Privacy Notice

The party responsible for the personal data that reaches me through this site is Carlos Anaya Ruiz, an independent technical SEO and software development consultant operating from Mexico City, Mexico.

One person runs this site. There is no team, no agency and no sales department that receives your data simply because it exists. The channel for anything related to this notice — including ARCO requests — is carlos@carlosanayaweb.com.

This document is the privacy notice required by Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). It describes the processing that actually happens here, not a generic template.

It is worth saying before anything else, because it shapes everything that follows: the contact form does receive what you write. When you submit it, the message travels to this site, and from here it goes to two places:

1. My inbox, delivered by Resend. That is the delivery that counts.
2. A case-management system of my own, so the message gets followed up instead of being lost in an inbox.

A backup copy in a database is also foreseen. If that is connected, it receives the same message for the same purpose — being able to answer you — and for nothing else. Resend and any database provider act as processors: they handle the data on my instruction and to no other end. The section on who else is involved names each one.

What the form cannot do is send what you write anywhere else: the site’s security policy (form-action ‘self’) prevents a form on these pages from pointing at an outside host.

There is also a button that copies my address to your clipboard, if you would rather write to me directly. That happens entirely on your own device.

There are no user accounts, no tracking cookies and no profiling. What there is, is a message that reaches me and is recorded so that I can reply to it. The rest of this notice describes what I do with it.

What you choose to write

The five fields of the form: your name, your email address, what it is about — picked from a list — your site’s URL and your message. The URL is optional; the rest are what I need in order to reply. Two more travel with them that you do not type: which page of the site you sent the form from, and which language you were reading it in. None of this is needed in order to browse the site.

Technical request data

As on any website, the infrastructure serving these pages processes request data — IP address, user agent, requested URL — in order to deliver the page and to measure traffic in aggregate. That measurement uses no cookies and builds no persistent profile of you; the detail is in the cookies section below.

The newsletter, if you subscribe to it

One email address, and nothing else — there is no name field and no tracking pixel. It is entirely optional: nothing on this site requires it and nothing is withheld if you skip it. The address goes to the email provider that sends the newsletter, and it is used for that and for nothing else.

What you receive, and how often. One email per new blog article: two a week, on Tuesdays and Fridays. No promotional sends, nothing from third parties, nothing that is not an article published on this site. The email carries the title, the standfirst and a link — and that link includes campaign parameters (utm_source) so I can see how many people arrive from the newsletter. That is aggregate site analytics, not individual tracking: there is no open pixel and no record of who clicked.

You can unsubscribe from the link in any issue, or by writing to carlos@carlosanayaweb.com. Withdrawing consent removes the address from the list; it does not affect anything else, because there is nothing else.

Where what you write in the form goes

Besides reaching me by email, the contents of the form may be forwarded to a case-management system of my own so the message can be followed up: same data, same purpose — replying to you — and under my responsibility. It is not shared with third parties for unrelated purposes, not sold, and not used for advertising.

If that system ever belongs to an external provider, it acts as a processor: it handles the data on my instruction and for nothing else. You can ask me at any time which providers are involved by writing to carlos@carlosanayaweb.com.

What this site does not collect

There are no user accounts and no sign-up, so no passwords exist. Payment or card data, your phone number, your precise location and sensitive personal data (health, ethnic or racial origin, religious beliefs, political opinions, sexual preference) are never requested. The site also sends a Permissions-Policy header that denies camera, microphone and geolocation at the browser level, so this domain cannot even ask you for them.

I do not address minors: this site speaks to professionals and businesses. If you are a parent or guardian and believe a minor wrote to me, tell me and I will delete the email.

If you include confidential or sensitive information inside your message, you do so on your own initiative. Please do not: email is not an end-to-end encrypted channel. That is what a call and, where needed, a signed non-disclosure agreement are for.

Primary purposes

• Reading your enquiry, answering it and following up.
• If the conversation progresses, preparing and sending you a service proposal.
• Keeping the email thread as a record of what was discussed and agreed.

The newsletter is a separate, consented purpose

Subscribing to the newsletter is a secondary purpose under the LFPDPPP, so it asks for its own consent and it is given by the deliberate act of typing an address and submitting it. It is used to send what I write, and to nothing else — it is not cross-referenced with the emails you send me, it does not feed advertising and the list is not shared.

No other secondary purposes

There is no remarketing and no profiling. And not as a policy I could quietly reverse: the infrastructure to do it does not exist here.

What I never do with your data: I do not sell it, transfer it, trade it, or enrich it against third-party databases. I build no profiles and make no automated decisions that affect you. Writing to me does not subscribe you to the newsletter: that sign-up is separate and you make it yourself. Your message is recorded so it can be followed up; where it ends up is set out above.

You give your consent by submitting the form. This notice tells you beforehand what for: I use what you write in order to reply to you and to follow your message up. For nothing else.

A record of that submission is kept. The email that reaches me carries your address, the date and the fields you filled in, and that email is the evidence that you chose to send it. The case-management system described in the section above holds the same copy.

