Privacy notice

Last updated: 1 November 2026.

Who is responsible for your data

I'm José Sosa, a sole trader based in Bari, Italy. P.IVA 08960590720. I run this site and decide how its data is used, so I'm the data controller.

You can reach me at founder@cvss-associates.com.

What I collect

When you open the homepage, press Buy or press Pay, I count it. For each count I store:

• the time, and what happened (a visit, a Buy click or a Pay click)
• which of my domains you were on, and the page
• where you came from: the campaign tag in the link, or the website that linked you, or "direct"
• the plan shown at checkout
• your country, as worked out by my hosting provider
• whether you're a person or a known bot or crawler, worked out from your browser's description of itself. I keep only that label, not the description.
• whether a Pay click looks real, based on whether it was a real click and how long you'd been on the page

I don't store your IP address.

My hosting provider processes your IP address to deliver the page and work out your country. I don't receive or store it.

My site reads your browser's description of itself (its user agent) to tell bots from people. It isn't stored. Only the person-or-bot label is kept.

If you ask for updates, I store your email address. Nothing else you type is sent to me.

If you email me, I get your email address and whatever you write.

Cookies and tracking

This site sets no cookies. There are no ads, no analytics scripts and no tracking pixels. The counts above are made by my own site: some when your browser asks for a page, and some by my own small script, sent to my own site.

Why, and on what legal basis

I count visits and clicks to understand interest in the offer and improve the site, and to tell people apart from bots. That's my legitimate interest (art. 6(1)(f) GDPR). The counts aren't meant to identify you, and I don't try to. I think that's a fair balance.

If you email me, I use your message to answer you. That's my legitimate interest in replying to people who contact me (art. 6(1)(f) GDPR).

How long I keep it

The counts are anonymous statistics, so I keep them.

I keep emails for up to 12 months after our last exchange, unless I need them for a legal claim.

Updates by email

After you press Pay, I ask if you'd like updates about Surface by email. If you press "Email me" (shown with "Get updates about Surface. Unsubscribe any time."), I use the email address you typed at checkout. If you don't press it, or you close the page, nothing is sent.

I store your email address encrypted, with a record of your consent: when you gave it, on which form, which version of this notice you saw, and the button text you pressed. I don't store your IP address with it.

Cloudflare runs an invisible bot check (Turnstile) on that form.

The legal basis is your consent (art. 6(1)(a) GDPR). You can withdraw it as easily as you gave it: email me any time and I'll unsubscribe you.

I keep your email until you unsubscribe. If I stop working on Surface, I'll delete the list.

If you unsubscribe, I keep only a one-way code (a hash) of your address, so I never email you again. You can ask me to delete that too.

Who else handles it

• My hosting and infrastructure provider, which runs the site and stores the counts.
• My email provider, if you write to me.

I don't sell your data or share it with anyone else.

Transfers outside the EU

My hosting and email providers may process data in the US. Those transfers are covered by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Your rights

You can ask me to see, correct or delete your data, to limit how I use it, or to get a copy. You can also object at any time to how I use it, since I rely on my legitimate interest. Just email me. I'll reply within one month.

The counts aren't meant to identify you, so I may not be able to find yours.

Complaints

If you think I've mishandled your data, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority where you live or work.

Terms and refunds

See the Terms of sale and licence.

Changes

I may update this notice. The current version is always on this page.

Contact

José Sosa · Bari, Italy · founder@cvss-associates.com