Privacy policy
Facts last reviewed: . This page is generated from the code that does the collecting, so its figures cannot drift from what the service actually does.
Who is responsible
Santiago Santa María Morales
Contact: santismm@gmail.com
This policy governs hispanic-legacy.com — the website, its machine-readable surfaces and its MCP endpoint.
What we collect, and what we deliberately do not
We measure traffic to know whether this source is useful. Each request may produce one record with: the path requested, the surface that answered, a coarse class of visitor derived from the user-agent (human, AI crawler, MCP client, bot), the outcome, how long it took, the referring site's host only, and a two-letter country.
What is never stored: your IP address, the full referring URL, your name, your email, or any account — there are no accounts. We do not use cookies to identify you, we do not fingerprint your browser, and we do not track you across other websites.
To tell one visit from another without identifying anybody, an IP and user-agent may be combined into a one-way hash truncated to 16 characters, under a secret salt that rotates every day. Yesterday's hash cannot be matched to today's, which is what stops it becoming a stable identifier. When the salt is not configured, no hash is computed at all and the feature simply stays off.
Why we are allowed to (legal basis)
Legitimate interest (GDPR art. 6.1.f): understanding aggregate demand for a public knowledge source, using the least data that answers the question. Because we store no identifiers and no IP addresses, this processing carries a minimal impact on you — that balance is the basis, and it is why the design refuses the data it does not need rather than collecting it "just in case".
Cookies
The public site sets no cookies until you say yes. Nothing is loaded from another company, and no analytics cookie is written, unless you accept them — refusing is one click and leaves the site working exactly as it did. The full table of what is set, for how long, and how to change your mind afterwards is on the cookie policy.
One cookie exists and it is not for visitors: __Host-citarium_panel, set only when the site operator signs in to the private observatory, strictly necessary to keep that session, first-party, HttpOnly, Secure, SameSite=Lax, and expiring after 30 days. Being strictly necessary for a service the operator explicitly requested, it needs no consent banner.
How long we keep it
- Aggregate daily counters: 200 days, after which they expire automatically.
- A raw log of agent requests only (never human visits), capped at 20,000 entries and expiring on the same 200-day clock; the oldest entries are dropped as new ones arrive.
- Session grouping: an idle window of 30 minutes, after which the visit is over and the daily salt rotation makes it unrecoverable.
Who else touches the data
Two processors, both acting on our instructions: Vercel (hosting and delivery) and Upstash (the counter store). Data may be processed outside the EEA under the transfer safeguards those providers publish. We do not sell, rent or share usage data with anyone else, and no advertising network receives anything from this site.
Your rights
You may request access, rectification, erasure, restriction of processing, portability, and you may object to processing based on legitimate interest. Write to santismm@gmail.com.
An honest limit: because we store no identifier that points to you, we usually cannot locate records "about you" — there is nothing to search by. That is a consequence of collecting less, not a refusal, and GDPR art. 11 covers it: where a controller cannot identify a data subject, the access and erasure rights may not apply. Tell us what you need anyway and we will explain exactly what exists.
You may also complain to the Agencia Española de Protección de Datos (AEPD) — www.aepd.es.
Automated content and AI
This source is built for machines to read and cite, and part of its content is drafted with AI assistance under human review before publication. Every published claim is bound to a registered source you can check yourself. Nothing you send to this site is used to train any model.
Changes
When what we collect changes, this page changes in the same release — it is generated from the collecting code, and a check in our build fails if the two disagree.