Privacy Policy

This policy explains what personal data william.beem.us collects, why I collect it, who processes it for me and how you control it. I write this site as an individual. I run no ads, sell nothing here and never sell your data.

Who I am

I am William Beem, and I operate william.beem.us from Florida, in the United States. I decide what data this site collects and how it is used, which makes me the controller of your personal data under the GDPR and the UK GDPR.

Send any privacy question or request to [email protected]. I read that mailbox myself.

The short version

  • I run no ads, sell no data and share no data for advertising.
  • My analytics runs on my own server, sets no cookies, and loads only after you accept analytics.
  • I collect your email address only when you give it to me through the newsletter, the contact form or a comment.
  • If you subscribe, I keep a record of which lists you chose, where you signed up, and which of my emails you open and links you click. I use it only to decide what to send you.
  • You can ask me to show, correct or delete your data at any time, wherever you live.

What I collect and why

Analytics

When you accept analytics, Umami records the pages you view, how you arrived, your browser, operating system, device type, screen size and language, and your approximate location at country, region and city level. It also records where you click and how far you scroll, which I see only as heatmaps that combine many visits. I use these reports to decide what to write next and to find pages that fail readers.

I run Umami myself on a server in Chicago, so no analytics company receives your data, and only I can see the reports. Umami sets no cookies and does not store your IP address. It uses your IP address and browser details only to compute a scrambled code, renewed every month, that groups your page views into one visit. If you decline analytics, Umami never loads.

Security and delivery

Every request to this site passes through Cloudflare, which blocks attacks and delivers pages quickly. Cloudflare processes your IP address, browser details and the address of the page you request, and it sets security cookies to tell people from bots. My host, xCloud, keeps standard web server logs with the same details. I use these logs only to keep the site running and secure.

Newsletter

The Subscribe form asks for your first name, your email address and, if you choose, your last name. You must tick a box agreeing to receive the newsletter before the form will send. Cloudflare Turnstile checks each signup to tell people from bots, and Akismet screens it for spam.

Your signup goes into FluentCRM, which runs on this site’s own server. You start as a pending contact and receive one email asking you to confirm. I send you nothing else until you click the confirmation link. If you do not confirm within 7 days, I may delete your signup.

I offer three lists: New Posts, Monthly Digest and Notes from William. New subscribers join New Posts and Notes from William. Every newsletter email links to a preference page where you can change your lists or update your name, and to an unsubscribe link that stops all newsletter email. I send from William Beem at [email protected], through FluentSMTP and Amazon SES.

FluentCRM records tags on your contact record: where you signed up, how far you are through my welcome emails, and other tags based on how you interact with my emails or this site. My emails contain a small image that tells FluentCRM when you open them, if your email app loads images. I may also track which links you click, and some links can add a tag when you click them. I use this record only to decide what to send you and to improve the newsletter. I do not sell it or use it for advertising. You can block open tracking by turning off images in your email app.

Contact form and email

The contact form collects your name, email address, an optional subject, and your message. Cloudflare Turnstile checks each submission to tell people from bots, and Akismet screens it for spam. I use what you send only to read and answer your message. When you email me directly, I keep your message and my reply in my mailbox.

Comments

When you comment on a post, WordPress stores your name, email address, website if you give one, comment text, IP address and browser details. Your name, website and comment appear publicly. Your email address and IP address never do.

Akismet, a spam filter run by Automattic, checks every comment and receives the same details to do it. Avatars on this site come from this site alone. I do not use Gravatar.

  • Consent covers analytics and the newsletter, including seeing when you open my emails and which links you click. You can withdraw it at any time through the Cookie settings link, the preference page or the unsubscribe link, and withdrawal does not affect what happened before.
  • Legitimate interests cover security and delivery through Cloudflare and server logs, spam and bot screening on forms and comments, answering your messages, publishing and moderating comments, and keeping proof of your newsletter consent. My interest in each case is running a safe, working site and newsletter and responding to the people who use them. You can object to any of these uses.
  • Legal obligation covers any disclosure the law compels, such as a valid court order.

You never have to give me personal data to read this site. I need your email address only to send the newsletter or answer a message. I make no automated decisions that have legal or similarly significant effects on you.

