a request you send us.
Legal obligation — Art. 6(1)(c): where the law requires retention.
Legitimate interests — Art. 6(1)(f): secure hosting, spam defence, running the site, delivering fonts, scripts and images, and cookie-free page statistics. In Germany the Federal Data Protection Act (BDSG) applies alongside the GDPR.
Cookies & consent
Cookies store and read small pieces of information on your device. SeeIndie uses them sparingly. Where consent is legally required — for anything beyond what's strictly necessary — it's requested first through a consent banner and can be withdrawn at any time. Where consent isn't needed (for example, keeping the site functional and secure), the basis is our legitimate interest. Session cookies clear when you close your browser; any permanent cookies last up to two years unless stated otherwise. You can also clear or block cookies in your browser settings.
Your choice in the consent banner is stored only in your browser (local storage, entry seeindie_consent_v1) and is not sent to us or to anyone else. Member accounts and Ghost page statistics are no longer used on this website.
Withdrawing consent. You can change or withdraw your consent at any time via the “Cookie settings” link in the footer of every page, with effect for the future. Withdrawing stops Clarity and Google Analytics from loading again.
Services we use
Each item names what it does, who provides it, the legal basis, and — where relevant — the basis for any transfer outside the EU. The DPF is the EU–US Data Privacy Framework; SCCs are the EU's Standard Contractual Clauses.
Hosting & delivery — Cloudflare
seeindie.com and its uploaded images are hosted and delivered through Cloudflare Workers and Static Assets. Cloudflare processes technical request data, including IP addresses, requested URLs, timestamps and browser information, to deliver the website and protect it from abuse. Provider: Cloudflare, Inc. Processing can take place across its global network, including outside the EU. Legal basis: legitimate interests in providing a secure, reliable website, Art. 6(1)(f) GDPR. Cloudflare privacy policy.
Contact form — Formspree
Messages sent through the contact form are processed to answer and handle your request (typically your email, message, and any name). Delivery is handled by Formspree, which receives the form data plus technical metadata (IP address, time of submission) and forwards it to us by email, also using it for spam protection. Formspree acts as a processor under a data processing agreement, on servers in the USA. Provider: Formspree, Inc., San Antonio, Texas, USA. Legal basis: contract / pre-contract, Art. 6(1)(b), and legitimate interests, Art. 6(1)(f). Transfer basis: SCCs. Formspree privacy policy.
Analytics — Microsoft Clarity
Clarity helps understand how the site is used (heatmaps and session recordings of mouse movement, clicks, scrolling and interactions) so usability can be improved. It runs on a pseudonymous identifier and isn't used to identify you personally — and it only loads after you consent. Provider: Microsoft Corporation, Redmond, WA, USA (EU entity: Microsoft Ireland Operations Ltd). Legal basis: consent, Art. 6(1)(a). Transfer basis: DPF and SCCs. Microsoft privacy statement.
Analytics — Google Analytics 4
Google Analytics 4 (measurement ID G-WJ87PXS27T) counts visits and shows which pages are useful, how people arrived and roughly where they are, so the site can be improved. It works with a pseudonymous identifier stored on your device and is not used to identify you personally — and, like Clarity, it only loads once you have enabled analytics in the consent banner. Until then Google Consent Mode keeps analytics storage denied, so nothing is stored or sent. IP addresses are used only to derive a coarse location and are not stored by Google Analytics; advertising features, ad personalisation and Google Signals are not enabled, and ad storage stays denied at all times. Provider: Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (parent: Google LLC, USA). Legal basis: consent, Art. 6(1)(a). Transfer basis: DPF and SCCs. Retention: event and user-level data is kept for a maximum of 14 months; aggregated reports remain available longer. Google privacy policy.
Fonts — Bunny Fonts
Fonts are delivered by Bunny Fonts, a privacy-friendly alternative to Google Fonts. Your IP address is technically transmitted so the font can be delivered to your browser. According to the provider, Bunny Fonts doesn't log or store IP addresses, set cookies, or track end users, and its servers are in the EU (no third-country transfer). Provider: BunnyWay d.o.o., Ljubljana, Slovenia. Legal basis: legitimate interests, Art. 6(1)(f). Bunny privacy policy.
Scripts — jsDelivr
Some interactive tools may load supporting scripts from jsDelivr. Requests transmit your IP address and technical access data to the CDN. Member sign-in and Ghost search are no longer used. jsDelivr privacy policy.
