Privacy notice

Pareto Learn publishes original explanations of the ideas in non-fiction books. Making that work takes very little information about you, and we describe that little without hedging.

If you read only one paragraph, make it this one: to create an account we ask for your email and a password. We store your reading preferences and where you left off in each explanation. We measure how the texts are read only if you accept analytics, and you can decline without losing any feature.

• We do not sell your data or hand it to data brokers.
• We run no targeted advertising and no third-party trackers.
• We do not train machine learning models on your data.
• We ask for no sensitive data and infer none. The one nuance — which particular book you read — we spell out below.
• Everything we measure for analytics depends on you accepting it.

Today, a Mexican individual. Tomorrow, the company once incorporated. The contact address doesn't change.

Controller

Álvaro Hernández, an individual carrying on business activity, in his capacity as operator of Pareto Learn (paretolearn.com).

Address for receiving notices

Not yet published — Write to contact@paretolearn.com and we'll send it to you in writing.

Contact email

contact@paretolearn.com

Designated person for personal data

Álvaro Hernández — contact@paretolearn.com

Being an individual is not an exemption. The LFPDPPP regulates “private individuals or legal entities” that process personal data (art. 2, section XVI), and the only relevant carve-out — art. 1, section II — covers collection for exclusively personal, non-commercial use, which is not our case.

Mexican law requires designating a person to handle data subject requests (art. 29 LFPDPPP). This designation is not a GDPR data protection officer: we are not required to appoint one, because we are not a public body, we do not process special categories of data, and we do not do so on a large scale (art. 37.1 GDPR).

Pareto Learn is currently run by three partners and the company has not yet been incorporated. Once it is, the company will replace the individual as data controller. That change will be announced on this same page under “Changes to this notice”, and it will not by itself expand any purpose or any transfer.

Legal basis: Arts. 2 section XVI, 15 section I and 29 LFPDPPP; arts. 4(7), 13(1)(a) and 37(1) GDPR.

This is the complete list of what we handle: what we store in the database, what stays in your browser, and what our traffic analytics records. There is no hidden “other data” category. Two things sit outside the table, and both are stated: the logs any request leaves on our server, in the note right after the table, and what your browser sends to Google when it loads the fonts, which we neither receive nor store.

The table below, together with the two paragraphs that follow it, is the real inventory of what we store: what the data is, where it lives, what it is for, on what legal basis we process it if you are in the European Union, and how long we keep it.

About the IP fingerprint: in the sign-up table we never store your IP address in the clear, only the result of running it through an HMAC function with a secret server-side salt. Even so, because we keep the salt, that value remains pseudonymised personal data, not anonymous data. We say this because calling it “anonymised” would be inaccurate, and that is why it appears in this table and within the scope of your rights.

In addition, like any web server, ours logs the requests it receives (IP address, timestamp, path and browser) in order to operate the service and detect abuse. Those logs are kept for 90 days and are not cross-referenced with your account. We process them on our legitimate interest in the security and operation of the service (art. 6(1)(f) and recital 49 GDPR).

Note: None of this is sensitive personal data under art. 2, section VI of the LFPDPPP, nor a special category under art. 9 GDPR. We do not ask for or infer ethnic origin, health status, beliefs, union membership, political opinions, sex life or biometric data. Nor do we deliberately process health data: we do not measure what you read in order to infer your physical or mental condition, we do not cross-reference the title you read with any characteristic of yours, and we do not use that signal to segment you or for anything other than deciding what to publish next. If our processing were to fall within the scope of Washington's My Health My Data Act, or of equivalent state laws on consumer health data, we will publish the separate consumer health data policy those laws require, linked prominently from the homepage, and we will ask for the separate consent they provide for.

Legal basis: Arts. 15 section II and 18 LFPDPPP; arts. 5(1)(c), 13(1) and 13(2) GDPR.

Some purposes are essential to providing the service. Others are separable: if you say no, the product works exactly the same.

If we ever wanted to use your data for a purpose other than those in this notice — advertising profiling, monetised personalised recommendations, or model training, say — we would have to ask you again. That is not a marketing promise: it is what the law requires.

Legal basis: Art. 11 LFPDPPP; arts. 5(1)(b) and 6(4) GDPR.

With the providers that keep the site running, acting on our instructions. And with two genuine third parties: Google, for the fonts, and Amazon, if you click a bookstore link.

