Privacy Policy

Last updated: 11 August 2026.

Who is responsible

This website, cisoessentials.ai, is a personal blog run by Michael Mullins, based in Switzerland. I am the data controller for the personal data described below, and I decide alone what is collected and why.

For any question about this policy (that are not answered by reading it) or about your personal data, write to [email protected].

What I collect and why

Email address, if you subscribe. If you sign up for the newsletter, request a download, or create an account, I store the email address you give me, along with the date you subscribed and, if applicable, your name. It is used only to send you the content you asked for. I do not sell it, rent it, or share it for anyone else's marketing.

Analytics. I use Plausible Analytics, which I run on my own server rather than using a third party service. It sets no cookies, does not track you across websites, and does not attempt to identify individual visitors. It records the page visited, the referring site, the browser and device type, and a country derived from your IP address. Your IP address itself is not stored.

Server logs. The web server records standard technical information for each request, including IP address, timestamp, requested page, response status and user agent. These logs exist for security and troubleshooting, and are not used to build profiles of visitors.

Cookies

This site sets no analytics or advertising cookies, which is why you are not asked to accept any.

The only cookies used are those the publishing platform sets when you sign in or use a subscriber feature. They are strictly necessary for those features to work. If you never sign in, no cookies are set.

Who else processes your data

I keep the number of third parties deliberately small. Those currently involved:

  • Hetzner Online, which hosts the server this site runs on, located in Finland
  • OVH, which hosts the separate server running my analytics
  • Cloudflare, which provides DNS, TLS and protection against attacks, and therefore processes connection data for every visit
  • Resend, which delivers account and confirmation emails
  • Mailgun, which delivers the newsletter, using its European infrastructure
  • jsDelivr and cdnjs, public content delivery networks from which parts of the site's front-end code are loaded. Your browser contacts them directly, which means they receive your IP address.

Analytics is not on this list, because it runs on my own infrastructure and the data is not shared with anyone.

Some of these companies are established outside the EU and Switzerland, including in the United States. Where that is the case, transfers rely on the recognition of adequate protection under EU & Swiss law, or on standard contractual clauses.

This site is operated from Switzerland and the Federal Act on Data Protection applies. I ask for your consent before sending you the newsletter or any material you have requested. For analytics and server logs I rely on a legitimate interest in understanding which articles are read and in running a secure website, which is proportionate given that the analytics are cookieless and do not identify you.

Where the GDPR applies because a visitor is in the European Economic Area, the same grounds are relied on under that regulation.

How long it is kept

Subscriber email addresses are kept until you unsubscribe or ask me to delete them. Server logs are kept for 14 days. Analytics data is aggregated and retained for 2 years.

Your rights

You may ask me for a copy of the personal data I hold about you, correct it, delete it, restrict how it is used, or object to that use. You may withdraw consent at any time, and every newsletter includes a one-click unsubscribe link.

Write to [email protected] and I will respond within one month.

If you believe your data has been handled improperly, you may contact the Swiss Federal Data Protection and Information Commissioner. If you are in the European Economic Area, you may also complain to the supervisory authority in your own country.

Children

This site is aimed at professionals and is not directed at children. I do not knowingly collect data from anyone under 16.

Changes

If this policy changes, the date at the top is updated. Material changes will be announced on the site.