Images — Unsplash
Some cover images are stock photos loaded directly from Unsplash. When such a page or article list is shown, your browser requests the image from Unsplash's servers, which transmits your IP address and technical access data (browser, time, referring page). Delivery may take place outside the EU. Provider: Unsplash Inc. Legal basis: legitimate interests, Art. 6(1)(f), in showing images without hosting every file ourselves. Unsplash privacy policy.
Embedded video — YouTube (click-to-load)
Where a video is embedded, only a preview loads first; YouTube's player — and any connection to its servers — loads only after you click it. Videos use YouTube's extended privacy mode (youtube-nocookie). When the player loads, your IP address and technical data are sent to the provider and cookies may be set. A visible thumbnail may transmit your IP to YouTube on page load. Provider: Google Ireland Ltd, Dublin, Ireland (parent: Google LLC, USA). Legal basis: consent, Art. 6(1)(a). Transfer basis: DPF.
Social profiles
SeeIndie maintains profiles on Bluesky, X, LinkedIn, Threads, Instagram, TikTok and YouTube to share information and communicate. The site only links to them; nothing from these networks is loaded on seeindie.com. Where a network gives us statistics about our profile (for example Instagram, Threads or LinkedIn page insights), we and the network may be jointly responsible for that processing (Art. 26 GDPR); the network's own terms on joint responsibility apply. If you interact with these, the network processes your data under its own policy, and this may happen outside the EU. Requests about that data are best made directly to the network, which alone can access it. Bluesky: Bluesky PBLLC, Seattle, USA — privacy policy. X: X Internet Unlimited Company, Dublin, Ireland — privacy policy. LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland — privacy policy. Threads and Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland — privacy policy. TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland — privacy policy. YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — privacy policy. Legal basis: legitimate interests, Art. 6(1)(f). Transfer basis (where data leaves the EU): DPF and/or SCCs, as set out by each network.
Data outside the EU
Where data reaches a country outside the EU/EEA (mainly the USA, via the services above), it happens on a lawful basis. For US transfers we rely first on the Data Privacy Framework — recognised as adequate by the EU Commission in July 2023 — backed by Standard Contractual Clauses as a fallback, so protection holds even if the framework changes. Each service above notes which basis applies to it.
How long we keep data
Data is deleted once its purpose is met or consent is withdrawn, unless the law requires it kept longer (for example, tax or evidentiary reasons). Where several periods apply, the longest wins. Specific rules noted above: server logs up to 30 days; unsubscribed newsletter addresses up to three years to prove consent; Google Analytics event data up to 14 months. Your consent choice stays in your browser until you change it or clear your browser data.
Your rights
Under the GDPR (Art. 15–21) you can exercise the following at any time — just email the address above.
Right
What it means
Access
Confirm whether your data is processed, and get a copy.
Rectification
Have inaccurate data corrected or completed.
Erasure & restriction
Have data deleted, or its processing restricted, where the law allows.
Portability
Receive data you provided in a common, machine-readable format.
Objection
Object to processing based on legitimate interests, including profiling; and object to direct marketing at any time.
Withdraw consent
Withdraw any consent, with effect for the future.
Complaint
Lodge a complaint with a supervisory authority, e.g. where you live or work.
Security
Appropriate technical and organisational measures protect your data's confidentiality, integrity and availability. All traffic is encrypted in transit with TLS/SSL (shown as https:// in your browser), and data protection is considered by design and by default.
Changes to this policy
This notice is updated whenever changes to how data is processed make it necessary. Where a change needs something from you (such as fresh consent), you'll be informed. Please check the “last updated” date at the top from time to time.
No. There are no ads, no affiliate links and no advertising trackers. Clarity and Google Analytics only run after you consent. Nothing is sold, ever.
What gets processed even if I consent to nothing?
Your IP address and server log data — access times, requested files, referrer — so pages load and the server stays stable and secure. Server logs are kept for up to 30 days. Fonts, scripts and some images come from Bunny Fonts, jsDelivr and Unsplash, which see your IP address.
What only runs if I consent?
Analytics (Microsoft Clarity and Google Analytics) and embedded YouTube videos. The contact form only processes data if you choose to use it. Newsletter signup is currently unavailable.
Does my data leave the EU?
It can — mainly to the USA, via the services listed on this page. Those transfers rely first on the EU–US Data Privacy Framework, recognised as adequate by the EU Commission in July 2023, backed by Standard Contractual Clauses as a fallback, so protection holds even if the framework changes.
How do I get my data deleted, or withdraw consent?
Email the address on this page. You have rights of access, rectification, erasure and restriction, portability, objection, and withdrawal of consent with effect for the future, plus the right to complain to a supervisory authority. Consent can also be changed or withdrawn at any time via the “Cookie settings” link in the footer.