Legal
Privacy Policy
This site collects three things, all of which you type into a form yourself. It sets no cookies, does not track you across other sites, and builds no profile of you.
Effective
Who is responsible
The controller of the personal data described here is Carlo Martin, who operates TaleShard. For anything in this document, email privacy@taleshard.com or use our contact form.
This policy covers taleshard.com, the marketing site. The TaleShard application is not open to the public yet; when it launches it will carry its own policy covering the projects and content you create in it. Nothing described here gives this website access to application data, and that is structural rather than a promise: this site holds no credential able to read application data and has no route into it. The only store it writes to is the private bucket where form submissions are kept, described below.
What we collect, and only when you send it
Every field below is one you fill in and submit deliberately. The only things collected without you typing them are anonymous counts of which pages are read and how quickly they load, described under Analytics — they identify nobody.
Waitlist
- Your email address.
- Optionally, your name, your role, a link to your work (a portfolio, studio site or similar), and what you are working on.
- Whether you ticked the newsletter box, together with the exact wording you were shown beside it. The wording is recorded, not just the tick — a checkbox on its own is not a record of what was consented to.
Newsletter
- Your email address, and the consent wording shown beside the form you used.
Contact
- Your name, email address, subject, and message.
Attached to all three
- The IP address the request came from, and the country our network layer resolves it to.
- Your browser's user-agent string, truncated to 300 characters.
- The time of submission.
- Which page of this site you submitted the form from, and any campaign tags (
utm_sourceand similar) that were in that page's address. These come from the address itself, not from anything stored on your device, and they tell us which link brought you here — not who you are.
That technical group exists to make abuse and duplicate submissions traceable, and to tell us which of our own links are worth repeating. It is not used to build a profile of you, and it is never combined with data from anywhere else.
Every submission is written to a private storage bucket on Cloudflare, held in the EU, the moment it is received; if that write fails, the form tells you so rather than pretending it worked. Our backend reads new submissions from that bucket into our database. The bucket deletes each submission automatically after 24 months, and if you ask us to delete your data, your submissions are removed from it too.
Analytics
This site uses Umami to count visits and to see which sections of a page people reach, andCloudflare Web Analyticsto measure how quickly pages load. Neither sets cookies, stores anything on your device, or can follow you to other websites. No profile is built, and nothing they record can be traced back to you as an individual.
We use them to answer two questions: whether these pages explain the product well enough, and whether they load fast enough to be read. You are counted in an aggregate; you are not identified. This is also why you have not been shown a cookie banner — there is nothing stored on your device to ask you about.
What we do not collect
- No profiling, and no cross-site tracking. The page counting described above is anonymous and aggregate. There is no Google Analytics, no advertising pixel, no heatmap, no session recorder, and nothing that follows you off this site.
- No tracking cookies. The site sets no cookie for advertising, analytics, or profiling — which is also why you have not been shown a cookie banner.
- No third-party embeds that phone home. Fonts are served from this domain rather than a font CDN, and site search runs entirely inside your browser against a static index.
- No advertising networks, and no sale or sharing of your data with anyone for marketing.
Why we are allowed to hold it
| Purpose | Lawful basis (UK/EU GDPR) |
|---|---|
| Holding your waitlist place and emailing you about access | Consent — Art. 6(1)(a) |
| Sending the newsletter | Consent — Art. 6(1)(a) |
| Replying to a message you sent us | Legitimate interests — Art. 6(1)(f): answering someone who asked us a question |
| Keeping IP, country, and user agent against a submission | Legitimate interests — Art. 6(1)(f): preventing abuse of a public form |
Where the basis is consent, you can withdraw it at any time and that is as easy as giving it: every email carries a one-click unsubscribe, and withdrawing has no effect on anything done before you withdrew.
Where it goes
A submission is written to the private storage bucket described above, on Cloudflare's network, and our own backend collects it from there into our database. We use these processors and nothing else:
| Processor | What it does |
|---|---|
| Cloudflare | Hosts this site, stores submissions in a private bucket held in the EU, runs the Turnstile anti-spam check, delivers contact and confirmation email, and measures page load speed (Web Analytics) |
| Our database provider | Stores submissions once our backend has collected them. We will name the provider here once the production database is deployed. |
| Umami | Counts page views and which sections are reached, without cookies or any identifier for you |
Turnstile is a privacy-preserving alternative to a CAPTCHA: it decides whether a submission is automated without profiling you across sites and without asking you to label photographs.
We disclose data outside that list only where the law compels us to, and we will tell you if that ever happens unless we are legally barred from doing so.
International transfers
Cloudflare operates a global network, so a request may be handled by infrastructure outside your country. Transfers out of the EEA or UK rely on the European Commission's Standard Contractual Clauses and the UK Addendum, and the same applies to the aggregate page counts processed by Umami. Where our database is hosted will be stated here once the production database is deployed, along with the safeguards covering it.
How long we keep it
- Waitlist: until you are given access or ask us to remove you, and in any case no longer than 24 months.
- Newsletter: until you unsubscribe.
- Contact messages: 24 months after the conversation ends.
Unsubscribing removes you from the mailing list. Ask us to erase, and the record goes.
Your rights
Under the UK and EU GDPR you can ask us to give you a copy of your data, correct it, erase it, restrict or object to how we use it, or send it to another provider in a portable format. You can also withdraw consent at any time. Use the contact form or email privacy@taleshard.com. You will normally hear back within a few days — one month is the legal ceiling, not the target. The law allows longer only where a request is genuinely complex, and we would tell you why well before the month was up.
If you think we have handled your data badly, please tell us first so we can fix it — but you are entitled to complain directly to a supervisory authority. Ours is the ItalianGarante per la protezione dei dati personali, and you may also complain to the regulator where you live.
Security
Submissions travel over HTTPS to a private storage bucket that is not publicly reachable. Our backend collects from it outbound, so it exposes no inbound endpoint for this flow. The site holds no credential capable of reading or writing application data, so even a full compromise of this site would not reach the TaleShard application or anything stored in it.
Children
This site is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has sent us their details, contact us and we will delete them.
Changes
If we change this policy we update the effective date at the top. Where a change materially affects a consent you have already given, we will email you rather than rely on you noticing.