Privacy Policy

Who We Are

Curated Supply is an independent editorial site operated by Justin Farrugia, based in Malta. For the purposes of the EU General Data Protection Regulation (GDPR) and Malta's Data Protection Act, Curated Supply is the data controller for the personal data described in this policy.

You can reach us about anything in this policy at hey@madebyjus.com.

What We Collect, and Why

Your email address, if you subscribe to the newsletter. We use it to send the newsletter and nothing else, along with a note of which page you subscribed from so we know which parts of the site are working. The legal basis is your consent, which you give by subscribing and can withdraw at any time.

What you type into the contact form or the submit-a-product form: your message, your email address, and your name if you give it. We store these so we can read and reply to them. The legal basis is our legitimate interest in answering the people who write to us.

Aggregate analytics about how pages are used. We use Ahrefs Web Analytics, which is cookieless and does not build a profile of you or track you across other websites. It tells us which pages are read and roughly where readers came from, in aggregate. The legal basis is our legitimate interest in understanding whether the site is working.

Standard server logs. Our host records technical information such as IP address, browser type, and the time of a request, as almost every web server does. These logs exist to keep the site running and to protect it from abuse, and we do not use them to identify individual readers. The legal basis is our legitimate interest in operating and securing the site.

We do not collect names, addresses, payment details, or account credentials, because the site has no accounts, no checkout, and nothing to log in to.

Cookies

Curated Supply does not set any cookies of its own, and does not use local storage to track you. Our analytics provider is cookieless by design.

Affiliate links are the exception, and they are not ours. When you click through to a retailer, that retailer, or the affiliate network sitting between us, may set a cookie in your browser so the purchase can be attributed to us. That cookie is set by them, on their terms, once you have left our site. Their privacy policies govern it, and your browser settings control it.

If we ever introduce cookies of our own, or join an affiliate network that sets them while you are still on our pages, we will ask for your consent before any non-essential cookie is set, and this section will be updated first.

The Contact Form

The contact form on our About page and the submit-a-product form send what you type to our own database, hosted by Supabase, together with the page you sent it from. Nobody but us can read it. We keep a message for as long as we need to deal with what you wrote about, and delete it after that.

Affiliate Links and Outbound Clicks

Curated Supply earns commission on some outbound links. Where a link is managed through a link service, clicking it sends you through a redirect that may use your approximate location, derived from your IP address, to send you to the right regional store rather than one you cannot buy from.

When you click a buy link we record the click itself: which product, which part of the page the link was on, which page of our site you were on, and the country the request came from. We do not record your IP address, your browser, or anything that identifies you, and we set no cookie. It tells us which products and pages earn their keep, not who you are. The legal basis is our legitimate interest in running the site.

Who Else Handles Your Data

We keep the list of companies involved deliberately short. As of the date above, they are: Beehiiv, which runs the newsletter and holds subscriber email addresses; Vercel, which hosts the site and processes server logs; Supabase, which stores contact-form messages, product submissions and buy-link click counts; Ahrefs, which provides cookieless analytics; and Geniuslink, which handles affiliate link redirection.

Each of these acts on our instructions under a data processing agreement. We do not sell personal data, and we do not share it for advertising.

International Transfers

Some of the companies above are based in the United States, so your data may be processed outside the European Economic Area. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard recognised under GDPR.

How Long We Keep It

Newsletter email addresses are kept until you unsubscribe, after which they are removed from our active list. Contact-form messages and product submissions are kept until they have been dealt with. Server logs are kept for a short operational period and then rotate out. Click records and analytics data hold nothing that identifies you.

Your Rights

Under GDPR you have the right to ask what personal data we hold about you, to have it corrected, to have it deleted, to receive a copy of it in a portable format, to object to processing based on legitimate interest, and to withdraw consent at any time. Withdrawing consent for the newsletter is as simple as the unsubscribe link at the bottom of every issue.

To exercise any of these rights, email hey@madebyjus.com. We will respond within one month.

If you believe we have handled your data badly, you have the right to complain to Malta's Information and Data Protection Commissioner (idpc.org.mt), or to the supervisory authority in the EU country where you live.

Children

Curated Supply is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has subscribed to the newsletter, email us and we will remove the address.

Changes to This Policy

If what we do with personal data changes, this page changes first, and the date at the top will tell you when. Material changes affecting newsletter subscribers will be sent to subscribers directly.