Privacy

Who is responsible

Daniele Arcuri runs genburn and decides what happens to the data described here (the “controller”, in the words of the GDPR). For anything on this page, write to news@genburn.com.

We do not sell your data, including what you search. The companies listed below receive only what they need to run the site for us. Search words are sent to reading providers as described below.

What we measure, and why

We measure how genburn is used, to see what works and fix what does not. On the site, with PostHog and without cookies: which pages are opened, what is clicked, how far people scroll, where they came from and their country, never the words they type (details under “When you open a page”). In our emails, with Brevo, which sends them: whether each one is opened and which of its links are clicked. We use these numbers to improve the site and the emails, and for nothing else.

To stop it: every weekly letter has a link at the bottom that ends it in one click. To stop all our email and have your address and what we measured about it deleted, write to news@genburn.com. On the site, if your browser sends “Do Not Track” or “Global Privacy Control”, nothing is sent to PostHog at all.

Legal basis: our legitimate interest in knowing whether the site and its emails are useful (GDPR art. 6(1)(f)).

When you open a page

The site runs on Cloudflare. To send you a page, Cloudflare receives your IP address and what your browser says about itself, as every web server does. The fonts come from genburn itself: no other company is asked for anything while a page loads.

To stop anyone copying the site, we count how many pages arrive from your IP address and from your browser, recognised by its type and language. The count is kept in memory for about 60 seconds and never written down.

On the site we record which pages you open; whether a search found a price (not its words); what you click (the name of the button, link or space, and where on the page); how far down you scroll and how long you stay; where you came from (the site that sent you and campaign tags such as utm_source); your country; and your type of device, system, browser and screen size. The words you type are never part of it: they are removed from every address before anything is sent.

To count how many different people visit in a day without a cookie, our server mixes your IP address and browser with a random key that changes every day, and keeps only the scrambled result. The key is deleted the next day, so a visit on one day cannot be linked to a visit on another (our database's automatic safety copies keep it for up to 30 days, and we never use them for this). Your country comes from Cloudflare. Your IP address is never stored and never passed on.

The results go to PostHog, on its European servers, from our server: PostHog never sees your IP address. There is no cookie and nothing is stored in your browser for this.

Legal basis: our legitimate interest in running a fast, safe site and knowing whether it is useful (GDPR art. 6(1)(f)).

When you search

We keep what you typed in the search bar, the day and the time to the minute (UTC), and how it went: whether we found a price. We do not keep your IP address. With low traffic, the phrase and the time together can identify who searched, so please do not type personal details into the search bar.

To check that we read your search the right way, the site sends the words you typed, together with our reading of them, to TypeSafe, which answers whether the two match. It receives no account details or IP address from us.

If our rules cannot fully read a search, we send its words to Anthropic to read it. We store a fingerprint of that search and the resulting reading in our database. When the same search comes again, we use that stored reading instead of sending it to Anthropic again. We limit this reading service to $20 a day. If the limit is reached, or Anthropic does not reply within a few seconds, the page uses the rules alone and tells you.

Legal basis: our legitimate interest in answering the question you asked, and in learning what people look for (GDPR art. 6(1)(f)).

Searches you keep in this browser

If you press “Save this search”, the search and its prices are stored in your own browser (local storage, under “genburn.saved.1”). They never reach us. You can remove them from the page (the × beside each one), or by clearing this site's data in your browser. To know whether that storage works, the site first writes and deletes a test entry (“genburn.probe”).

If you save a project

To save a project we need an email address, and nothing else: no name, no password, no phone. We keep your address, the projects you save (the words you typed and our reading of them), the prices they were made of on each day you opened them, and the day you joined and last came back.

• to sign in we email you a link, which works once and for 15 minutes; it is deleted once used or expired
• signing in sets one cookie, “gb_sessione”, for 30 days or until you sign out. It holds a random key and nothing else, not your email
• the emails you agreed to: the sign-in link, and a note when a price in one of your projects changes
• we write down what you agreed to receive, the exact sentence you ticked and the day, so that we can show it later

Legal basis: the service you ask us for (GDPR art. 6(1)(b)); for the record of what you agreed to, our duty to be able to prove it (art. 7(1) and 6(1)(f)).

The weekly letter

Only if you tick its box, which starts unticked: one email a week with the prices that moved, and none in a week when nothing moved. Every letter has a link at the bottom that stops it in one click, without signing in.

All our emails leave from news@genburn.com through Brevo, which receives your address and the text of the message in order to deliver it. Brevo also records whether each message was opened and which of its links were clicked (see “What we measure”).

Legal basis: your consent, which you can take back at any time (GDPR art. 6(1)(a)).

If you buy a space

Payment happens on Stripe's page. Stripe takes the payment, issues the invoice and handles the tax: your card details go to Stripe and never reach us. For that part, Stripe's own privacy policy applies.

