Privacy & cookies
Privacy & cookie policy
Last updated: 7 August 2026
1. Who is responsible
Magda & Bots is a personal project run by Magda Ursulean, based in Switzerland. Magda Ursulean is the data controller for everything described here, and can be reached at hello@magdaandbots.com .
Because the controller is established in Switzerland, the Swiss Federal Act on Data Protection (nFADP) applies. The EU General Data Protection Regulation (GDPR) applies in addition where visitors are in the EEA, and the UK GDPR where they are in the UK. There is no Data Protection Officer — the site is small enough not to require one.
2. What is collected, and why
Nothing on this site asks you to create an account, and none of it profiles you or makes automated decisions about you.
| When | What | Why | Legal basis |
|---|---|---|---|
| Any visit | IP address, browser and device details, the page requested, and the referring page — recorded in server and security logs. | Serving the site, and defending it from attack and abuse. | Legitimate interests (GDPR Art. 6(1)(f)) in operating a secure site. |
| Newsletter signup | Your email address. | Sending you the newsletter, and nothing else. It is never sold, rented, or passed on. | Your consent (GDPR Art. 6(1)(a)), given by clicking the confirmation link, and withdrawable at any time. |
| Contact form | Your name, email address, and whatever you write in the message. | Reading your message and replying to it. | Steps taken at your request (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) in answering enquiries. |
| Opening the contact page | Your IP address and browser signals, sent to Cloudflare Turnstile. | Confirming you are not a bot, so the form is not usable for spam. | Legitimate interests (Art. 6(1)(f)) in preventing abuse. |
| Only if you accept cookies | Analytics data: pages viewed, approximate location from your IP, referrer, and which links you click. | Understanding which pages and videos are worth making more of. | Your consent (Art. 6(1)(a)), which you can withdraw at any time. |
The Turnstile check in the fourth row runs when the contact page loads, not when you press send — so it happens even if you decide not to write anything. It is the one third-party request the site makes before you have answered the cookie banner, and it sets no advertising cookie.
3. Who else processes it
These are the only companies that handle data from this site. Each acts on instructions, under a data processing agreement.
- Cloudflare — hosts the site and runs the form endpoints, provides the Turnstile anti-spam check, and keeps operational and security logs. United States, with processing at edge locations worldwide.
- Kit (ConvertKit) — stores the newsletter list and sends the emails. United States.
- SMTP2GO — transmits contact-form messages to the inbox. Your name, email and message pass through their systems and appear in their sending logs. United States.
- Google — provides Gmail, where contact messages are received and read, and (only with your consent) Google Tag Manager and Google Analytics. United States.
Video thumbnails on the homepage are stored on this site rather than loaded from YouTube, so browsing the site does not tell YouTube you were here. Fonts are self-hosted for the same reason. Data is never sold, and is only ever disclosed beyond this list where the law requires it.
4. Transfers outside Switzerland and the EEA
Every processor above is based in the United States, so your data is transferred there. Those transfers rely on the European Commission's Standard Contractual Clauses together with the Swiss addendum, and, where the provider is certified, on the EU–US and Swiss–US Data Privacy Frameworks. US law may give public authorities access rights that Swiss and EU law would not — that is an inherent limitation of using US services, and it is why the list above is kept as short as it is.
6. How long it is kept
- Newsletter — you are only added after clicking the confirmation link in the opt-in email, and your address stays on the list until you unsubscribe, which you can do from the footer of any email. After that it is removed, apart from the minimum record needed to avoid emailing you again by mistake.
- Contact messages — kept as long as they are needed for the conversation and any follow-up it leads to, then deleted. There is no fixed clock on this; if you would like your message deleted sooner, ask and it will be.
- Analytics — retained by Google Analytics for no more than 14 months, then deleted automatically. Reports are only ever looked at in aggregate.
- Server and security logs — kept short-term by Cloudflare for operations and abuse prevention, then discarded.
7. Your rights
Under the nFADP and, where it applies, the GDPR, you can ask for a copy of the data held about you, have it corrected, have it deleted, have its use restricted, object to processing based on legitimate interests, and receive it in a portable form. Where processing rests on consent — the newsletter and analytics — you can withdraw that consent at any time, without affecting anything done before you withdrew it.
Write to hello@magdaandbots.com and you'll get a reply. Requests are free, and answered within 30 days.
If you are not satisfied with the response, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) (opens in a new tab) . If you are in the EEA or the UK, you can complain to the supervisory authority where you live or work instead.
8. Changes to this policy
If what the site does changes, this page changes with it, and the date at the top is updated. There is no version history to dig through — what's written here is what the site currently does.