Who processes data for me

  • Cloudflare provides DNS, security and content delivery for every visit, including to my analytics server, and runs Turnstile, which checks form submissions to tell people from bots.
  • xCloud hosts and manages the server that runs the site, its database and FluentCRM, where the newsletter list lives. It also manages the separate server that runs my Umami analytics.
  • Vultr provides the data center server in Chicago where my Umami analytics data is stored.
  • Google runs Google Workspace, which handles email I send and receive at beem.us.
  • Amazon Web Services sends the site’s email through Amazon SES, including the newsletter and form notifications, and stores the site’s backups in Amazon S3.
  • Automattic screens comments, contact messages and newsletter signups for spam through Akismet.

Each provider processes your data only to deliver its service to me, under its own data processing terms. I share your data with no one else, except when the law compels me.

International transfers

I live and work in the United States, so data you send me travels there. My providers also process data in the United States and in other countries where they operate. When data leaves the EU, the EEA or the UK, the provider’s certification under the EU-US Data Privacy Framework and its UK Extension, or the Standard Contractual Clauses in its data processing terms, protect it.

How long I keep data

  • Newsletter subscribers: until you unsubscribe. After that, I keep your email address on a suppression list so I never mail you again.
  • Proof of your consent: the Subscribe form entry, which holds your name, email address, IP address, browser, the box you ticked and the date and time you signed up, for as long as you stay subscribed and then for as long as your email address stays on the suppression list. If you ask me to delete your data, I delete this entry too and keep only your email address on the suppression list.
  • Unconfirmed signups: I may delete them after 7 days.
  • Contact messages and email: 12 months after my last reply.
  • Comments: as long as the comment stays published. Akismet discards spam after 15 days, and WordPress deletes trashed comments after 30 days.
  • Analytics: 24 months. A scheduled job on my analytics server deletes older records every month.
  • Server and security logs: the short periods xCloud and Cloudflare set for their own logs.
  • Backups: database backups, which hold subscriber, form and comment data, rotate out after 5 days. Data I delete from the site leaves my backups within that window.

Your rights

Wherever you live, you can ask me to:

  • show you the personal data I hold about you and give you a copy in a portable format;
  • correct data that is wrong or incomplete;
  • delete your data;
  • restrict how I use your data, or object to a use based on legitimate interests;
  • withdraw any consent you gave me.

Email [email protected] from the address your request concerns, or tell me how to confirm the data is yours. I answer within one month and charge nothing.

If you live in the EU or the EEA, you can also complain to your local data protection authority. In the UK, you can complain to the Information Commissioner’s Office. I ask for the chance to fix the problem first.

US state privacy laws

I do not sell your personal data, share it for cross-context behavioral advertising or use it for targeted advertising, as California and other state privacy laws define those terms. I extend the rights above to every reader, so you do not need to live in a particular state to use them.

I honor Global Privacy Control and Do Not Track. When your browser sends either signal, I treat it as a refusal of analytics, and Umami never loads.

Cookies are small files a website stores in your browser. This site sets two kinds, and my analytics sets none.

  • Strictly necessary, set without consent. Cloudflare sets __cf_bm for 30 minutes to tell people from bots, cf_clearance to record that you passed a security check, and _cfuvid for your browsing session to apply rate limits fairly. The cookie banner stores your choice for 12 months so it does not ask again on every page.
  • Comment preferences, set only if you ask. When you tick Save my name, email, and website in this browser on the comment form, WordPress sets comment_author cookies for about a year to fill in the form next time.

On your first visit, a banner asks whether to allow analytics. Declining takes one click, the same as accepting, and the site works the same either way. Umami loads only after you accept, and it stores nothing in your browser. You can change your choice at any time through the Cookie settings link at the bottom of every page, or delete cookies in your browser.

How I protect your data

Every page loads over an encrypted HTTPS connection. Cloudflare’s security rules screen traffic before it reaches the server, every administrator account uses two-factor authentication, and the site runs only the accounts and plugins it needs. No system is perfectly secure, so do not send sensitive personal information through forms or email. If a breach puts your data at risk, I will notify you and the relevant authority as the law requires.

Children

I write this site for IT professionals, and it is not directed at anyone under 16. I do not knowingly collect personal data from children. If you believe a child has given me personal data, write to [email protected] and I will delete it.

Changes to this policy

When I change this policy, I update the date below. When a change affects how I use data you already gave me, I also email newsletter subscribers before it takes effect.

Last updated: October 20, 2026