From Stripe we receive your email address and whether the payment went through. We use that address to send you the link to set up your space, and one reminder if the space is still blank after 3 days. The name, line, link and logo you put in the space are shown to everyone who visits, for the days you paid. What the space is and what it costs: Terms.

Legal basis: the contract you enter by paying (GDPR art. 6(1)(b)).

If you write to us or report a price

Email you send to a genburn.com address reaches us through Cloudflare's email routing and is kept in our mailbox. A wrong-price report takes only a link to the vendor's page: we keep the link, and nothing about you.

Legal basis: our legitimate interest in answering you and fixing the prices (GDPR art. 6(1)(f)).

Optional DataFast and DataDash analytics

DataDash is operated by the site owner and hosted on Cloudflare. After explicit consent, it measures public page views and actions, referring domains, sanitized campaign names, country and broad browser/device information. It stores random visitor and session identifiers in appscope:63eee338-95aa-58e2-a7df-f76f7945f36e browser storage; sessions renew after 30 minutes of inactivity. Visitor identifiers remain until consent is withdrawn or browser storage is cleared. Rejecting removes DataDash identifiers and stops collection. Do Not Track and Global Privacy Control prevent collection. No form contents, email addresses, account pages, search queries or card details are sent. When you open a checkout after consent, the first-party genburn_datadash_checkout cookie passes session and campaign context for at most two minutes and is cleared by the server. A verified Stripe payment can then be associated with its source; browser clicks alone are never counted as payments.

We are trying DataFast alongside our existing cookieless measurement. DataFast loads only after you choose “Allow analytics”. It measures visits to public pages, return visits, referring sites, campaign parameters, browser and device information. Its service receives your connection IP address to process analytics. We do not send account pages, search results or the words you type to DataFast. Links containing private parameters are excluded. DataFast payment attribution remains disabled.

Rejecting does not affect the site. Use “Analytics settings” at the bottom of a public page to change your choice. Rejecting after allowing reloads the page to stop tracking, including other open tabs; existing DataFast cookies may remain until they expire. Do Not Track and Global Privacy Control prevent DataFast from loading.

Legal basis: your consent, which you can withdraw at any time (GDPR art. 6(1)(a)).

DataFast privacy policy

• genburn.analytics.2: remembers the analytics choice for 180 days.
• datafast_visitor_id: visitor cookie for up to one year after consent.
• datafast_session_id: session cookie for 30 minutes, renewed during activity.
• datafast_pageview_state: session storage for duplicate-page-view prevention, cleared when the tab closes.

Cookies and browser storage

• “gb_sessione”: a cookie, only after you sign in, for 30 days. It keeps you signed in, which is strictly necessary for what you asked
• “genburn.saved.1”: local storage, only after you press the button, until you remove it. It stays in your browser
• “genburn.probe”: local storage, written and deleted in the same moment

Nothing else. No advertising trackers, and the sponsors' spaces run no code of theirs and learn nothing about you. Stripe sets its own cookies on its payment page.

Who else handles the data

• Cloudflare: hosting, databases, our incoming email
• PostHog, EU servers: how the site is used
• DataFast: optional public-page analytics, only after your consent
• TypeSafe: checks our reading of a search
• Anthropic: reads a search only when our rules cannot fully understand it
• Brevo: sends our emails, and counts which are opened and which links are clicked
• Stripe: takes payments

Each one gets only what its job needs, as described on this page. Stripe also acts on its own account, as the merchant of record of your payment. Some of these companies are based outside the European Union, so your data may be handled there.

How long we keep it

• the count against copying: about 60 seconds, in memory
• sign-in link: 15 minutes, or until used
• sign-in cookie: 30 days, or until you sign out
• searches: the search record holds the words, the day, and the time to the minute (UTC). The reading memory holds a fingerprint of the words and how we read them. Neither holds who typed them. We keep them; if you typed something personal, tell us the words and roughly when and we delete them
• the daily key for counting visitors: deleted the next day
• usage records at PostHog: one year, then PostHog deletes them
• a saved project: until you delete it
• your email address, the record of what you agreed to, and copies of the emails we sent you: until you ask us to delete them. The weekly letter stops as soon as you unsubscribe
• a space you bought (the sale, your email and what the space showed): as long as Italian tax law requires records of a sale to be kept, ten years
• emails you write to us: up to two years after the last message

Your rights

You can ask us to see the data we hold about you, correct it, delete it, limit what we do with it, or have it in a file you can take elsewhere. You can object to what we do on the basis of legitimate interest, and take back any consent at any time; that does not undo what was done before.

Write to news@genburn.com from the address you used with us. We answer within one month. The weekly letter stops from the link at the bottom of any letter, and a project is deleted from its own page.

If you think we got it wrong, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the one where you live or work.

No decision with legal or similar effect on you is taken by a machine here.