Draft — not ready to publish. These fields in lib/legalConfig.ts still hold placeholders: ownerName, ownerTaxId, ownerAddress, ownerCity, contactEmail, databaseRegion.

Privacy Policy

How your personal data is handled on thecompounderscore.com, in line with the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

Last updated: 6 October 2026

Contents (12 sections)

At a glance
Who is responsible for your data
What data I use, why, and for how long
Where your data comes from
Who receives your data
Payments
International transfers
Your rights
Security
Children
Third-party content and links
Changes to this policy

1. At a glance

This is a short summary. The sections below give the full detail.

Who is responsible

Summary

[FULL LEGAL NAME], an individual (no company). Contact: [CONTACT EMAIL, e.g. hello@thecompounderscore.com].

Why I use your data

Summary

To run the website and keep it secure, manage accounts and paid subscriptions, take payments and issue invoices, answer your messages, and send updates you asked for.

Legal basis

Summary

Contract, legal obligations (tax and accounting), my legitimate interests (security, fraud prevention) and, for optional things like marketing emails, your consent.

Who receives it

Summary

Only the service providers needed to run the site and take payments (hosting, database, payment processor, newsletter platform) and authorities where the law requires it. I never sell your data.

Your rights

Summary

Access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You can also complain to the Spanish data protection authority (AEPD).

Topic	Summary
Who is responsible	[FULL LEGAL NAME], an individual (no company). Contact: [CONTACT EMAIL, e.g. hello@thecompounderscore.com].
Why I use your data	To run the website and keep it secure, manage accounts and paid subscriptions, take payments and issue invoices, answer your messages, and send updates you asked for.
Legal basis	Contract, legal obligations (tax and accounting), my legitimate interests (security, fraud prevention) and, for optional things like marketing emails, your consent.
Who receives it	Only the service providers needed to run the site and take payments (hosting, database, payment processor, newsletter platform) and authorities where the law requires it. I never sell your data.
Your rights	Access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You can also complain to the Spanish data protection authority (AEPD).

2. Who is responsible for your data

The data controller is [FULL LEGAL NAME], tax ID [NIF / NIE], with address at [STREET, POSTAL CODE, CITY, COUNTRY]. This website is run by an individual in a personal capacity; there is no company behind it. Contact for any privacy matter: [CONTACT EMAIL, e.g. hello@thecompounderscore.com].

I have not appointed a Data Protection Officer because the law does not require one for this kind of activity.

3. What data I use, why, and for how long

Running and securing the website

Data

IP address, browser and device type, pages requested, date and time

Legal basis (GDPR)

Legitimate interest (Art. 6.1.f): keeping the site working and secure

How long

Only as long as the hosting provider keeps its server logs (usually short); longer only to investigate an abuse or security incident

Accounts and access to paid content

Data

Email, name (if you give it), login identifiers, subscription status. Your email is also passed to Substack to grant the access to the paid publication that your subscription includes

Legal basis (GDPR)

Contract (Art. 6.1.b)

How long

While your account is open

Purchases and billing

Data

Name, billing address and country, tax or VAT ID if you provide one, email, order or transaction ID, amount, date, payment status, card brand and last four digits (supplied by the processor)

Legal basis (GDPR)

Contract (Art. 6.1.b) and legal obligation (Art. 6.1.c): tax and accounting law

How long

For the period tax and accounting law requires, in Spain generally between four and six years

Fraud prevention, chargebacks and legal claims

Data

Transaction and account data

Legal basis (GDPR)

Legitimate interest (Art. 6.1.f)

How long

Until resolved, then only while legal claims could still arise

Answering your messages and support requests

Data

Your email address and the content of your message

Legal basis (GDPR)

Steps prior to a contract and legitimate interest (Art. 6.1.b and 6.1.f)

How long

Until your request is resolved, then only while claims could still arise

Review requests and notifications on the site

Data

Your email address (if you give it) and the company ticker you chose

Legal basis (GDPR)

Your consent (Art. 6.1.a) or, to handle your request, legitimate interest

How long

Until the request is fulfilled or you ask me to delete it

Newsletter and updates

Data

Your email address, the date you signed up and the consent notice you were shown

Legal basis (GDPR)

Your consent (Art. 6.1.a; Art. 21 of Spanish Law 34/2002)

How long

Until you unsubscribe. A sign-up made on this website is first stored in my database and later added to the Substack mailing list, which sends the newsletter and keeps its own records under its own policy

