Privacy Policy
Last updated: 24 October 2026
This policy explains what personal data The Serving Stack (theservingstack.com, "the site", "we") collects, why, how long we keep it, who processes it for us, and your rights. It covers the site, its accounts, its newsletter, and the emails it sends. It describes what the site does today; if that changes, this page changes first.
Who is responsible
The site is published by Alexis Kinsella, an individual based in France, who is the data controller under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act. Contact for anything about your data: team@theservingstack.com. We answer within one month.
What we collect and why
We do not sell personal data, we show no advertising, and we do not build profiles of you. Reading the site requires no account.
| What | When | Why | Legal basis | How long |
|---|---|---|---|---|
| Email address, with the dates you subscribed, confirmed, or unsubscribed | You subscribe to the newsletter (you confirm by email before anything is sent) | Send you the newsletter; prove your consent | Your consent (Art. 6(1)(a) GDPR), withdrawn by unsubscribing | While you are subscribed. After you unsubscribe, the address stays marked as unsubscribed so that we never write to you again |
| Delivery events for our emails (permanent bounce, spam complaint) | We send you an email | Stop sending to addresses that bounce or complain | Legitimate interest in reliable, non-abusive email (Art. 6(1)(f)) | With the address |
| Account data: name, email address, profile picture (copied to our storage), the sign-in method you used (GitHub, Google, or an email link), the account identifier and sign-in tokens your provider returns | You create an account or sign in | Provide your account and its features; send account emails (sign-in links, a welcome message) | Performance of our contract with you (Art. 6(1)(b)) | Until you ask us to delete your account |
| Sessions: a session identifier, the IP address and browser user agent of each signed-in session | You sign in | Keep you signed in; protect accounts | Contract, and legitimate interest in security | A session expires after 30 days without use |
| Your activity: course enrollments and progress, saved articles, course ratings, lesson feedback, error reports, a short bio if you write one | You use these features | Provide them; improve the content | Contract (Art. 6(1)(b)) | Until you delete them or your account |
| Certificates: your name as shown on it, the course, the date | You complete a course that issues one | Issue a certificate others can check at its public link | Contract (Art. 6(1)(b)) | As long as the certificate exists; you can ask us to remove it |
| Page views: a random identifier from a first-party cookie, the article, the time | You open an article | Count views per article | Legitimate interest in knowing which articles are read (Art. 6(1)(f)) | The identifier expires after 30 days in your browser; view records are kept as long as the site uses them for article statistics |
| Visit statistics: page, referrer, country, browser and device type, and anonymous counts of actions (subscribing, confirming, creating an account, following a link to another site), without cookies and without storing your IP address | You visit the site | Measure overall audience | Legitimate interest (Art. 6(1)(f)) | Kept by our statistics provider as aggregated visit records |
| Messages you send us | You write to us | Answer you | Legitimate interest | As long as needed to handle your message |
When you create an account, we also create a matching customer record (email, name, account identifier) with our payment provider, Polar, so that purchases could later be attached to your account. No payment is processed on the site today.
Our servers also log technical data about requests (IP address, time, requested page, browser) to operate and secure the site; these logs are kept for a limited time.
Who processes your data for us
| Provider | What they do | Where |
|---|---|---|
| Hetzner Online GmbH (Germany) | Hosts the site, its database, and its files | Germany (Nuremberg) |
| Scaleway SAS (France) | Stores daily database backups, kept 30 days | France (Paris) |
| Resend (Plus Five Five, Inc., USA) | Sends account emails and the newsletter | United States |
| Cloudflare, Inc. (USA) | Domain name service; forwards email sent to our addresses | Global, including the United States |
| Umami (Umami Software, Inc., USA), Umami Cloud | Visit statistics, without cookies | United States |
| Polar (Polar Software, Inc.) | Holds the customer record created with your account | Its own infrastructure |
| GitHub (GitHub, Inc.) and Google (Google Ireland Ltd / Google LLC) | Only if you choose to sign in with them: they confirm who you are and send us your name, email address, and profile picture, under their own privacy policies | Their own infrastructure |
These providers process your data on our behalf, under their data processing terms (except GitHub and Google, which act for themselves when you sign in with them). For providers outside the European Union, transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for details.
Cookies
The site sets a few first-party cookies: sign-in cookies, and one that counts article views. See the Cookie Policy.
Your rights
You can ask to access your data, correct it, delete it, restrict its use, object to uses based on our legitimate interest (such as the view counter), and receive the data you gave us in a portable format. You can withdraw your consent to the newsletter at any time with the link in every email. Under French law, you can also give instructions about your data after your death.
Write to team@theservingstack.com from the address linked to your account or subscription. You can edit your bio and your newsletter preference yourself in your account page.
If you think we have not respected your rights, you can complain to the French data protection authority, the CNIL (cnil.fr), or to the authority of the EU country where you live.
Children
The site is not directed at children. You must be at least 15 to create an account or subscribe to the newsletter.
Security
All connections are encrypted (HTTPS). Sign-in uses one-time email links or your GitHub or Google account; we never store a password.
Changes
We update this page, and its date, before changing how we use personal data. If a change affects data you already gave us, we tell you by email first.