Mexican law draws a distinction that often gets blurred. When a provider processes data on our behalf and under our instructions, it acts as a processor within the meaning of art. 2, section XII LFPDPPP. Passing data to it is not a transfer: art. 2, section XX defines a transfer as a communication made to someone other than the data subject, the controller or the processor, so the processor falls outside the concept by legal definition. That is why it does not require your acceptance. When data reaches someone who decides independently what to do with it, that is a transfer to a third party.

Note: We do not sell your data, we do not hand it to data brokers, there are no ad networks on the site and there is no third-party pixel.

Legal basis: Arts. 2 sections XII and XX, and 35 LFPDPPP; arts. 4(8), 13(1)(e) and 28 GDPR; judgment of the Court of Justice of the European Union in Fashion ID, C-40/17, of 29 July 2019, on joint controllership where a third party's resources are embedded.

The database is in the United States. If you live in the European Union this matters to you; if you live in Mexico, the law asks nothing special of you because of it.

Our database, authentication and file storage run on Supabase, in its us-east-1 region (United States). The contact mailbox is on Google Workspace. The analytics instance is hosted by IDONIA.

For people residing in the European Union or the European Economic Area, those data flows rely on the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914, which form part of Supabase's data processing agreement. That agreement, with the clauses already incorporated, is published by Supabase at supabase.com/legal/dpa, and the official text of the clauses is that of Commission Implementing Decision (EU) 2021/914 itself, available at eur-lex.europa.eu. If you would rather we sent it to you than go looking for it, write to contact@paretolearn.com and we will send you a copy, free of charge. Supabase is not certified under the EU–U.S. Data Privacy Framework, so we do not invoke it. Google LLC is an active participant in that framework, covered by Commission Implementing Decision (EU) 2023/1795 of 10 July 2023.

For people residing in Mexico, the LFPDPPP imposes no adequacy requirements or standard clauses for data to leave the country, and hosting in the United States requires no authorisation from any authority.

Note: We are evaluating moving the database to a European Supabase region. It is not an obligation we have today: it is the cleanest way to make this section unnecessary.

Legal basis: Arts. 44, 45, 46 and 13(1)(f) GDPR; Commission Implementing Decision (EU) 2021/914 of 4 June 2021; Commission Implementing Decision (EU) 2023/1795 of 10 July 2023; art. 35 LFPDPPP.

These are the periods we apply. When they run out, the data is deleted or turned into an aggregate statistic that no longer speaks about anyone.

• Account, profile, preferences, progress and bookmarks: for as long as the account exists. If you ask us to delete it, 30 more days of grace in case it was a mistake, and then it goes.
• Monthly quota used: 12 months.
• Reading analytics (reading_sessions and events) and bookstore link clicks: 13 months as individual records. After that they are irreversibly aggregated and stop being personal data.
• Traffic analytics in our own Plausible instance: 13 months.
• Cryptographic IP fingerprint from sign-up: 12 months.
• Cookie for reads without an account (pl_reads): 62 days.
• Web server logs: 90 days.
• Emails you send us: 24 months from the close of the matter, so we can evidence how we responded.

Legal basis: Arts. 10, 11 and 12 LFPDPPP; arts. 5(1)(c), 5(1)(e), 13(2)(a) and 25 GDPR.

You can see what we hold about you, correct it, take it with you, object to some uses and ask us to delete it.

• Access: find out what data of yours we process and get a copy.
• Rectification: correct anything wrong or incomplete.
• Cancellation or erasure: ask us to delete data once it is no longer necessary, or once you withdraw the consent it rested on.
• Objection: ask us to stop processing data we handle on legitimate interests, for reasons relating to your situation.
• Restriction of processing: ask us to keep the data but stop using it while a dispute is resolved.
• Portability: receive, in a machine-readable file, and have transmitted to another controller, the data you provided to us and also the data we observed from your activity — your reading progress and bookmarks, your reading sessions and product events — provided we process it on your consent or to perform the contract.
• Withdraw your consent to analytics at any time, without that affecting anything we did before you withdrew it.
• Lodge a complaint with the relevant authority: your country's supervisory authority if you are in the European Union, the Secretaría Anticorrupción y Buen Gobierno if you are in Mexico, and your state Attorney General or the Federal Trade Commission if you are in the United States.

