Polimeme

Who is responsible

Polimeme is operated by Paulo Querido. The contact address for privacy questions and requests is paulo@polimeme.com.

Ordinary visits

For security, reliability and aggregate traffic measurement, the server records the requested route, time, HTTP status, visitor segment, user-agent, referring hostname, approximate country, device and browser. The IP address is used in memory to derive the country and a salted hash that changes every day; the plain IP address is not stored.

These first-party traffic records are kept for up to 90 days. Newsletter redirect clicks are excluded from this log and are counted separately only as aggregate edition, language, link, day and human-or-bot totals.

Accounts and sign-in

If you request a passwordless login link, Polimeme stores your email address, language, hashed login and session tokens, their dates and expiry, and your account tier. Login links expire after 10 minutes and sessions after 30 days. The browser stores the session token, email and expiry in localStorage and receives an HttpOnly session cookie.

On confirmed sign-in, Stripe may receive your email to create the billing customer used for any present or future subscription. Polimeme stores the resulting customer identifier and subscription status; card and payment details are handled by Stripe, not by Polimeme.

Newsletters and plan requests

If you subscribe, Polimeme stores your email, language, chosen cadence, status and relevant dates, plus a delivery record for each edition. Email is sent through Amazon SES. Unsubscribe links are available in every message.

If you submit interest in a paid plan, Polimeme stores the email, plan, currency, billing interval, language and any note you provide. Newsletter click counters never store an email, user id, IP address or user-agent.

Cookies and browser storage

Before sign-in, the optional acknowledgement cookie lasts seven days. A theme choice is kept in localStorage. After sign-in, language and an anonymous first-party identifier may be kept in cookies for up to one year, alongside the session cookie; authentication data remains in localStorage until logout or expiry. These values are used to render preferences, recognise an authenticated session and distinguish aggregate logged-in traffic.

Purposes and legal grounds

Data is used to deliver requested accounts, newsletters and subscriptions; secure and operate the service; prevent abuse; maintain delivery and billing records; and measure aggregate use. Depending on the feature, processing is necessary to provide the requested service, based on consent for optional communications, required by legal obligations, or supported by the legitimate interest in security and reliable aggregate operation.

Providing an email address is optional, but without it Polimeme cannot create an account, send a newsletter or arrange billing. Newsletter consent can be withdrawn at any time through the unsubscribe link; withdrawal does not affect processing that already took place. Polimeme does not use account or traffic data for automated decisions with legal or similarly significant effects, or for direct-marketing profiling.

Retention, recipients and rights

Traffic logs are deleted after 90 days. Account, newsletter, delivery, plan-interest and billing records are kept while needed to provide the service, honour unsubscribe and billing history, meet legal obligations or resolve disputes. You may request access, correction, erasure, restriction, portability or object to processing, and you may complain to the Portuguese data-protection authority.

Service providers receive only what is needed for their role: Amazon SES for email delivery and Stripe for billing. Where those providers process data outside the European Economic Area, their data-processing terms use the applicable transfer mechanisms, including European Commission Standard Contractual Clauses. You may ask Polimeme for further information about these safeguards. Requests are assessed against applicable legal and record-keeping obligations.