Privacy

Last updated 16 September 2026

This site is one person's. It sells three things and runs a few games. It collects as little as it can get away with, and this page says exactly what that is rather than describing a policy in general terms.

Who is asking

Christoforos Sisamos, in Cyprus, is the data controller for everything on sisamos.net and its subdomains: research.sisamos.net, newrome.sisamos.net, gg.sisamos.net, cv.sisamos.net and portfolio.sisamos.net.

Write to chris@sisamos.net about anything on this page. There is no data protection officer, because at this size the law does not require one and inventing a role nobody fills would be worse than saying so.

What is collected, and why

Your email address

When you buy something. It is how the thing you bought reaches you, how Stripe sends your receipt, how you are told your order arrived and when it is due, and how you get back in if you lose access. It is not added to any mailing list, and nothing is ever sent to it that is not about your own order. Legal basis: performing the contract you entered into.

Your card details

Never seen by this site. The payment form is Stripe's own, running inside a frame Stripe serves; the card number is typed into their page, not this one, and never touches this site's servers. What is kept here is the identifier of the payment and a short reference code.

Files and text you send for a project review

The files you attach, the brief you write, and the answer to the one question asked afterwards. They are stored privately, read to do the work you paid for, and are not shown to anyone else or used to train anything. Legal basis: performing the contract.

A cookie called __session

Set once, after you buy the book, so that newrome.sisamos.net knows you may read it. It holds a random string and nothing else: no name, no address, nothing readable. It is necessary for the thing you asked for, which is why there is no banner asking permission for it. It lasts a year, and clearing your cookies removes it. You can get back in with your email and your reference code.

Your IP address, briefly

Every request to a server anywhere carries one. Here it is used to count requests per address so that the payment and recovery endpoints cannot be hammered, and it lives in memory for minutes rather than being stored. Google's hosting keeps its own request logs. Legal basis: legitimate interest in keeping the site working.

On gg.sisamos.net only: a player name and scores

The arcade keeps a leaderboard. The name on it is the one you type, and choosing a name that is not yours is entirely reasonable. Play is signed in anonymously, which means a random identifier in your browser and no account.

Visitor statistics, with nothing kept on your device

Every page on sisamos.net and its subdomains counts visits with Cloudflare Web Analytics. It sets no cookie, stores nothing in your browser, and has no way to recognise you on a later visit or on another site, which is why you are not asked to agree to it: there is nothing stored to agree to. What is counted is the page, where you came from, the country, and the sort of browser and device, as totals rather than as a record of a person. Your address reaches Cloudflare the way it reaches any server you visit, and is used to work out the country rather than kept against the visit. Legal basis: legitimate interests, in knowing which pages are read. This used to be Google Analytics behind an Allow button. It was replaced because consent-gated counting measures only the people who press Allow, which is a number that cannot be divided by anything, and because a cookie notice on the first page of a book is a poor greeting. The old sisamos_analytics_consent cookie is no longer read or set; if you have one, it does nothing and will expire.

What is kept in your browser

The full list. None of them is for advertising, and none of them follows you to anybody else's site:

• __session, and this is the important one: it is the book you bought. When you pay for New Rome, the server puts a token here, and it is what the site checks to let you read the chapters. It lasts a year, it is marked HttpOnly so no script on the page can read it, and it is shared across sisamos.net and newrome.sisamos.net because you buy on one and read on the other. Refusing it means being unable to open what you paid for, which is why it is not something you are asked about.
• nrlisten, your place in the audiobook, so it starts again where you stopped.
• sisamoslang, whether you chose English or Greek, so the page opens in the language you were reading last.
• __stripe_mid and __stripe_sid, set by Stripe when its payment code loads, and used by Stripe to detect card fraud. They are Stripe's rather than ours, and we cannot read them.
• sisamos_analytics_consent, which is retired. It answered the old Google Analytics notice. Nothing reads or writes it any more, and the site now deletes it on sight, so it disappears the next time you visit.

The visitor counting adds none of these. It stores nothing at all.

Who else sees it

Each doing one job:

• Stripe takes the payment and is the only party that handles your card. They are a controller in their own right for the payment, under their own privacy policy.
• Google hosts the site, the database and the stored files, through Firebase and Google Cloud. The servers used are in the European Union.
• Resend delivers the emails about your order, so they handle your address and what those messages say. They act on instruction only, as a processor, and there is no mailing list for them to add you to. Resend is a United States company: mail for this site is dispatched from their Irish region, but their own records of it are held in the US under the European Commission's Standard Contractual Clauses. Their privacy policy.
• Google Fonts serves the typefaces. Loading a page here makes your browser fetch fonts from Google, which means Google sees that request and the address it came from. This is said plainly because it is easy to leave out.
• Cloudflare counts the visits, as described above. No cookie, nothing stored on your device, and nothing that identifies you. Their privacy policy.

Nobody else. Nothing is sold, rented, or shared for marketing.

How long it is kept

• Purchase records for as long as you might need to get back into what you bought, and as long as tax law requires a record of the sale, which in Cyprus is six years.
• Review files and briefs for sixty days, then the storage they sit in deletes them by itself. That is the thirty days the page gives you to add more to an order, and thirty after it in case you come back with a question. Ask and they will be deleted sooner.
• Access records for the book until you ask for them to go, or the purchase is refunded.

What you can ask for

Under the GDPR you may ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, ask for it in a portable form, or object to a use of it. There is no form and no process: send an email and it gets done, normally within a few days and always within a month.

One honest caveat. Deleting the record of your purchase deletes the thing that proves you bought it, so access goes with it. You will be told that before anything is deleted rather than after.

If you think this has gone wrong and writing here has not fixed it, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the authority where you live.

Children

Nothing here is aimed at children, and nothing sold here is for them. No age is asked for, and none is inferred.

If this page changes

The date at the top changes with it. A change that affects what is collected or who sees it will be said in the text rather than slipped in.

See also the terms of sale. Questions to chris@sisamos.net.