Note: Two honest clarifications. Portability and restriction are GDPR rights: Mexican law recognises only access, rectification, cancellation and objection. If you live in Mexico and ask us for an export, we will still give it to you, but as a courtesy and not as a legal obligation. And objection only makes sense against what we process on legitimate interests; against what we process to perform the contract, the remedy is not objecting but closing the account.

Legal basis: Arts. 21 to 27 and 31 to 34 LFPDPPP; arts. 15 to 22 GDPR.

Write to contact@paretolearn.com from your account's email and tell us what you want. We do it by hand, within the legal deadlines, and free of charge.

To act on the request we need to be able to confirm it is you. Writing from the email address tied to the account and telling us which right you are exercising and over what data is enough. If that doesn't let us identify you, we will ask for something more — and only the bare minimum.

If you reside in the European Union or the European Economic Area, we will answer without undue delay and at the latest within one month of receiving the request, extendable by two further months if the matter is complex; in that case we would tell you within the first month and explain why.

If you reside in Mexico, we will communicate our determination within a maximum of twenty days of receiving the request, and give it effect within the following fifteen days. Both periods may be extended once, by an equal period, where the circumstances justify it.

Exercising these rights is free. Since everything is delivered by download or email, there are no reproduction or delivery costs to pass on.

Legal basis: Arts. 22, 23, 24, 31, 33 and 34 LFPDPPP; arts. 12(3), 12(4) and 12(5) GDPR.

Two things depend on your consent: reading analytics and campaign attribution. Today they travel together in a single button, and below we explain why that is a shortfall on our part. Everything else is either needed to provide the service or rests on a legitimate interest you can challenge.

The first time you visit we show you a notice with two real options: accept analytics, or keep only the essentials. If you choose the essentials, no identifier is created, nothing is stored, and not a single measurement request leaves your browser. The site works exactly the same.

Withdrawing consent does not make what we did beforehand unlawful, but it does leave us without a legal basis to keep those records. So erasure is not an extra you have to ask for: when you withdraw consent we delete your pseudonymous identifier, your reading sessions, the campaign parameters and the product events tied to it, within thirty days at most. All we keep is the already-aggregated statistics, which speak about nobody.

Legal basis: Art. 7, sixth paragraph, and art. 15 section IV LFPDPPP; arts. 4(11), 7(1), 7(2) and 7(3) and recital 43 GDPR; European Data Protection Board Guidelines 05/2020 on consent, § 60.

Encryption, permissions that deny by default, and the smallest possible number of people with access.

• All traffic runs over HTTPS, and the database is encrypted at rest and in transit.
• Passwords are not stored: what is stored is their cryptographic derivation, which nobody on the team can reverse.
• Tables holding personal data use row-level security that denies by default: without an explicit rule, nobody sees anything.
• The service key that can bypass those rules lives only on the server, never in the browser and never in the code repository.
• The whole site sits behind a global rate limit per IP address, the same for every route: there are no tighter limits on the sensitive endpoints yet, and adding them is still pending. Email verification at sign-up is switched on in our Supabase Auth configuration.
• Only the project's partners have access to the database, under a duty of confidentiality that survives their leaving the project.

Note: We are not going to promise you absolute security, because nobody can. We are going to tell you what we do, and tell you if something fails.

Legal basis: Arts. 18 and 20 LFPDPPP; art. 32 GDPR.

We tell you. We tell the authority where the GDPR requires it — or, if you are in the United States, your state's law.

If you reside in Mexico and a security breach occurs that significantly affects your economic or moral rights, we will notify you immediately, with the information you need to take action. Mexican law does not require notifying the authority, and we are not going to claim it does in order to look thorough.

Where the GDPR applies, we will notify the supervisory authority without undue delay and at the latest within 72 hours of becoming aware, and we will tell you where the risk to your rights and freedoms is high. We document every breach internally, whether or not it is notified.

If you reside in the United States, a breach is governed by your state's notification law. All fifty states have one and none of them exempts us for being small: what decides whether it reaches us is the activity we direct at that state, not our revenue. The pair we hold — your email together with the credential that opens your account — falls within those laws' definition of personal information; we store the password only as a cryptographic derivation, and even so we treat it as covered rather than argue about whether a hash is a password. Our commitment, whichever state you live in: we will notify you without delay and in no case later than thirty calendar days after we discover the breach or are notified of it. Notice to your state's authority does depend on which state it is, because neither the deadlines nor the thresholds line up: California requires a sample copy of the notification to be sent to the Attorney General within fifteen calendar days of notifying you, where more than five hundred residents of that state are affected (Cal. Civ. Code § 1798.82(a) and (f)); Vermont requires a preliminary notice to its Attorney General within fourteen business days and with no minimum number of affected residents; Texas, from two hundred and fifty affected residents. We will meet whichever deadline applies to your state; we are not going to write that one single standard covers all fifty.

