Privacy Policy
Last updated: 29 July 2026
1. Who is responsible for your data
This website is run by Nico Burkart, a sole trader based in Spain. For the purposes of the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD), I am the data controller for the personal data described below.
- Controller: Nico Burkart
- Email: contact@nicoburkart.com
I am not required to appoint a Data Protection Officer, so privacy requests come to me directly at the email above.
2. What this site does
nicoburkart.com is a small personal site with two purposes: it offers a free pre-launch checklist in exchange for an email subscription, and it lets you book a free 30-minute discovery call with me. There is nothing to log into and nothing to pay for, so the amount of personal data involved is deliberately small.
3. What I collect
What I do not collect
- No user accounts, passwords, or login credentials.
- No payment or card details. Nothing on this site is for sale.
- No contact lists, address books, or uploaded files.
- No precise location data, and no advertising or cross-site tracking pixels.
- No special-category data (health, beliefs, biometrics) is ever requested.
Newsletter signup
When you request the checklist, I collect the email address you type in. Alongside it, my server records the campaign parameters in the link you arrived through (utm_source, utm_medium, utm_campaign, utm_content) and the referring website, if any, so I can tell which content actually helps people. Your email address is passed to Beehiiv, which stores your subscription and sends you the checklist and future emails. Every email includes a one-click unsubscribe link.
Booking a discovery call
The booking calendar on the audit page is an embedded Cal.com scheduling page. When you book, you give Cal.com your name, email address, chosen time slot, time zone, and whatever you write in the notes field; Cal.com passes that booking to me and to my connected calendar. Loading that page also means your browser contacts Cal.com directly, which means Cal.com receives your IP address and browser details, and may set its own cookies. Cal.com's own privacy policy applies to that connection in addition to this one.
Analytics and performance
I use PostHog to understand how the site is used: pages viewed, referrer, device and browser type, clicks on the signup form, whether a signup or booking succeeded, and Core Web Vitals performance measurements. PostHog runs here in cookieless mode — it stores nothing at all on your device, so there is no analytics banner to accept or decline. In place of an identifier saved in your browser, PostHog derives a visitor code on its own servers by hashing a salt that rotates every day together with your IP address, your browser's user agent, and this site's hostname. Because the salt changes daily, a return visit on a later day is counted as a new visitor rather than linked to your earlier ones. I do not upload your email address to PostHog, and I do not attempt to identify you personally from analytics.
Alongside it I use Vercel Web Analytics and Vercel Speed Insights, which count page views and measure how quickly pages load. Both also store nothing on your device and identify visitors by a hash of the incoming request that Vercel discards after 24 hours. Vercel records an approximate location worked out from your IP address — country, region and city, never a precise position — as well as the page URL, referrer, device type, operating system and browser.
Server logs
My hosting provider automatically logs technical request data — IP address, timestamp, requested URL, user agent, and response status — to keep the site available and to detect abuse. The signup form also contains a hidden field that automated bots tend to fill in; if it is filled, the submission is discarded.
Artificial intelligence
This site does not run your data through any AI model, and no personal data collected here is used to train, fine-tune, or evaluate an AI system — mine or anyone else's.
4. Why I am allowed to process it (legal bases)
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Sending the checklist and follow-up emails | Email address | Consent — art. 6(1)(a). You gave it by submitting the form and can withdraw it any time by unsubscribing. |
| Knowing which campaign brought you here | UTM parameters, referring website | Legitimate interest — art. 6(1)(f): understanding which of my own content works, using data you already sent in the link. |
| Scheduling and holding the discovery call | Name, email, time slot, notes | Steps at your request prior to a contract — art. 6(1)(b). |
| Analytics and performance | Usage events, device data, IP address, approximate location (country, region, city) | Legitimate interest — art. 6(1)(f): measuring whether the site works and which pages help people. No consent is requested because analytics store nothing on your device. |
| Keeping the site up and blocking abuse | Server logs, honeypot field | Legitimate interest — art. 6(1)(f): security and availability. |
6. Who else processes your data
I use a small number of service providers. Each one only receives what it needs, and each is bound by a data processing agreement where it acts on my instructions.
