What this site knows about you.
Plain-language version. The short answer: as little as possible, and only what the site actually needs to work.
Cookies we set
One locale preference cookie, so the site stays in your language. Allow Google Analytics and it adds two of its own — that is what the banner is for, and it is the only thing on this site that asks. Decline, and the language cookie is the full list: no advertising cookies, and no sign-in cookie either now that the dashboard has moved.
Analytics
There are three analytics tools here, and only one of them asks permission. Two use no cookies at all. Plausible Analytics — EU-hosted, aggregate page counts only. And Vercel Web Analytics, from the platform that serves this site: it stores no IP address and recognises a visitor by a hash of the request that is discarded after 24 hours, so you cannot be followed from one day to the next or from one site to another. Per page view it records the timestamp, the URL, the referring page, an approximate location down to city level, the operating system, the browser and the device type. Neither tool sets a personal identifier, tracks you across sites, or resells anything. Dutch law exempts analytics with that little privacy impact from the consent requirement, so those two run whatever you choose. The third is Google Analytics, the same measurement tag as diazatlas.com, and it does set two cookies. It loads only after you allow it, it is configured without Google Signals and without advertising personalisation, and you can withdraw at the bottom of this page — that takes effect immediately. Separately, server errors are reported to Sentry so I can fix them; that report carries the failing URL and a stack trace, not your IP address or cookies.
The contact form
When you submit the contact form, your name, email, company, sector, message and the page you sent it from are stored in our Supabase database so I can write back. The same details reach me straight away as an email (through Brevo) and as a Telegram message, so I see them without waiting — no copy is kept by either beyond that delivery. Nothing goes to advertising or marketing platforms. If you later want that record deleted, mail me (the address is at the bottom of every page) and it is gone within a working day.
The newsletter
Signing up stores your email address, the page you signed up from, your language, the exact consent sentence you saw next to the button, and a random unsubscribe token. No name, no company, and no record of what you open or click. Every email carries an unsubscribe link at the bottom; one click removes you. Emails are sent through Brevo (EU), which keeps its own delivery logs.
The revenue-leak scan
The scan runs in your browser; nothing is sent until you choose to leave your email. If you do, we store the address, your language, the number of leaks found, the consent sentence you ticked, and an unsubscribe token, in the same Supabase database as the newsletter. You then get at most three emails about those leaks, sent through Brevo, each with an unsubscribe link. That is the whole list: your answers to the individual questions are not stored.
Booking a call
The booking button opens Cal.com, a separate service with its own privacy policy. What you enter there (name, email, chosen slot) lives at Cal.com and in my calendar. When a booking lands, Cal.com tells this site about it so I get a notification; that message contains the same name, email and slot, and is stored in our Supabase database.
Hosting, errors and processors
The site runs on Vercel (servers in Frankfurt). Vercel keeps request logs (IP address, URL, timestamp) for a short period for security and debugging; that is the only place your IP address is written down. Server-side errors go to Sentry with personal data switched off: no IP, no cookies, no form contents. The full list of companies that can touch data you leave here: Vercel (hosting), Supabase (database, EU), Brevo (email, EU), Cal.com (bookings), Telegram (a notification to my phone when you contact me), Plausible (analytics, EU), Vercel Web Analytics, and Google Analytics only if you allow it. Nothing is sold, shared with advertisers, or used to train anything.
Your rights
Under the GDPR, you can ask us for a copy of everything we hold on you, ask us to correct it, or ask us to delete it. Mail info@juandiazllc.com and you will get a response within three working days.
Changes to this page
If we ever start doing something we did not list above, this page changes before that happens. The last update date is visible in the footer.