Last updated: 13 November 2026
This Privacy Policy explains what personal data is collected when you visit thedark.ai (the “site”), subscribe to The Dark Side newsletter or leave a comment, why it is collected, and what rights you have. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR).
1. Who is responsible for your data
The site is a personal publication run by an individual, not a company. The controller responsible for your personal data is:
Alexios Dionysios Diakogiannis
Email: [email protected]
In this policy, “I”, “me” and “my” refer to the controller. For any question about your data, write to the address above.
2. Summary
- I collect only what the site needs to work, stay secure and send the newsletter.
- Analytics and YouTube videos run only if you accept them in the cookie banner.
- The site is self hosted on a server in Germany. Newsletter and comment data stay on that server.
- I do not sell your data, rent it out or use it for advertising profiles.
- You can unsubscribe, withdraw consent or ask for your data to be deleted at any time.
3. What data I collect and why
3.1 Visiting the site (server logs)
When you open a page, the web server automatically records technical data: your IP address, date and time of the request, the page requested, the referring page, your browser type and version, and your operating system. I need this data to deliver the pages, to find errors and to protect the site against attacks.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in running a secure and working website).
Retention: server logs are deleted after 14 days, unless a specific log entry is needed longer to investigate a security incident.
3.2 Hosting
The site runs on a dedicated server that I manage myself, rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in Germany. Hetzner provides the hardware and network only and processes data on my behalf under a data processing agreement (Art. 28 GDPR).
3.3 Security and bot protection (Cloudflare)
Traffic to the site passes through Cloudflare, a content delivery and security service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare filters malicious traffic, blocks bots and speeds up page delivery. To do this, Cloudflare processes your IP address, browser information and the details of your request, and may set a strictly necessary security cookie (see the Cookie Policy).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting the site from attacks and abuse).
Cloudflare acts as a processor under a data processing agreement. For transfers to the USA, see section 6.
3.4 Cookies and your consent choice
The site uses a cookie banner (WP Legal Pages) to ask for your consent before any non-essential cookies are set. The banner stores your choice in a cookie so it does not ask you again on every page. Details of every cookie are in the Cookie Policy.
Legal basis: Art. 6(1)(c) GDPR together with § 25 TDDDG and the ePrivacy rules (legal obligation to record consent), and Art. 6(1)(f) GDPR.
3.5 Analytics (Google Analytics 4)
If you accept analytics cookies, the site uses Google Analytics 4, connected through the Site Kit by Google plugin. The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It helps me understand which articles people read and how they find the site.
Google Analytics collects information such as the pages you view, how long you stay, the site that sent you, your device type, browser, screen size and approximate location (country or city). Google Analytics 4 does not log or store full IP addresses. I do not combine this data with your name or email address.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (your consent). Without your consent, Google Analytics is not loaded.
Retention: analytics data is kept for 14 months and then deleted automatically.
You can withdraw your consent at any time through the cookie settings (see section 9). For more information, see Google’s Privacy Policy.
3.6 Google Search Console
I use Google Search Console to see how the site performs in Google Search, for example which search terms lead to it. Search Console does not run on the site, sets no cookies on your device and gives me only aggregated statistics. I cannot identify individual visitors from it.
3.7 YouTube videos
Some articles include videos hosted on YouTube, a service of Google Ireland Limited (address above). When a YouTube video loads, your browser connects to YouTube’s servers. YouTube receives your IP address and information about your device and the page you are on, and sets cookies that it may use for advertising and to track your viewing. If you are signed in to a Google account, YouTube can link the visit to your account.
For this reason, YouTube videos load only if you accept marketing cookies. Until then, you see a placeholder instead of the video.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (your consent).
For more information, see Google’s Privacy Policy.
3.8 Newsletter
If you subscribe to The Dark Side newsletter, I collect your email address. I also record the date and time of your signup and confirmation, and the IP address you used, so I can prove that you gave consent.
The newsletter uses double opt-in: after you sign up, you receive an email with a confirmation link, and you are added to the list only after you click it. The newsletter is managed by a WordPress plugin on my own server, so subscriber data is not shared with an external mailing service.
The newsletter may record whether an email was opened and which links in it were clicked. I use this only in aggregate to see which topics readers find useful.
Legal basis: Art. 6(1)(a) GDPR (your consent).
Retention: your data is kept until you unsubscribe. After that, I delete it within 30 days, except for a minimal record of your consent and unsubscription, which I may keep for up to 3 years to prove I followed the law (Art. 6(1)(c) and (f) GDPR).
You can unsubscribe at any time with the link at the bottom of every newsletter, or by writing to [email protected].
