ABOTAN · Policies & reader information
Privacy Notice
Policy draft — jurisdiction-specific legal review pending. No compliance guarantee.
Who to contact
ABotan is the public site name. Contact melinemek@gmail.com for privacy and rights requests. A personal name is not published here. LEGAL REVIEW REQUIRED — the legal operator/data controller, required address/disclosures and jurisdiction must be confirmed; this draft is not a completed controller identification notice.
Information received
The submission form receives a credit/name, private email, title, work, type and language; optional biography, image and source/rights context; and dated declarations. Country and city/region can be entered as free text and remain private, as does historical residence information. Rights reports receive contact email, an optional name, content URL, category and explanation.
Public and private
Approved work, its author/credit, language, approved image and public source/original-publication fields are public. Contact email, residence, private biography, permission evidence, acceptance records, internal notes and complaint details remain in admin systems. A separately approved author biography can be public. Information included within the work or visible image itself may become public.
Purposes and legal bases
Information is used for editorial review, correspondence, publication, rights handling, abuse prevention and relevant records. Rights declarations, contractual permission and acknowledgement of this notice are distinct; accepting terms is not blanket privacy consent. No marketing-consent checkbox is used. LEGAL REVIEW REQUIRED — establish the basis for each processing purpose, any genuinely necessary separate explicit consent, sensitive-data handling and statutory exceptions before relying on this draft.
Infrastructure and transfers
The code supports a Vercel frontend, Render API, MongoDB records and private Vercel Blob images. Actual providers, locations, backup arrangements and contracts need operator verification. The public contact uses Gmail. Hosting and email providers may process request/network data. LEGAL REVIEW REQUIRED — determine recipient roles, international transfers and any required safeguards; a terms checkbox does not authorize all transfers.
Technical data and external services
HTTP request logs contain a random visitor ID for ordinary browser requests, request method/path, status, timing, traffic classification, and available browser/device descriptions. Browser-provided model, browser/platform versions, screen dimensions, language and timezone may be recorded; unavailable values remain unknown. These descriptions are not used to recognize a physical device or authenticate anyone. Bots and server tools are classified separately using fallible User-Agent heuristics. Authenticated requests retain the verified account identity. No passwords, authentication cookie values or hardware identifiers are included in these request records. The visitor cookie lifetime is not a database log-retention period; automatic deletion of these logs is not currently configured. Fonts are served by ABotan. Optional maps, external images, links and calendar services may contact their providers. First-party request statistics use the visitor cookie described here; no advertising tracker is added. When configured, Google Analytics 4 (Google) measures public website usage only after you allow analytics. Before permission, after rejection, and in excluded browsers the application does not load the Google tag. It is separate from necessary storage and from MongoDB request/audit logs. No advertising, remarketing, Google Signals or User-ID feature is intentionally enabled. Allow or reject analytics with equally accessible controls and change or withdraw your choice at /cookies. abotan-analytics-consent stores the choice and version in localStorage for up to 180 days. Withdrawal disables further collection and attempts to clear this integration’s readable analytics cookies; it cannot recall requests already sent or erase data already held by Google. If storage is blocked the choice applies to the current document only. Language/theme, authentication, submission declarations and technical logs remain separate. LEGAL REVIEW REQUIRED — operator jurisdiction, legal basis, provider terms and international transfers must be reviewed before activation. GA cookies use the _abotan prefix (for example _abotan_ga and _abotan_ga_<stream suffix>) and have a configured maximum lifetime of 180 days without rolling extension; browser restrictions may shorten this. abotan-analytics-excluded is a browser-profile localStorage preference set only through authenticated Admin Settings. It persists after logout until changed or cleared and is independent of analytics permission. Other browsers and private profiles require separate choices. No fingerprint is used.
Storage and media
Browser storage is described in /cookies. Work drafts are no longer saved or restored; older drafts can be deleted using the privacy controls. Retry keys use sessionStorage. The admin cookie lasts at most 12 hours. New uploaded images are re-encoded to remove metadata; visible private details are not removed. ABotan uses a random first-party visitor cookie (abotan_visitor). It is HttpOnly, Secure in production, SameSite=Lax and shared across abotan.com and its subdomains, with a lifetime of up to one year. It groups HTTP requests from the same browser; it does not identify a person or physical device. Clearing or blocking site cookies removes or prevents this continuity. An ordinary browser request without a valid cookie receives a new ID immediately. Blocking cookies prevents continuity. With permission, Google may process browser/device category, sessions, engagement, coarse public page groups, referrer origin, successful submission completion and calendar downloads. ABotan sends no form values, work text, contributor names/emails, private/admin pages, search terms, MongoDB IDs or abotan_visitor IDs to GA4. Public content identifiers are replaced with grouped routes, so analytics is not a per-work readership report. Google receives connection information when a request is made; ABotan does not add IP addresses to event payloads. Analytics is not authentication or identification of an exact physical device. Google property retention is configured in the Google console, not by this code. The deployment recommendation is two months of user/event retention with reset on activity disabled; the live setting has not been verified. Standard aggregated reports may have different retention. Google is a separate provider; processing locations and transfer safeguards depend on its applicable terms and the operator’s circumstances and require legal review. No compliance certification is claimed.
Retention and erasure
No automatic expiry currently exists for submissions, moderation/acceptance records or rights reports. Editors must review necessity and handle erasure requests; indefinite retention is not justified by this technical default. Unpublishing hides content while retaining internal records. A linked publication must be deleted before its source submission can be deleted; deleting the publication retains the private submission for a separate decision. Referenced images remain until no longer needed and eligible for cleanup. Backups and third-party caches require separate handling. LEGAL REVIEW REQUIRED — set defensible retention periods, deletion/backup procedures and any limited legal-hold rules.
Requests
Use the rights-report form or contact email for access, correction, erasure, withdrawal or an objection, with the affected URL and enough context to identify the record. Proportionate identity/authority verification may be necessary. Applicable statutory remedies and deadlines remain available; using this site’s process is not a waiver. LEGAL REVIEW REQUIRED — confirm the jurisdiction-specific request procedure and response deadlines.