Privacy policy
Effective date: 3 August 2026
The Hosted Startup (“the site”, “we”, “us”) is a personal blog run by an individual. This policy explains what personal data we collect, why, and your rights under the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The data controller is Lukas Moers, a private individual based in Sweden, operating this site in a personal capacity (not on behalf of a company). The site may also be used to offer consulting services; if you contact us about that work, we process your details to respond to the inquiry.
Contact for privacy requests: info@hostedstartup.com
2. What we collect
Depending on how you use the site, we may process:
Data | When |
|---|---|
Email address | You subscribe, sign in, or create a member account |
Name (optional) | You provide it in your member profile |
Membership status | Free (or paid, if we enable paid plans later) |
Signup / referral source | Attribution when you join (member source tracking) |
Comment content and member identity | You leave a comment |
Approximate location derived from IP | Ghost may store geo-related fields for members |
IP address and standard server logs | When you visit the site (hosting) |
Analytics events (pages viewed, referrers, country-level traffic) | Site visits via Ghost web analytics |
Member ID and free/paid segment | When you browse while signed in (analytics audience filters) |
Email engagement (opens and clicks) | Newsletter and transactional email tracking |
Email hash for avatar lookup | Ghost may query Gravatar using a hash of your email |
Theme preference | Stored in your browser as |
We do not currently collect payment card data. If paid memberships are enabled later (for example via Stripe), payment details would be handled by that payment provider and disclosed here.
3. Why we use your data (purposes and legal bases)
Purpose | Legal basis (GDPR) |
|---|---|
Send newsletters and membership emails you signed up for | Consent (you can withdraw anytime) |
Measure newsletter opens and clicks | Consent (informed at signup via Portal notice and this policy; you can unsubscribe or request deletion anytime) |
Provide member accounts, magic-link sign-in, and member-only features | Contract / steps prior to a contract; legitimate interests in running the membership system |
Respond to consulting or other inquiries you send us | Steps prior to a contract; legitimate interests in answering requests |
Essential session cookies so you stay signed in | Strictly necessary for the service |
Security, abuse prevention, and keeping the site running | Legitimate interests |
Understand traffic and content performance (Ghost web analytics / Tinybird) | Legitimate interests in improving the publication |
Attribute where new members came from | Legitimate interests in understanding growth |
Remember light/dark theme preference | Legitimate interests / strictly necessary for UI preference you choose |
Show profile avatars via Gravatar | Legitimate interests in displaying member/user avatars |
We do not sell your personal data.
4. Web analytics (Ghost + Tinybird)
We use Ghost’s built-in, first-party web analytics, which uses Tinybird as a processor.
- Analytics are designed to be cookie-free: they do not use cookies or other persistent browser storage to identify you across sessions or devices.
- Unique visitors are counted within roughly 24-hour windows.
- Tracking is served in a first-party way through this site.
- Tinybird processes this analytics data in AWS eu-central-1 (Frankfurt, EU).
- If you are signed in as a member, we may associate views with your member ID and free/paid status so we can see what resonates with different audiences.
- This analytics data is not sold or shared for advertising.
5. Email (Mailgun)
Newsletters and membership-related email are delivered through Mailgun in the EU region.
We enable Ghost’s open tracking and click tracking. That typically means:
- A small tracking image may load when you open an email (open tracking).
- Links in emails may be wrapped so clicks can be recorded (click tracking).
By signing up (and agreeing to the Portal signup notice that links to this policy), you consent to this email engagement measurement so we can understand newsletter performance. Ghost applies open/click tracking site-wide; there is no per-person “emails without tracking” switch. If you do not want this measurement, unsubscribe from newsletters or request deletion of your member data.
You can unsubscribe from newsletters via the link in any email, or manage preferences in your member account (Portal). To request deletion of your member data, email info@hostedstartup.com.
6. Cookies and similar technologies
Ghost uses strictly necessary cookies for member authentication and sessions (for example so you stay signed in). Those are required for the membership features to work.
We do not load third-party advertising pixels or Google Analytics in the theme.
Because site analytics are cookie-free and membership cookies are essential, we do not show a separate cookie consent banner for the current setup. Email open/click tracking is described in section 5 and is separate from website cookies.
Your browser may store hs-theme in localStorage for appearance preference only.
7. Where data is processed (processors)
We use service providers who process data on our behalf:
Provider / role | Location / notes |
|---|---|
Ghost (self-hosted application and database) | On a Hetzner VPS in Germany |
Mailgun | Email delivery and related logs — EU |
Tinybird | Web analytics processing — AWS eu-central-1 (EU) |
Hetzner | VPS / hosting infrastructure in Germany |
jsDelivr (CDN) | Ghost Portal / Search scripts may load from this CDN; the CDN sees IP and request metadata |
Gravatar (Automattic) | Optional avatar lookup using a hash of your email; may involve processing outside the EEA |
If a post embeds third-party content (for example YouTube or similar), that third party may collect data under its own policies when the embed loads.
This site uses Ghost’s social web / ActivityPub features. Public profile information and public posts may be federated to other servers when those servers or their users follow or request content. Those remote servers process data under their own policies.
8. Retention
- Member / subscriber data: kept while your account or subscription is active. After a deletion request, we aim to remove it from the live system promptly; copies in backups may remain for up to about 30 days before rotation.
- Server logs: typically retained for about 90 days, then rotated or deleted according to normal hosting practice.
- Analytics: retained as configured in Ghost / Tinybird while we operate and review the publication.
- Email engagement stats: retained with newsletter performance records in Ghost while we operate the publication.
9. Security
We take reasonable technical and organisational measures appropriate to a personal blog (HTTPS, access controls to Admin, updates). No method of transmission or storage is perfectly secure.
10. International transfers
Primary hosting, Mailgun, and Tinybird analytics are in the EU. Some processors (for example Gravatar or a CDN) may store or access data outside the EEA. Where that happens, we rely on appropriate safeguards required by law (such as standard contractual clauses) where applicable.
11. Your rights (GDPR)
If you are in the EEA/EU (and in similar cases under applicable law), you may have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase data (“right to be forgotten”)
- Restrict or object to certain processing
- Data portability
- Withdraw consent where processing is based on consent (without affecting prior lawful processing)
- Lodge a complaint with a supervisory authority — in Sweden, Integritetsskyddsmyndigheten (IMY) (imy.se)
How to exercise rights
- Email info@hostedstartup.com
- Unsubscribe or manage email preferences via Portal / links in emails
- Delete or update your member account where Ghost provides that in Portal
We may need to verify your request before acting on it.
12. Children
This site is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it.
13. Changes
We may update this policy when our practices or stack change. The effective date at the top will be revised. Significant changes may also be noted on the site or by email where appropriate.
14. Contact
Questions about privacy: info@hostedstartup.com