Privacy Policy

Who we are

Frostbloom (frostbloom.xyz) is an independent online journal covering lipstick science and beauty technology. For the purposes of data protection law, Frostbloom is the controller of the personal data described in this policy. Questions and requests go to [email protected].

Which laws apply

This policy is written to satisfy, at minimum, the laws most likely to reach a globally readable journal:

• The EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and the UK GDPR, for readers in the European Economic Area and the United Kingdom.
• Brazil's General Data Protection Law (Lei nº 13.709/2018, the “LGPD”), supervised by the ANPD, for readers in Brazil.
• The California Consumer Privacy Act as amended by the CPRA (the “CCPA”), for California residents.
• Other local laws apply as you travel; where a law gives you a right this policy does not describe, write to us and we will honour it.

Information we collect

We keep the data we handle to a minimum. Nothing on frostbloom.xyz requires an account, and the site never processes a payment.

• Delivery data: when your browser requests a page, our hosting provider necessarily receives your IP address, browser type and version, device and operating system, the page requested, the referring page and a timestamp. This happens on every website on the internet; it is how a page gets to you.
• Correspondence: if you write to [email protected], [email protected] or [email protected], we receive whatever you choose to put in the message.
• The weekly brief: the subscription form on the site opens your own email application with the message pre-written. The website itself stores no address. An address only reaches us if you send it, and is then used for the brief and nothing else.
• Error diagnostics: if a page fails to load, an error report containing the failure message and the page path may be sent to our publishing platform so we can fix what broke.
• We do not collect payment details, run user accounts or surveys, and do not knowingly collect data from anyone under 16.

Purposes and legal bases

Every processing purpose below is tied to the legal basis it rests on. Where the GDPR requires a basis under Article 6, the equivalent LGPD basis under Article 7 is named alongside it.

• Delivering and securing the site — serving pages, CDN delivery, abuse and DDoS protection — rests on our legitimate interest in operating a public website (GDPR Art. 6(1)(f); LGPD Art. 7, V).
• Keeping security logs for incident investigation rests on legitimate interest, and on legal obligation where a retention period is imposed (GDPR Art. 6(1)(f) and (c); LGPD Art. 7, II and IX).
• Understanding which reports are read, in aggregate — page views, referrers, read depth — rests on legitimate interest in knowing whether our journalism is reaching anyone (GDPR Art. 6(1)(f); LGPD Art. 7, IX).
• Answering your messages rests on legitimate interest, or on steps taken at your request before entering a contract (GDPR Art. 6(1)(b) and (f); LGPD Art. 7, V and IX).
• Sending the weekly brief rests on your consent, which you withdraw from any email we send (GDPR Art. 6(1)(a); LGPD Art. 8, §5).
• Complying with lawful orders and court decisions rests on legal obligation (GDPR Art. 6(1)(c); LGPD Art. 7, II).
• Where we later add a purpose that needs consent — a new cookie, a new partner — we will ask before it runs, not after.

Advertising and personalized ads

Frostbloom may display advertising on the site. When it is, the ads are delivered by third-party vendors, including Google. Google's use of advertising cookies — including the advertising cookie historically known as the DoubleClick DART cookie — enables it and its partners to serve ads based on your visits to this site and to other sites on the internet.

Personalized advertising can be switched off without affecting the ads themselves — you will still see ads, they simply stop being chosen on the basis of your browsing. The switches live here:

If your browser sends a Global Privacy Control (GPC) or Do Not Track signal, we treat it as an opt-out of any sale or sharing of personal information, as the CCPA requires.

• Opt out of personalized advertising — Google Ad Center
• How Google uses information from partner sites and apps
• How Google uses cookies in advertising
• How Google personalizes ads
• Industry opt-out register (US) — Network Advertising Initiative
• Industry opt-out register (US) — Digital Advertising Alliance
• Industry opt-out register (EU) — YourOnlineChoices

Cookies

The site itself sets no advertising cookies. The technologies in use at the delivery layer are strictly necessary: they keep pages secure and sessions working.

Cookies set by advertising vendors, if any appear, are covered by our Cookie Policy, which sets out the categories in full — strictly necessary, preference, analytics and advertising — and the consent regime that applies to each.

For visitors in the European Economic Area and the United Kingdom, non-essential cookies (analytics and advertising) are used only where you have chosen to allow them, in line with the ePrivacy Directive. Strictly necessary cookies run regardless, because the page cannot be delivered without them. The opt-out links in the section above stop advertising cookies from being used for personalization at any time.

Who receives your data

We share data only with the providers that make the site work, and with nobody else — no data brokers, no advertising dossiers, no list sales.

• Cloudflare, which delivers the site through its hosting and CDN network. It receives request data including your IP address, and processes it under its own privacy and data processing terms.
• Google, through the web fonts the site uses. Your browser requests the font files from Google's servers, so Google receives your IP address in the process.
• Lovable, the publishing platform behind frostbloom.xyz, which receives the error diagnostics described above so we can fix what breaks.
• Your own email provider, and ours, when a message passes between us.
• Authorities, where a lawful order requires it — and only where it requires it.

International transfers

Our providers operate globally, so your data may be processed in the United States and elsewhere outside your country. Where EU or UK personal data is transferred, we rely on adequacy decisions or the European Commission's standard contractual clauses with the provider receiving it. Transfers of Brazilian personal data follow the international transfer rules of LGPD Article 33, including the standard contractual clauses recognised by the ANPD.

Retention

Each category of data has a ceiling, and the ceiling is short:

• Delivery and security logs: up to 30 days, then deleted or aggregated beyond recognition.
• Error diagnostics: up to 90 days.
• Correspondence: for as long as your message takes to resolve, then up to 24 months for record-keeping.
• Weekly brief addresses: until you unsubscribe; a deletion request is completed within 30 days.

Your rights

Depending on where you live, data protection law gives you the following rights over the personal data we hold about you:

• Under the GDPR and UK GDPR: access, rectification, erasure, restriction of processing, objection to processing based on legitimate interests, data portability, and withdrawal of consent at any time. You may also complain to your local supervisory authority.
• Under the LGPD (Article 18): confirmation that processing takes place; access; correction; anonymisation, blocking or deletion of unnecessary, excessive or non-compliant data; portability; information about the public and private entities with which we share your data; deletion of data you gave consent for; information about the possibility of refusing consent and the consequences; and revocation of consent.
• Under the CCPA: the right to know, delete and correct personal information, and to opt out of its sale or sharing. Frostbloom does not sell or share personal information as those terms are defined.

• Exercise a request — [email protected]
• European Data Protection Board — your EU supervisory authority
• ANPD — Brazil's data protection authority

Exercising a request

Write to [email protected] from the address concerned and say which right you are exercising. We may need to confirm you are who you say you are before handing data over or deleting it — we will not ask for more than that takes.

We answer within 30 days, or sooner where the law requires it: LGPD requests for confirmation of processing or for information are answered immediately in simplified form, or in full within 15 days. You may authorise an agent to act for you, and we handle agents' requests under the same rules.

Security

Pages are served over HTTPS, access to our systems is limited and logged, and every provider above is bound by contract. No method of transmission or storage is completely secure, and we will not promise you an impossibility.

Children

The site is not directed at anyone under 16, and we do not knowingly collect their personal data. If you believe a child has sent us personal data, write to [email protected] and we will delete it.

Third-party links

Our reports cite and link to external sources — regulators, standards bodies, trade press, research. What those sites do with your data is governed by their own policies, not ours.

Changes

We may update this policy; the date at the top shows the last revision. Material changes will be announced on the site rather than sprung on you silently.