You can withdraw your consent at any time by writing to carlos@carlosanayaweb.com. Withdrawing it means I delete your message and its thread from my inbox and from the case-management system, and stop using your data, unless I have to keep something to meet a legal or tax obligation or to defend a legal claim.

You can also ask me to limit the use or disclosure of your data without deleting it outright.

Three providers are involved. Each processes the data on my instruction and for nothing else: they are processors, not recipients.

• Vercel — hosts the site and provides the aggregate traffic and performance measurement (Vercel Analytics and Speed Insights).
• Resend — delivers the emails from the form and sends the newsletter. It receives your name, your address and the content of your message, and the address of anyone who subscribes to the list.
• My own case-management system — receives each message from the form so it can be followed up. It is an application of mine, not a third-party service, and it is hosted on Vercel too.

A backup database for form messages is foreseen. Until it is connected it receives nothing; when it is, this notice will name the provider.

What there is not: no advertising pixel, no Google Analytics, no Meta Pixel, no third-party chat widget, no embedded maps and no embedded video. The typefaces are self-hosted at build time, so your browser makes no request to Google Fonts, and every image is served from this same domain.

Transfers outside Mexico

Vercel and Resend both operate global infrastructure, so these pages are served — and your message processed — from servers that may be outside Mexico, typically in the United States. That is a transfer to a processor, which under the LFPDPPP does not require your separate consent: it happens in order to provide the service you asked for, and the processor may not use the data for anything else.

You can ask me for the current detail of any provider by writing to carlos@carlosanayaweb.com.

This site sets no advertising cookies and no third-party tracking cookies. There is no Google Analytics, no Meta Pixel, no remarketing and no identifier shared with anyone.

The only measurement is Vercel Analytics and Vercel Speed Insights. They count visits, page views, referrers and performance metrics (Core Web Vitals) in aggregate, without cookies and without a persistent identifier that follows you between sessions or across sites.

That is why you will not see a cookie consent dialog here: there would be nothing to consent to. A banner asking permission for something that does not happen is compliance theatre, and I would rather say so in this notice than put an obstacle on your first screen. If I ever add a tool that genuinely requires consent, the banner will appear and this notice will say so first.

Nothing is kept in your browser either: the site writes neither to localStorage nor to sessionStorage. It has a single visual theme, so there is not even a preference to remember.

Your message reaches my inbox and my case-management system. Those are the two places, and the periods are the same in both:

• An enquiry that went nowhere: up to 24 months after the last exchange, and sooner if you ask me to delete it.
• A working relationship: for as long as the applicable contractual, tax and accounting obligations require.
• Your address on the newsletter: for as long as you stay subscribed. Unsubscribing removes it from the list.
• Vercel metrics: aggregate and non-identifying, so there is no personal datum of yours there to expire.

Once the period is over, or when you ask for cancellation, I delete the email from the inbox and from the trash and delete the record from the case-management system. Deleting the email alone is not enough.

These are technical and checkable from outside, not a generic promise:

• Only the minimum needed to reply is stored: name, email, subject, site and message. There are no user accounts, so there are no passwords to leak.
• The credentials for the email provider and for the case-management system are server-side only and never reach the browser. You can check that in the inspector: no key appears in the page source.
• All traffic is encrypted in transit over HTTPS/TLS, enforced with HSTS (a two-year max-age, subdomains included).
• A Content Security Policy restricts where the site may load code from and, with form-action ‘self’, stops an injected form from pointing at someone else’s server.
• Permissions-Policy denies camera, microphone and geolocation, and frame-ancestors ‘none’ stops another site from framing these pages.
• The image optimiser accepts no remote hosts, so this domain cannot be used as a proxy for third-party content.

From the inbox onwards, my email provider’s measures apply. No system is infallible: if something happens that materially affects your data, I will tell you by email what I know and what I am doing about it.

The LFPDPPP grants you four rights over your data, known together as ARCO rights:

• Access: knowing what data of yours I hold and what I use it for.
• Rectification: correcting it if it is wrong or incomplete.
• Cancellation: asking me to delete it.
• Opposition: asking me to stop using it for a specific purpose.

You may also withdraw your consent and ask me to limit the use or disclosure of your data.

How to exercise them

Write to carlos@carlosanayaweb.com with ARCO in the subject line and include: the address you wrote to me from (that is what lets me find the thread), which right you want to exercise, and — for rectification — the correct value. I may ask for one additional detail to confirm the request comes from you, such as the approximate date of your message.

In practice: access means forwarding you your message and telling you where it is — my inbox and my case-management system; cancellation means deleting it from both. If you subscribed to the newsletter, I also remove your address from the list.

The process is free and I will answer within the deadlines the LFPDPPP sets. If you believe your request was not handled properly, you can escalate to the competent Mexican federal data protection authority.

If what this site does with data changes — a form that does post to a server, a different provider, a measurement tool that does use cookies — I update this notice and move the last-updated date shown at the top, in the same change that touches the code. The version published here is always the one in force.

Any question about this document goes to the same place: carlos@carlosanayaweb.com.