| Provider | What it does | Privacy policy |
|---|---|---|
| Beehiiv, Inc. (USA) | Stores newsletter subscriptions and delivers the emails | beehiiv.com/privacy |
| PostHog, Inc. (USA) | Product analytics and performance measurement | posthog.com/privacy |
| Cal.com, Inc. (USA) | Scheduling for the free discovery call | cal.com/privacy |
| Vercel Inc. (USA) | Website hosting, content delivery, server logs, and the Web Analytics and Speed Insights measurement tools (no cookies or other storage on your device) | vercel.com/legal/privacy-policy |
Fonts are served from this site itself rather than from Google, so loading a page does not disclose your IP address to Google. Beyond the providers above, I disclose personal data only where I am legally required to.
7. How long I keep it
- Newsletter subscription: kept until you unsubscribe or ask for deletion. After you unsubscribe, a suppression record (your email address, marked unsubscribed) is kept so you are not accidentally re-added.
- Attribution data: kept with your subscription record for as long as the subscription exists.
- Booking data: kept for the duration of the enquiry and up to 12 months afterwards, then deleted unless it becomes part of a client relationship with its own record-keeping obligations.
- Analytics events: retained by PostHog for up to 12 months and then deleted or aggregated. Vercel keeps Web Analytics and Speed Insights data for the reporting window of my plan, currently one month, and notes that it may hold it longer so that the window can be extended later.
- Server logs: retained by the hosting provider for a short technical window, typically up to 30 days.
8. International transfers
The providers listed above are based in the United States, so your data is transferred outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses, on the provider's certification under the EU–US Data Privacy Framework where it holds one, and on the additional technical measures those agreements require. You can request a copy of the relevant safeguards by writing to me.
9. Your rights
Under the GDPR you can ask me to give you a copy of your data (art. 15), correct it (art. 16), delete it (art. 17), restrict how it is used (art. 18), send it to you or another provider in a portable format (art. 20), or object to processing based on legitimate interest (art. 21). Where processing rests on consent — which here means the newsletter, and only the newsletter — you can withdraw that consent at any time by using the unsubscribe link in any email, and withdrawing it does not affect what was already lawfully done beforehand. Analytics rest on legitimate interest rather than consent, so the right to object under art. 21 is the one that applies to them; write to me and I will exclude you.
Write to contact@nicoburkart.com and I will respond within one month. I hold very little data about you, so I will usually only need to confirm that you control the email address in question. There is no charge, and no automated decision-making or profiling with legal effects takes place on this site.
If you are unhappy with how I handled your request, you can complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, aepd.es, or to the authority in your own EU country of residence.
If you are in California
You have the right to know what personal information is collected and to request its deletion or correction. I do not sell or share personal information as those terms are defined in the CCPA/CPRA, and I do not use it for cross-context behavioural advertising. Use the same email address above to make a request.
10. Children
This site is aimed at people building software professionally and is not directed at children. Under Spanish law, valid consent requires you to be at least 14 years old; I do not knowingly collect data from anyone younger. If you believe a child has submitted their email address here, write to me and I will delete it.
11. Security
All traffic is served over HTTPS, and data held by my providers is encrypted in transit and at rest. Because there are no accounts, there are no passwords here to be leaked, and because nothing is sold, no payment details are stored. Access to the newsletter and booking dashboards is limited to me and protected by multi-factor authentication. No system is perfectly secure — if a breach ever affects your data and poses a risk to you, I will notify the AEPD within 72 hours and inform you where the GDPR requires it.
12. Changes to this policy
If I add a tool or change how data is used, I will update this page and change the “last updated” date at the top. For changes that materially affect you, I will say so more visibly — by email to subscribers or a notice on the site — before they take effect.
13. Contact
Questions about this policy, or about anything above, go to contact@nicoburkart.com. I reply to privacy requests within one month, and usually much sooner.