No cookies, no tracking, no disclosure for advertising purposes.
Last updated: 23 September 2026
1. Responsible person
Paolo Stolfo, Birkenhaldenstrasse 32, 8738 Uetliburg, Switzerland · web@paolostolfo.com
2. Scope and principles
This policy applies to paolostolfo.com and the associated services (reading sample, purchase of the digital edition, newsletter, contact). The Swiss Data Protection Act (DSG) applies and, where applicable, the GDPR. I process only the data required for the respective purpose and do not disclose it for advertising purposes.
3. Visiting the website
No cookies are set and no personal tracking takes place. For anonymous, aggregated statistics I use Plausible Analytics (provider: Plausible Insights OÜ, Estonia; servers in Germany). Plausible does not create personal profiles and operates exclusively within the EU. The basis is my legitimate interest in data-minimising audience measurement.
4. Reading sample
The reading sample of the book «Die Illusion des Verstehens» is freely available as a PDF download. No personal details are required; neither an email address nor a registration is needed.
Delivery runs via the infrastructure of Cloudflare (Cloudflare, Inc., USA). This involves technically necessary connection data, including the IP address, which Cloudflare processes to deliver the file and to prevent abuse. I receive no personal analysis from this. The basis is my legitimate interest in the secure and reliable operation of the download.
5. Newsletter
When you subscribe, I collect your email address (required), your first name (optional) and your preferred language in order to send you the newsletter. Subscription uses double opt-in; the basis is your consent, which you may withdraw at any time with effect for the future. Delivery runs via Loops (Astrodon, USA). You can unsubscribe via the link in every email or by message to web@paolostolfo.com. After unsubscribing, your address is deleted or blocked so that you receive no further messages. A newsletter subscription is required neither for the reading sample nor for a purchase.
I also use Loops to send the email containing the access link to customers; details in section 7.
6. Contact by email
If you write to me, I use your details solely to answer your enquiry. Afterwards I delete them, unless a statutory retention obligation applies. The basis is my legitimate interest in handling your enquiry.
7. Book sales
Sales of the digital edition are processed by Stripe and appear there under the name Link (Stripe, Inc., USA, with group companies in Ireland and the United Kingdom). Stripe is the merchant of record and therefore itself responsible for processing payment data; Stripe’s privacy policy applies in addition.
On purchase, the email address, name, billing country, payment details and, for business customers, the VAT identification number are collected. Payment data such as card numbers never reaches me. Receipts, invoices and refund notifications are sent by Stripe directly to the customer. Stripe also offers an order overview through which purchases can be managed; I have no influence over it.
From Stripe I receive the details required for delivery and for answering enquiries: email address, first name, title purchased, transaction number, country.
Delivery runs via books.stolfo.co on Cloudflare’s infrastructure. On each access, the payment is verified live with Stripe; this involves the transaction number from the link and technically necessary connection data. No customer account is created and no entitlement is stored.
I send the email containing the access link via Loops. Customers are kept there as contacts, without a newsletter subscription; this email forms part of performing the contract.
The basis for processing is performance of the contract. Purchase data is retained for as long as required for delivery and for statutory retention obligations.
8. Hosting
The website is hosted by METANET AG in Switzerland (ISO 27001). Technically necessary server data is deleted after 14 days and does not leave Switzerland. The basis is my legitimate interest in the secure operation of the website.
9. Transfers abroad
Plausible processes data exclusively within the EU, METANET within Switzerland.
Cloudflare also processes data in the USA. Cloudflare is certified under the Swiss-U.S. Data Privacy Framework and the EU-U.S. Data Privacy Framework; standard contractual clauses apply in addition.
Loops processes data in the USA. The basis is a data processing agreement and the standard contractual clauses of the European Commission.
Stripe also processes data in the USA. Stripe is certified under the Swiss-U.S. Data Privacy Framework and the EU-U.S. Data Privacy Framework; standard contractual clauses apply in addition.
10. Your rights
You have the right to information, rectification, erasure, data portability and objection; consent once given may be withdrawn at any time with effect for the future. Contact web@paolostolfo.com — I normally respond within 30 days. The competent Swiss supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch. If you are subject to the GDPR, you may additionally lodge a complaint with the supervisory authority at your place of residence.
11. Changes
The version published on this page applies in each case.
12. Language
This English text is a translation provided for convenience. In the event of any discrepancy, the German version prevails.