Purpose	Data	Legal basis (GDPR)	How long
Running and securing the website	IP address, browser and device type, pages requested, date and time	Legitimate interest (Art. 6.1.f): keeping the site working and secure	Only as long as the hosting provider keeps its server logs (usually short); longer only to investigate an abuse or security incident
Accounts and access to paid content	Email, name (if you give it), login identifiers, subscription status. Your email is also passed to Substack to grant the access to the paid publication that your subscription includes	Contract (Art. 6.1.b)	While your account is open
Purchases and billing	Name, billing address and country, tax or VAT ID if you provide one, email, order or transaction ID, amount, date, payment status, card brand and last four digits (supplied by the processor)	Contract (Art. 6.1.b) and legal obligation (Art. 6.1.c): tax and accounting law	For the period tax and accounting law requires, in Spain generally between four and six years
Fraud prevention, chargebacks and legal claims	Transaction and account data	Legitimate interest (Art. 6.1.f)	Until resolved, then only while legal claims could still arise
Answering your messages and support requests	Your email address and the content of your message	Steps prior to a contract and legitimate interest (Art. 6.1.b and 6.1.f)	Until your request is resolved, then only while claims could still arise
Review requests and notifications on the site	Your email address (if you give it) and the company ticker you chose	Your consent (Art. 6.1.a) or, to handle your request, legitimate interest	Until the request is fulfilled or you ask me to delete it
Newsletter and updates	Your email address, the date you signed up and the consent notice you were shown	Your consent (Art. 6.1.a; Art. 21 of Spanish Law 34/2002)	Until you unsubscribe. A sign-up made on this website is first stored in my database and later added to the Substack mailing list, which sends the newsletter and keeps its own records under its own policy

Giving me your data is voluntary, but without the data marked as needed for an account or a purchase I cannot provide that account or sell you a subscription. Settings stored in your browser, such as your currency choice, stay on your device and are covered by the Cookies Policy.

4. Where your data comes from

Mostly from you (when you create an account, buy, subscribe or write to me), automatically from your browser when you visit the site, and from the payment processor, which tells me whether a payment succeeded and sends the billing details needed for the invoice.

5. Who receives your data

I only share data with providers that help me run the service, under data processing agreements where required (Art. 28 GDPR):

Hosting and delivery of the website (Vercel Inc.).
Database and authentication (Supabase), with data stored in [SUPABASE REGION].
Payment processing (Stripe Payments Europe, Ltd.). See section 6.
Substack, which receives the email address you subscribed with so that your subscription also gives you access to the paid publication, and which sends the newsletter: email addresses signed up on this website are added to its mailing list.
Accountants or tax advisers, where needed to meet my tax and accounting duties.
Courts, public authorities and regulators, only when the law requires it.

I do not sell your personal data, I do not use it for advertising profiling, and I do not make decisions about you by automated means that have legal or similarly significant effects.

6. Payments

Card and other payment details are entered directly with Stripe Payments Europe, Ltd.. I never see or store your full card number. The processor handles the payment on my behalf and also acts as an independent controller for its own fraud-prevention and regulatory obligations. Its privacy policy is available at https://stripe.com/privacy.

7. International transfers

Some providers are based in, or operate from, countries outside the European Economic Area, notably the United States. Where your data is transferred there, the transfer relies on an adequacy decision (for example the EU–US Data Privacy Framework, for certified providers) or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask me for details using the contact address above.

8. Your rights

Access: ask whether I process data about you and receive a copy.
Rectification: have inaccurate or incomplete data corrected.
Erasure: ask me to delete your data when it is no longer needed or you withdraw consent, unless I must keep it by law.
Restriction: ask me to limit how I use your data in certain cases.
Portability: receive the data you gave me in a structured, commonly used format.
Objection: object to processing based on legitimate interest.
Withdraw consent at any time, without affecting what was done before.

To exercise a right, write to [CONTACT EMAIL, e.g. hello@thecompounderscore.com]. I may ask you to confirm your identity. I will answer within one month, which can be extended by two further months for complex requests, and it is free unless a request is clearly unfounded or excessive. If you think I have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or to the authority in your own country of residence.

9. Security

I use encrypted connections (HTTPS), access controls limited to what is necessary, and providers with recognised security practices. No system is completely secure; if a breach affects your rights and freedoms, I will notify you and the authority as the law requires.

10. Children

This website is intended for adults. It is not directed at anyone under 18 and I do not knowingly collect data from minors. If you believe a minor has given me personal data, contact me and I will delete it.

11. Third-party content and links

Some images, such as company logos, may be loaded from third-party servers, which can see your IP address and browser details when your browser requests them. The site also links to other services, such as Substack and YouTube. Those services have their own privacy policies and I am not responsible for them. See also the Cookies Policy.

12. Changes to this policy

I may update this policy, for example when I add features or providers. The date at the top shows the latest version. I will tell you about material changes by email or with a notice on the site.

Questions?

Write to [CONTACT EMAIL, e.g. hello@thecompounderscore.com].