Legal basis: Art. 19 LFPDPPP; arts. 33 and 34 GDPR; Cal. Civ. Code § 1798.82, as amended by Senate Bill 446, and the other U.S. state breach notification laws.

The service is not aimed at minors and we do not ask anyone's age.

Pareto Learn is not directed at minors and, in particular, it is not directed to children under thirteen, nor do we knowingly collect their personal information within the meaning of the United States Children's Online Privacy Protection Act and its implementing rule, 16 CFR Part 312. The service is intended for adults under the law of wherever you live. We do not ask for or verify anyone's age at sign-up, and we would rather say so than imply a control that doesn't exist. If we detect, or are told, that an account belongs to a child under thirteen, we delete it along with its data, no questions asked. If the account belongs to a minor aged thirteen or over, we delete it at the request of whoever holds parental responsibility or guardianship.

There are no automated decisions about you. There are per-user activity statistics, and the GDPR calls that profiling: we say so rather than deny it. No decision affecting you comes out of those figures.

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. What we do do, and would rather say plainly: for internal use we keep activity statistics per registered user — sessions, active time, distinct pieces of content, active days, completed reads, and the dates of first and last activity — tied to your account and not only to a browser pseudonym. The reading figures are only filled in if you accepted analytics; if you declined, your row is still there but at zero. They serve one purpose: knowing how many of the people who sign up actually get round to reading, and who comes back, and deciding from that what we build and publish next. That falls within the definition of profiling in art. 4(4) GDPR, so we are not going to write that we do not profile. What does not happen is any decision about you coming out of it: nothing we measure changes your plan, your limits, what you see or what you pay. The monthly read counter and the multiple-sign-up flag are fixed, checkable rules, not assessments of you as a person.

The multiple-sign-up flag, moreover, blocks nobody: it just tells us to look at it by hand. Behind a single IP address there may be an office, a university or an entire mobile network, and throwing real people out over that signal would cost far more than it would solve.

Legal basis: Arts. 4(4) and 22 GDPR; Article 29 Working Party Guidelines WP251rev.01 on automated individual decision-making and profiling, endorsed by the European Data Protection Board.

Europe is not our market, but we do measure how people read and we do offer terms written for Union consumers. We apply the GDPR rather than argue about whether it reaches us.

We are established in Mexico and our main market is Mexico and Latin America. There are no euro prices, no European domain, no campaigns aimed at Union countries, and the English version is built for the United States. The fact that the site can be viewed from Europe, or that it is in Spanish, would not be enough to say we are “offering goods or services” to people in the Union within the meaning of art. 3(2)(a) GDPR: recital 23 says so itself. But there is one indication that does weigh, and we are not going to hide it: our terms include a section written specifically for Union consumers, with a fourteen-day right of withdrawal, and offering terms drafted for that audience is exactly the kind of signal that recital treats as evidence of envisaging offering services there.

What we do do, if you accept analytics, is measure your reading behaviour: active time, progress and sections reached, tied together by a persistent identifier. That may fall within the “monitoring of behaviour” of art. 3(2)(b). That is why we apply the GDPR to visitors from the Union: assuming it seems more honest than hunting for a loophole.

You may lodge a complaint with the supervisory authority of your country of residence, your place of work, or the place of the alleged infringement. The directory of authorities is published by the European Data Protection Board at edpb.europa.eu.

Legal basis: Arts. 3(2), 12, 13, 27, 77 and recitals 23 and 24 GDPR; European Data Protection Board Guidelines 3/2018 on territorial scope.

This section completes the comprehensive privacy notice Mexican law requires, and tells you which authority to go to.

This document is the comprehensive privacy notice within the meaning of art. 15 LFPDPPP. Its minimum content is covered as follows: the controller's identity, under “Who the controller is”; the data processed and the fact that none of it is sensitive, under “What data we handle”; the purposes and which of them require your consent, under “What we use your data for”; the options for limiting the use or disclosure of your data, under “Consent” and in the cookie policy; the means for exercising your ARCO rights, under “How to exercise your rights”; and the procedure for communicating changes, in the final section. One element is missing: the controller's address required by section I is not published yet, so on that point this notice is incomplete — we say so here rather than treat it as covered. We will publish it once we have one.

