Privacy Policy

Summary

This is a static website. There is no account system, no user database, and no server-side logging of personal data by us. Nothing that identifies you is loaded until you give consent.

Data controller

gambocco. Contact for any privacy request: gam@duck.com.

What we collect

Consent-based analytics: if you press Accept in the cookie banner, Google Tag Manager and Google Analytics load and may process your IP address (truncated), device and browser information, pages viewed and approximate location. If you press Reject, or ignore the banner, no analytics scripts load at all.

Newsletter: the subscription form is an embedded Substack widget. If you subscribe, your email address is processed by Substack Inc. under their own privacy policy, not ours.

Email: if you write to gam@duck.com, we process the contents of your message to reply to you.

Support: Ko-fi payments are processed entirely by Ko-fi and its payment providers. We never see your card details.

Legal bases (GDPR Art. 6)

Consent (Art. 6(1)(a)) for analytics cookies. Legitimate interest (Art. 6(1)(f)) for responding to emails you send us. Contract (Art. 6(1)(b)) where you request a service such as a commission.

Third parties

Google (Tag Manager / Analytics) — consent only. Substack — newsletter. Ko-fi — voluntary support payments. Your hosting provider's CDN serves the pages. Fonts are self-hosted, so no font CDN sees your requests.

Retention

Analytics data is retained according to the Google Analytics retention window (14 months maximum). Emails are kept only as long as needed for the conversation and any legal record-keeping.

Your rights

You have the right to access, rectify, erase, restrict, port and object to processing of your personal data, and to withdraw consent at any time using the Cookie settings link in the footer. You may also complain to your national data protection authority. Requests: gam@duck.com.

International transfers

Some processors (Google, Substack, Ko-fi) are based in the United States and rely on Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

Children

This site is not directed at children under 16 and we do not knowingly collect their data.