Privacy & cookies

Who is responsible

Santiago Santa María Morales, owner of santismm.com. For any question about this policy or to exercise your rights, write to santismm@gmail.com.

Measurement without cookies (always on)

Every request to this site is counted server-side. This processing sets no cookie, creates no cross-site identifier and never stores your IP address: the IP is combined with a secret salt and hashed one way, and only that hash is kept — to approximate how many distinct visitors there were, never to identify anyone.

What is stored: the path requested, the surface (page, API, MCP endpoint), a browser/agent family, the referring site's hostname, the country reported by the hosting provider, and — for AI-agent traffic only — the tools called and the queries sent to the knowledge endpoint. Legal basis: legitimate interest in understanding and improving my own service.

Retention: aggregate daily counters for 200 days; the raw technical log of agent traffic is capped at 50,000 events, roughly 25 days, after which the oldest fall off.

Google Analytics and Google Tag Manager (only with consent)

This site uses Google Tag Manager to load Google Analytics 4. Both run under Google Consent Mode: until you accept, every storage signal is denied, no analytics cookie is written and no advertising identifier is used. If you accept, GA4 sets its own cookies to distinguish sessions; IP anonymisation is enabled.

You can change your mind at any time by clearing this site's data in your browser, which brings the banner back.

Other processors

• Vercel — hosting, plus Vercel Analytics and Speed Insights (aggregate performance and visit metrics, no cookies).
• Upstash Redis — storage for the cookieless measurement described above.
• Substack — if you subscribe to EUREKA, your email address is submitted to Substack, which becomes responsible for that subscription and its own privacy terms.
• Google — Analytics and Tag Manager, only after you consent.

Cookies and local storage

• Language preference — a cookie remembering the language you chose. Essential to serve the site correctly.
• Consent decision — stored in your browser's local storage so you are not asked again.
• Google Analytics — set only after you accept, to distinguish sessions.
• Private dashboard access — a cookie used only by the site owner to reach a private analytics page. Never set for visitors.

Forms

If you write through the speaking-request form, the details you send are used to answer you and nothing else. If you subscribe to EUREKA, the email you type goes to Substack and you confirm the subscription there.

Your rights

You can request access, rectification, erasure, restriction, objection and portability by writing to santismm@gmail.com. Note that the cookieless measurement above stores no data that can be traced back to you, so there is nothing personal in it to retrieve or delete. If you are in the EU and believe your data has been mishandled, you may complain to your national supervisory authority (in Spain, the AEPD).

Changes

If what is collected changes, this page changes with it and the consent request is asked again where the change requires it.