Privacy Policy

Last updated: July 25, 2026

1. Who is the data controller

Bernard W. Piccione, an individual operating a personal advisory and publishing site, is the data controller for information collected here. Contact: info@bernardpiccione.com.

2. What we collect and why

2.1 Newsletter subscriptions

When you sign up for the "Seven Signals / Daily Signal" newsletter we store your email address, the signup source (which page/CTA), the timezone reported by your browser, your IP address and user agent for anti-abuse, and timestamps for signup, confirmation, and unsubscribe. Legal basis: your consent (GDPR Art. 6(1)(a)) via double opt-in.

3.2 Survey responses

If you complete our reader survey we store the topics you selected, the challenges you described, the email address used to open the invitation, and technical anti-abuse fields (IP, user agent). Legal basis: your consent.

2.3 Advisory requests, bookings, and payments

Advisory intake forms collect name, email, phone number (with country code), company, role, message, the tier you selected, and internal fields (status, notes). Booking flows for paid engagements pass your details to Stripe for payment processing and to Microsoft 365 / Outlook Calendar for scheduling. Legal basis: performance of a contract you have requested (GDPR Art. 6(1)(b)) and our legitimate interest in operating the advisory practice.

2.4 Cheat-sheet downloads

The cheat-sheet lead-magnet page collects your email, the source, and anti-abuse fields (IP, user agent). Legal basis: consent.

2.4b CIO Mentorship applications

The mentorship application form collects your name, email, organization, role/title, track interest, years in leadership, current challenge, definition of success, referral source, follow-up consent, and anti-abuse fields (IP, user agent). Used solely to evaluate fit and, with your consent, to follow up about cohort dates and next steps. Legal basis: consent and pre-contractual steps at your request (GDPR Art. 6(1)(a)/(b)).

2.5 Site analytics (first-party)

If you consent to analytics, we generate a random visitor ID and session ID stored in your browser and log each pageview (path, referrer, timezone) to our own database. We do not use Google Analytics, Facebook Pixel, or any advertising tracker. Legal basis: consent.

2.6 Interaction events

With analytics consent we also log book-purchase link clicks, newsletter link clicks, and share-button clicks (destination, UTM parameters) so we can measure what resonates.

2.7 Admin authentication

The site owner signs in via Google OAuth. If you are not the owner, this does not apply to you.

3. Third-party processors

We use these processors. Each has its own privacy policy.

• Lovable Cloud — hosting, database, and edge functions (data stored in the United States/EU depending on region).
• Lovable managed email (notify.bernardpiccione.com) — transactional and newsletter delivery.
• Stripe, Inc. — card and PayPal payment processing for paid engagements and subscriptions. We do not receive or store full card numbers.
• Microsoft 365 / Outlook Calendar — scheduling of advisory calls.
• Google reCAPTCHA v3 — spam and abuse prevention on forms. Google may set its own cookies and receive interaction signals.
• Google Fonts — the Inter typeface is loaded from Google's CDN.
• Google Sign-In — used only for the site owner's admin login.

4. How long we keep it

• Newsletter subscribers: until you unsubscribe, then contact + unsubscribe timestamp only, for CAN-SPAM/GDPR audit.
• Survey responses: up to 24 months from submission.
• Advisory requests: up to 36 months for engagement continuity and legal defense.
• Payment records: as required by applicable tax and accounting law (typically 7 years).
• Site visits and click events: up to 24 months in raw form; longer only in aggregate.
• reCAPTCHA signals: managed by Google per its policy.

5. Sharing and disclosure

We do not sell personal information. We share data with the processors listed above strictly to run the services you requested, with legal or tax advisors under confidentiality, or when required by law.

6. International transfers

We are based in the United States. If you are located in the European Economic Area, United Kingdom, or Switzerland, your data may be transferred to and processed in the US and other countries. Our processors rely on Standard Contractual Clauses or equivalent safeguards where applicable.

7. Your rights

Depending on where you live, you have rights to access, correct, delete, restrict, object to, or port your data, and to withdraw consent at any time. See Your Rights for the full list and how to exercise them.

8. Children

This site is not directed to children under 16 and we do not knowingly collect data from them.

9. Security

Data is stored on managed infrastructure with Row-Level Security policies, TLS in transit, and access limited to the site owner. No system is perfectly secure — please do not send sensitive information (health data, government IDs, etc.) through forms on this site.

10. Changes

We will post material changes to this page and update the "Last updated" date.

11. Contact

Questions or requests: info@bernardpiccione.com.