PUBLIC POLICY · UPDATED 25 OCTOBER 2026

Privacy policy

This policy explains how Alejandro Carbajo Vidales handles personal data through alejandrocarbajo.com and the owner-operated PersonalBrand Social Connector used with Alejandro's Facebook Page and Instagram creator account.

Who is responsible

The data controller is Alejandro Carbajo Vidales, based in Spain. Privacy questions and requests can be sent to carbaj03@gmail.com.

Website measurement

The website records aggregate page paths, language and explicit newsletter or portfolio actions through Cloudflare Web Analytics and a first-party Cloudflare Analytics Engine endpoint. These measurements do not set advertising cookies, create a cross-site profile or intentionally store an IP address, email address or other visitor identifier. They are used to understand which public pages are useful and where a person chooses to continue.

Some campaign links, such as those in Alejandro's YouTube videos, pass through alejandrocarbajo.com on their way to the App Store or Google Play. When such a link sends you to a store, the website records one aggregate event with the campaign path (which video and which store), the app, the campaign's language and the channel it was published on, to see which videos lead to the app stores. To choose a store, the website reads your browser's user-agent during that one request; neither it nor your IP address, the page you came from or the rest of the link is kept in the event. No tracking cookie is set and no visitor identifier is assigned. If the browser cannot be recognised, a page lets you choose the store, and opening that page is not counted. Cloudflare processes these events in Analytics Engine, and they are counted as requests, not as people. The store link carries the same campaign name so Apple and Google can report store visits and downloads per campaign in aggregate under their own privacy policies. Cloudflare may keep its own operational request logs under its terms.

The weekly note

When you subscribe, Cloudflare KV stores your email address, language, join date and a random unsubscribe token. Sign-up is open, but sending has not started yet: no issue has gone out, and the list only keeps these details. Once sending starts, they will be used to send the weekly note in your chosen language, and Brevo will process your address and the email to deliver it on Alejandro's behalf. Every issue will include an unsubscribe link: the button in your email app can remove you in one click, or you can open the link and confirm with one button. Unsubscribing removes your address and token from the list. Until the first issue, a privacy request to the address above removes you.

Once sending starts, a private send record will keep a hash of the address, the issue, delivery time and Brevo's message identifier to prevent duplicate sends. It will not keep your address in plain text. This is separate from the website's aggregate measurements.

Data the connector processes

When Meta sends an authorized webhook event, the connector may process account, Page, media, comment, message or mention identifiers; event types and timestamps; bounded source references; and integrity hashes used for deduplication and security.

The webhook ingress does not intentionally retain comment or message bodies. Raw webhook bodies are verified, normalized and discarded. If source-text processing is separately enabled, the reply worker retrieves a public comment and bounded public post context just in time through Meta's official API. In SHADOW mode it may classify and draft, but it cannot write to the provider. It does not send private messages or intentionally retain the source text locally.

A public comment that passes deterministic private, crisis, safety and injection pre-screening may be sent transiently to OpenAI through the locally authenticated Codex service to decide whether no action or a bounded public reply is appropriate. Generated reply artifacts are stored privately with an integrity hash before any authorization. Provider access tokens and app secrets remain in the macOS Keychain and are not passed to the Codex subprocess through its input or environment.

Why the data is used

• to authenticate and operate the exact social accounts Alejandro owns or manages;
• to publish content that has passed the applicable approval boundary;
• to receive, deduplicate and classify authorized interaction events;
• to protect the service, investigate delivery failures and maintain an accountability record;
• to respond to a person only when the applicable platform, privacy, safety and policy-authorization rules allow it.

Where applicable, this processing is based on the account owner's authorization, consent, performance of a requested service, and the legitimate interest in operating and securing the connector. Consent or account authorization can be withdrawn at any time.

Storage and retention

Normalized terminal webhook metadata is retained for up to 30 days and then tombstoned or redacted under the connector's retention process. Credentials remain until they are revoked, rotated or no longer required. Minimal security, deletion and publication records, including generated public reply text and its hash, may be retained when necessary to demonstrate that a request or public action was handled correctly.

OpenAI processes text sent through Codex under the ChatGPT account's terms and data controls. Autonomous source-text processing remains disabled unless the account-wide “Improve the model for everyone” control is off. An ephemeral local Codex run prevents a persistent local session; it is not a promise that OpenAI retains no service-side safety or operational data.

Who receives data

Data is not sold. Meta provides the Facebook and Instagram APIs. Cloudflare hosts the website and supplies DNS, encrypted tunnel transport, Web Analytics, Analytics Engine for the aggregate measurements described above and KV storage for the weekly note's list. OpenAI supplies the Codex model used for pre-screened public-comment no-action or bounded-reply decisions. Durable ingress storage and the policy, authorization and provider-execution services run on Alejandro's local Mac Mini. These providers process data under their own terms and privacy policies.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, objection or portability, and may withdraw consent. You can also revoke the app directly in Facebook or Instagram's Apps and Websites settings. See the data-deletion instructions for the practical route. OpenAI also provides a privacy request portal for data it controls.

Security and children

The connector uses signed webhooks, exact route allowlists, loopback-only local service binding, Keychain-backed credentials and platform kill switches. No system can guarantee absolute security. The connector is not directed to children and is not intended to collect children's data.

Changes

Material changes will be published on this page with a new effective date. Questions can be sent to carbaj03@gmail.com.

Current automation boundary: an integration being technically connected does not by itself authorize a post, reply or private interaction. The autonomous reply worker remains in shadow mode until its independent privacy, qualification and official readback gates pass.