Privacy Policy

The data controller is Uncharted Territories Inc., 2021 Fillmore Street, 55, San Francisco, CA 94115, USA — a Delaware corporation, the company behind Tomas Pueyo's Uncharted Territories publication. For anything on this page, including exercising your rights, write to david@unchartedterritories.co. A person reads that address.

There are no reader accounts, no comments, no advertising, and we do not sell personal data or share it for advertising of any kind. What we do collect is analytics, so we can see which pages land and which are broken. Through PostHog, on its United States infrastructure, we receive:

• The pages you view and the links or elements you click.
• Approximate location at the country level.
• Standard technical information your browser sends: browser, operating system, device type, screen size, and the referring page.
• Event timestamps and related analytics metadata. PostHog stores an identifier in your browser so repeat visits count as one visitor; we do not use it to work out who you are.

We also run Sentry, an error-monitoring service that records the technical details of crashes and failed requests, which can include IP addresses, so we can fix them. We use all of this to understand how the site is used, improve it, diagnose problems, and protect our systems. Where the GDPR applies, our legal basis is our legitimate interest in understanding, operating, securing, and improving the site, and you can object at any time (see Your rights).

Only team members have accounts, behind Google sign-in restricted to an allowlist of company addresses. There is no public sign-up. What we hold: your name and email from your Google account, and the working record of what you do in the tools — drafts, reviews, approvals, what you published and when. That record is the point of the tools. Analytics for signed-in team members may include your first name so we can tell team traffic from reader traffic. Where the GDPR applies, we process this as necessary for our working relationship with you and for our legitimate interest in running the editorial tools and keeping an accurate record of editorial decisions.

Service providers processing on our instructions under contract: Render (hosting, US), Supabase (database, US), Google Workspace (email, documents, team sign-in), PostHog (analytics, US region), and Sentry (error monitoring). None of them may use the data for their own purposes. When an account owner directs us to publish, we send the approved content and authorization to LinkedIn, which processes it under its own terms and privacy policy. We may also disclose data where reasonably necessary to comply with law or valid legal process, to investigate fraud, abuse, or security incidents, to protect the rights and safety of our team or others, or to establish, exercise, or defend legal claims.

We do not sell personal data, and we do not share it for cross-context behavioral advertising as California law defines that term. The site carries no advertising. Because none of that happens, there is nothing to opt out of. California residents can exercise the access, correction, and deletion rights below at the same address, and we will not treat anyone differently for asking.

We are a US company and we process data in the United States. For personal data from the EU or UK, we and our providers rely on the EU standard contractual clauses, with the UK addendum where applicable, or another lawful transfer mechanism. Write to david@unchartedterritories.co for details of the safeguards that apply to you.

• LinkedIn tokens: until they expire, are revoked, or the account disconnects, whichever comes first.
• Editorial activity records: kept as the history of the content itself, because the record of who approved what is part of the work.
• Publish logs: kept as the operational record of the account owner's own published posts.
• Analytics and error monitoring: held under the providers' retention settings for our account, and only as long as reasonably necessary for the purposes above.
• Everything else: only as long as reasonably necessary, including for security, legal compliance, and resolving disputes.

Access to the internal tools is limited to an allowlist of company Google accounts. LinkedIn tokens are stored server-side and encrypted at rest. Traffic is encrypted in transit. Database access is limited to the people who need it, and operational logging helps us detect and investigate problems. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authorities as the law requires, and if you believe your data or a connection may have been compromised, contact us promptly.

Depending on where you live, you can ask us to give you access to the data we hold about you, correct it, delete it, restrict what we do with it while a question is settled, object to processing based on our legitimate interests (including analytics), give you a portable copy of what you provided, or act on a withdrawal of consent. Write to david@unchartedterritories.co. We answer within one month; where the law permits an extension for complex requests, we tell you within that first month. We may ask you to confirm you control the email address the request concerns, and nothing more. If you think we have handled your data unlawfully you can complain to your data-protection authority; we would rather you wrote to us first so we can fix it, but that is your choice, not a condition.

The site and the tools are not directed to children and we do not knowingly collect children's data. If you believe a child has given us personal data, write to us and we will review and delete it.

We use software, including AI tools, throughout the editorial process. No solely automated decision producing legal or similarly significant effects is made about you.

If we change how we handle personal data, we update this page and the date at the top. Material changes reach anyone with a connected LinkedIn account directly before they take effect.