Effective date: 27 September 2026
This policy explains what personal data is processed when you use paranoidandready.com (the "site"), why, on what legal basis, for how long, who receives it, and what rights you have.
1. Who is responsible for your data
The site is run under the name Paranoid and Ready from Lisbon, Portugal ("we", "us"). We are the controller of the personal data described in this policy within the meaning of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR").
For any question about your data or to exercise your rights, write to hello@paranoidandready.com.
We have not appointed a data protection officer, as the law does not require one for an operation of this kind.
2. Summary
- We collect only the personal data the site needs to work, to answer you, and to meet our legal obligations.
- We do not sell personal data, and we do not use it for profiling or for decisions made solely by automated means.
- We do not use advertising cookies or cross-site tracking.
- Our visitor statistics use no cookies and do not identify you.
- You may ask to see, correct or delete your data at any time.
3. What we process and why
Visiting the site
When you open a page, your browser automatically sends technical data: your IP address, the date and time of the request, the page requested, the page you came from, your browser and operating system, and your device type.
- Purpose: to deliver the site to you, keep it secure, and protect it against attacks, abuse and errors.
- Legal basis: our legitimate interest in operating a secure and working website (Article 6(1)(f) GDPR).
- Retention: we do not keep server logs ourselves. Our hosting and security provider keeps security logs for a limited period, after which they are deleted or anonymised.
Visitor statistics
We use Cloudflare Web Analytics to count visits and see which pages are read. It does not use cookies, does not store data on your device, does not use fingerprinting, and does not follow you across other websites. It records the page viewed, the referring page, your country (derived from your IP address, which is not stored), your browser and device type, and how fast the page loaded.
- Purpose: to understand which content is useful and to keep the site fast.
- Legal basis: our legitimate interest in improving the site (Article 6(1)(f) GDPR).
- Retention: the statistics are aggregated and do not allow us to identify you.
Fonts
The site loads its fonts from Google Fonts, a service of Google Ireland Limited. To deliver the font files, Google receives your IP address and basic browser information. Google states that the service does not set cookies and that the data is not used for advertising.
- Purpose: to display the site as designed on every device.
- Legal basis: our legitimate interest in a consistent presentation (Article 6(1)(f) GDPR).
When you contact us
If you write to us, we receive your name, your email address, your message and anything else you choose to include.
- Purpose: to read and answer your message and deal with your request.
- Legal basis: our legitimate interest in answering the people who write to us (Article 6(1)(f) GDPR); where your message concerns a purchase, the performance of a contract (Article 6(1)(b) GDPR).
- Retention: for as long as needed to deal with your request, and then for up to two years in case of follow-up questions or legal claims.
Our email is handled by an email service provider that processes messages on our behalf.
Affiliate links
Some links on the site are affiliate links. When you click one, you leave the site, and the retailer or partner receives the information that you came from us. The partner usually places its own cookie in your browser so that a purchase can be credited to us. We do not receive your name, your address or what you personally bought: we receive only aggregated reports of clicks and qualifying sales. The partner is responsible for the data it collects on its own website, under its own privacy policy.
Paranoid and Ready is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com. Third parties, including Amazon and other advertisers, may serve content and advertisements, collect information directly from visitors, and place or recognise cookies on visitors' browsers.
- Legal basis: our legitimate interest in financing the site through commissions (Article 6(1)(f) GDPR).
Buying a digital product
Our digital products are sold through Gumroad, which runs the checkout, takes the payment and handles sales taxes. Gumroad processes your payment details under its own privacy policy; we never see your card details. We receive your name, email address, country, the product bought and the date of purchase.
- Purpose: to deliver the product, answer your questions, handle refunds and keep the records the law requires.
- Legal basis: the performance of our contract with you (Article 6(1)(b) GDPR) and our legal obligations under tax and accounting law (Article 6(1)(c) GDPR).
- Retention: for the period required by tax and accounting law, currently up to ten years, and otherwise for up to three years after your purchase.
4. Who receives your data
We share personal data only where needed for the purposes above, and only with:
- our hosting, security and content delivery provider;
- our email service provider;
- our statistics provider;
- our font provider, as described above;
- our checkout provider;
- affiliate partners, only to the extent described under "Affiliate links";
- professional advisers, and public authorities where the law requires it.
Service providers that process data on our behalf do so under a contract that obliges them to follow our instructions and protect the data (Article 28 GDPR). We do not sell or rent personal data. If you ask, we will tell you the names of the specific recipients of your data.
5. Transfers outside the European Economic Area
Some of our providers are based in, or process data in, countries outside the European Economic Area, including the United States. Where the European Commission has not recognised a country as providing adequate protection, the transfer takes place under the EU-US Data Privacy Framework for certified recipients, or under the standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR). You may ask us for more information about these safeguards.
6. Cookies and storage on your device
We do not place cookies on your device, and we do not use cookies for statistics or advertising. For that reason the site shows no cookie banner.
If you close the Action Plan bar, the site stores a small note in your browser's local storage so that it stays closed on your next visit. Nothing is stored until you close it, the note contains no personal data, and it is never sent to us. You can remove it by clearing your browser's site data.
Other websites may place their own cookies when you follow a link to them, as described above. You can block or delete cookies in your browser settings.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy of it;
- have inaccurate data corrected and incomplete data completed;
- have your data erased, where there is no longer a reason for us to keep it;
- restrict our processing, for example while you contest its accuracy;
- receive data you gave us in a structured, machine-readable format and have it transferred to someone else, where the processing is based on consent or a contract;
- object to processing based on our legitimate interests, on grounds relating to your particular situation, and at any time to processing for direct marketing;
- withdraw your consent at any time, where processing is based on consent. This does not affect the lawfulness of processing before the withdrawal.
To exercise any of these rights, write to hello@paranoidandready.com. We may ask you to confirm your identity. We will reply within one month of receiving your request. Where a request is complex, this period may be extended by two further months, and we will tell you so within the first month. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you believe the infringement took place. The authority in the country from which we operate is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. We would appreciate the chance to address your concern first.
8. Whether you have to give us your data
The technical data sent by your browser is needed to deliver the site. We need your email address to answer you. The data requested at checkout is needed to conclude and perform the contract; without it we cannot fulfil your order. Everything else you give us is voluntary.
9. Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
10. Children
The site is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, write to us and we will delete it.
11. Security
The site is served only over an encrypted connection (HTTPS). Access to personal data is limited to what each purpose requires, and we choose providers that apply appropriate technical and organisational security measures.
12. Visitors from the United States
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act. The site does not track visitors across third-party websites, so it treats every visitor the same whether or not the browser sends a "Do Not Track" signal.
13. Changes to this policy
We may update this policy when our services or the law change. The effective date at the top shows when it was last changed. Where a change is significant, we will say so on the site.
14. Contact
Paranoid and Ready, Lisbon, Portugal. Email: hello@paranoidandready.com.