3.9 Comments
If you leave a comment, the site stores your name, email address, website (optional), the comment itself, the date and time, your IP address and your browser’s user agent. Your name, website and comment are shown publicly. Your email address and IP address are never published.
I use the IP address and user agent to detect spam and abuse, and in case a comment breaks the law. Comments are checked by me before they appear. The site does not use Gravatar or any external comment service. See the Comments Policy for the rules on commenting.
If you tick the box to save your details, WordPress stores your name, email and website in cookies on your device so you do not need to type them again (see the Cookie Policy).
Legal basis: Art. 6(1)(b) GDPR (publishing the comment you asked me to publish) and Art. 6(1)(f) GDPR (legitimate interest in preventing spam and abuse).
Retention: comments stay on the site until you ask me to delete them or I remove them. IP addresses of comments are deleted after 6 months.
3.10 Contacting me
If you write to me by email or reply to a newsletter, I process your email address, your name if you give it, and the content of your message, so I can answer you.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering your message), or Art. 6(1)(b) GDPR if your message relates to an agreement with me.
Retention: I delete messages when they are no longer needed, normally within 2 years of the end of the conversation.
3.11 Share buttons and external links
Articles have share links for LinkedIn and X and a “Copy link” button. These are plain links. No data is sent to LinkedIn or X when you load a page. Data is only sent if you click a share link, and then the privacy policy of that platform applies.
The site also links to other websites, such as my social media profiles. I am not responsible for how those sites handle your data.
4. Who receives your data
I do not sell or rent your personal data. I share it only with these service providers, who process it on my behalf or as described above:
- Hetzner Online GmbH (Germany): server hosting.
- Cloudflare, Inc. (USA): security, bot protection and content delivery.
- Google Ireland Limited (Ireland), with possible transfer to Google LLC (USA): Google Analytics and YouTube, only with your consent.
I may also disclose data to public authorities if the law requires it.
5. No automated decisions
I do not make decisions about you based only on automated processing, and I do not build profiles of individual visitors.
6. Transfers outside the EU
Cloudflare, Inc. and Google LLC are based in the USA. Both are certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection (Art. 45 GDPR). In addition, standard contractual clauses approved by the European Commission are in place (Art. 46 GDPR).
7. How long I keep your data
| Data | Retention |
|---|---|
| Server logs | 14 days |
| Analytics data (with consent) | 14 months |
| Newsletter subscription | Until you unsubscribe, then deleted within 30 days (consent record up to 3 years) |
| Comments | Until deleted on request or removed by me |
| IP addresses of comments | 6 months |
| Emails and replies | Normally up to 2 years after the conversation ends |
| Cookies | See the Cookie Policy |
If the law requires me to keep data longer, I keep it only for that purpose and for that period.
8. Your rights
Under the GDPR, you have the right to:
- Access the personal data I hold about you and get a copy (Art. 15).
- Correct data that is wrong or incomplete (Art. 16).
- Delete your data (Art. 17).
- Restrict how I use your data (Art. 18).
- Receive your data in a common, machine readable format and move it elsewhere (Art. 20).
- Object to processing based on legitimate interest (Art. 21).
- Withdraw your consent at any time, without affecting processing that happened before (Art. 7(3)).
To use any of these rights, write to [email protected]. I will answer within one month. I may ask you to confirm your identity before I act on your request. Using your rights is free.
9. How to withdraw your consent
You can change or withdraw your cookie consent at any time by opening the cookie settings through the cookie icon or the link on the site, and choosing “Reject All” or changing your preferences. You can unsubscribe from the newsletter with the link in every email.
10. Right to complain
If you think I process your data unlawfully, you can complain to a data protection supervisory authority, in particular in the EU country where you live, work or where the issue happened. The authority responsible for me is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34, 55116 Mainz, Germany
www.datenschutz.rlp.de
Readers in Greece can also contact the Hellenic Data Protection Authority (www.dpa.gr). I would appreciate the chance to fix any problem first, so please feel free to contact me before you complain.
11. Children
The site is written for software professionals. The newsletter and comments are not meant for anyone under 16, and I do not knowingly collect data from children under 16. If you believe a child has given me personal data, please contact me and I will delete it.
12. Security
I protect your data with technical and organisational measures that fit the risk, including HTTPS encryption for all connections, a server located in Germany, regular software updates, restricted access and bot protection. No system is completely secure, but I work to keep your data safe.
13. Changes to this policy
I may update this policy when the site or the law changes. The date at the top shows the latest version. If a change affects how I use newsletter subscriber data, I will tell subscribers by email.
14. Contact
For any question about this policy or your data, write to [email protected].