Consent and its revocation. You may revoke, at any time and without retroactive effect, any consent you have given us, through the routes described under “Consent”. To limit the use or disclosure of your data you may use those same routes, and to stop receiving any commercial communication it is enough to reply to the email asking for it.

The competent authority for personal data held by private parties is now the Secretaría Anticorrupción y Buen Gobierno, through its Personal Data Protection Unit. INAI has been dissolved and is no longer the authority you can turn to. If you are not satisfied with our response to an ARCO request, you may bring a rights protection proceeding before that Secretariat within fifteen days of the date we communicate that response to you. And if we do not respond at all, that limit does not apply to you: you may bring it as soon as our response deadline expires, with no cut-off date, attaching the acknowledgement of the request you filed with us.

On cookies, the Mexican rule is to inform you at the moment they are used and to give you a way to disable them; it does not require prior consent the way European law does. We ask for prior consent anyway, because we also serve visitors from the European Union and because we prefer the more protective standard.

Legal basis: Arts. 7, 11, 15, 16, 19, 29, 35, 36 and 38 to 44 LFPDPPP; art. 14, third paragraph, of Mexico's 2011 LFPDPPP implementing regulation, whose status is uncertain and on which we rest no obligation by itself.

One California law reaches us even though we are small, and we answer it here. The state privacy laws everyone names do not.

What does reach us. The California Online Privacy Protection Act, Cal. Bus. & Prof. Code §§ 22575–22579, applies to any commercial website that collects personal information from California residents, with no revenue, headcount or volume threshold. It applies to us, and it requires us to disclose two things. First: we do not respond to the browser's “Do Not Track” signal, because we do not track your activity across different sites and there would be nothing to switch off. Second: the only third-party resource the page loads is Google's fonts, which receive your IP address in that request and do not follow you from site to site. Both are set out in detail in the cookie policy.

What does not reach us, and why we say so anyway. We are not a “business” under the California Consumer Privacy Act: we do not have annual gross revenues above 26,625,000 dollars, we do not buy, sell or share the personal information of 100,000 consumers or households, and we derive no revenue at all from selling or sharing personal information. Those are the three thresholds in Cal. Civ. Code § 1798.140(d), and the revenue figure is adjusted by the California Privacy Protection Agency every odd-numbered year; the one in force applies from 1 January 2025. We meet none of the three, and not by a narrow margin. The other state privacy laws in force do not reach us either: some by threshold, and the ones without a threshold — Texas and Nebraska — through their small-business exception, which leaves a single obligation standing, not selling sensitive data without consent, and we process no sensitive data at all. We say this rather than advertise compliance that is not required of us today.

What we give you anyway. Free of charge and through the same route as everyone else: to know what data of yours we hold and get a copy, to correct it, to delete it, to take it with you in a machine-readable file, and not to be treated worse for asking. Write to contact@paretolearn.com. We do not sell or share your personal information within the meaning of those laws, and we never have. If we ever did, we would publish a “Do Not Sell or Share My Personal Information” link here before starting, not after.

If you are not satisfied with our answer, you may go to your state Attorney General or to the Federal Trade Commission. We do not point you to the California Privacy Protection Agency: its authority is exercised over “businesses” under the California statute, and we have just explained why we are not one.

Legal basis: Cal. Bus. & Prof. Code §§ 22575–22579; Cal. Civ. Code § 1798.140(d), whose revenue threshold is adjusted under § 1798.199.95(d); Section 5 of the Federal Trade Commission Act.

We publish them here, with a new date, and if they matter we tell you before they take effect.

Any change to this notice is published on this same page and updates the “last updated” date shown above. If the change is substantial — a new purpose, a new third party, a longer retention period — we will tell you by email if you have an account, and by a visible notice on the site for at least thirty calendar days before it takes effect.

We keep previous versions of this document. If you want to know what it said the day you created your account, ask contact@paretolearn.com and we'll send it.

Legal basis: Art. 15 section VI LFPDPPP; art. 5(2) GDPR.

For anything related to this notice — exercising your rights, revoking a consent, asking us an uncomfortable question or pointing out a mistake — write to contact@paretolearn.com. A person answers, not a form.