The Chevron Alliance

Privacy notice

Last updated .

This website, chevronalliance.org, and its mailing list are run by The Chevron Alliance, a 501(c)(7) non-profit. This notice says what personal data we collect from people who visit the site or join the mailing list, why, how long we keep it, and what you can ask of us. It is written to meet the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Who we are

The Chevron Alliance is the data controller for everything described here. For anything about your personal data, write to privacy@chevronalliance.org.

2. What we collect

When you join the mailing list:

  • Your email address. This is the only thing you have to give us.
  • What you’d like us to call you, your country and how you heard about us, if you choose to give them.
  • A record of your consent: when you signed up and when you confirmed, which version of our sign-up wording you agreed to, and your IP address when you signed up, with the country associated with it. We also note the website you came from (this site’s address only, never the page) and, if the link that brought you to the sign-up page was tagged with a campaign name, that name. A campaign name is the same for everyone who followed that link.
  • When you unsubscribe, and why, if you choose to tell us.
  • Which of our emails were delivered to you, and whether any bounced.

We don’t track whether you open our emails or which links in them you click. Our newsletters may link to videos on YouTube or elsewhere; following a link takes you to that site, under its own privacy notice.

Buttondown, which runs our mailing list, checks each sign-up for abuse using your IP address, your browser’s details and your email address, and may ask you to show that you’re not a robot.

When you visit the website: like any website, ours keeps logs of the requests it receives: your IP address, your browser’s details, the page you asked for and when.

We also count how the site is used, with PostHog: which pages are viewed and in what order during a visit, which buttons and links are pressed, the site you came from, your browser, device type and screen size, and the country you’re in, worked out from your IP address, which PostHog then discards. This sets no cookies and stores nothing in your browser, so it can’t recognise you from one visit to the next, and nothing is recorded that you type. If your browser sends a Do Not Track signal, nothing is counted at all.

That is all. We use no advertising, and we set no cookies (see section 7). If you reach us by scanning one of our printed QR codes, we count the scan; the count is a number and holds nothing about you.

3. Why, and on what basis

  • We email you because you asked us to. We use what you’d like us to call you, if you tell us, to greet you, and how you heard about us to learn how people find us. We ask for your country so that we can tell you about events near you, and so that we know where in the world our readers are. The legal basis for all of this is your consent (GDPR Article 6(1)(a)). You can withdraw it at any time; that doesn’t affect what we did before you withdrew it.
  • We keep the record of your consent, keep your address after you unsubscribe so that we don’t email you again, and check sign-ups for abuse. The legal basis is our legitimate interest in being able to show that you agreed, in respecting your wish not to be emailed, and in protecting the form, and other people’s inboxes, from abuse (Article 6(1)(f)).
  • We keep the website’s request logs to keep it running and to find and stop abuse, and we count how the site is used to see which pages and campaigns work. The legal basis is our legitimate interest in running a secure website and in knowing whether it does its job (Article 6(1)(f)).

4. Who handles your data for us, and where

Buttondown keeps our mailing list and sends our emails, on our behalf and under its data processing agreement. It stores your data in the United States, under the European Commission’s standard contractual clauses and the UK addendum to them.

Cloudflare, Inc. hosts this website, on our behalf and under its data processing terms. Cloudflare may process data outside your country, including in the United States, under the safeguards those terms provide.

PostHog, Inc. counts how the site is used, on our behalf and under its data processing agreement. It stores the counts in the United States, under the European Commission’s standard contractual clauses and the UK addendum to them. Write to us if you want a copy of the safeguards any of them works under.

Inside the Alliance, only the few volunteers who run the list and the website can see your data. We do not sell your data or share it with anyone else, unless the law requires us to.

5. How long we keep it

  • If you don’t confirm your sign-up, we send you nothing more, and delete it within 30 days.
  • While you are subscribed, we keep your details until you unsubscribe.
  • When you unsubscribe, we keep your address, marked as unsubscribed, and the record of your consent for 3 years, to show that you agreed and later withdrew and to make sure we don’t email you again. Then we delete them.
  • If you ask us to delete your data, we do so within one month, including the record we’d otherwise keep after you unsubscribe.
  • The website’s request logs are deleted after 7 days.
  • PostHog keeps the usage counts for 7 years. They hold no IP address and no cookie, so they can’t be tied back to you.

6. Your rights

If you live in the EU, the EEA or the UK, the GDPR gives you these rights, and we extend them to everyone:

  • to ask for a copy of your data (Article 15);
  • to have it corrected (Article 16);
  • to have it deleted (Article 17);
  • to have us restrict what we do with it while something is disputed or checked (Article 18);
  • to have it in a form you can take elsewhere (Article 20);
  • to object (Article 21). Where we rely on our legitimate interest (the record of your consent, keeping your address after you unsubscribe, the checks against abuse, the request logs and the usage counts), you can object at any time, for reasons to do with your own situation. We will then stop, unless we have compelling reasons that outweigh yours, or need the record to establish or defend a legal claim.

To keep the usage count from including you, turn on your browser’s Do Not Track setting; we respect it.

To unsubscribe, use the link in any email we send once you’ve confirmed, or write to us. For anything else, write to privacy@chevronalliance.org. We will answer within one month. If a request is complex, or we have many at once, we may take up to two months longer; if so, we’ll tell you within the first month and say why. Before we release or change anything, we will check that the request comes from the email address on our list.

You also have the right to complain to the data protection authority where you live.

Giving us your details is up to you; without an email address we cannot send you the newsletter. Apart from Buttondown’s automatic checks against abuse, we make no automated decisions about you.

7. Cookies and embedded videos

We set no cookies for visitors and store nothing in your browser, our usage count included, and we load nothing from advertising services. That is why there is no cookie banner: the usage count rests on our legitimate interest (section 3), keeps no identifier that could follow you from one visit to the next, and stops when your browser says Do Not Track. Cloudflare, which protects the site, may set a cookie if it has to tell your browser from a bot; that cookie identifies nothing about you.

A page on this site may include a video from YouTube or Vimeo. The player is loaded from them when the page opens, so they receive your IP address, and they may set cookies or storage of their own, particularly once you play it. We use YouTube’s no-cookie player and never autoplay. What they do with it is covered by their privacy notices, not ours.

8. Children

Our mailing list is for people aged 16 and over. If we learn that someone younger has signed up, we delete their details.

9. Changes

If this notice changes, we will update this page and the date at the top.

Back to top