Skip to content
The FIRE Exit
Legal

Privacy policy

What this site collects, why, where it goes and what your rights are — in plain English.

I run this site alone. I don’t sell your data, I don’t run ads, and the site sets no cookies of its own. Most of it works without collecting anything about you at all. This page covers the few places where personal data does come up.

Who is responsible (the “controller”): Pablo M. Hernandez, publishing as The FIRE Exit, based in Lisbon, Portugal. For anything in this policy, email pablo@thefireexit.com.

The short version

  • The calculators and tools run entirely in your browser — nothing you type in them is sent to me or anyone else.
  • I only receive personal data when you choose to send it: the contact forms, booking a session, or subscribing to the newsletter.
  • No cookies of my own, no advertising trackers, no cross-site tracking, no profiling, no automated decision-making.
  • You’re never obliged to give me data — the forms simply don’t work without the fields they ask for, and everything else works with none.
  • You can ask me at any time what I hold about you, and ask me to correct or delete it.

What I collect, and why

1. The contact forms

If you write to me through the contact form (a session enquiry or a talk enquiry), I receive your name, email address and message, plus which form you used. I use it to answer you and, if you’re booking a session or a talk, to prepare for it. Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and my legitimate interest in answering correspondence (Art. 6(1)(f)). Retention: for as long as our exchange is live and up to two years after the last message, then deleted — earlier if you ask.

2. Booking a session

The booking calendar on the contact page is provided by Cal.com, running on its EU-hosted service (cal.eu). When the calendar loads, your browser talks to Cal.com’s servers; when you book, the details you enter — name, email, your answers to the screening questions and the time you pick — are processed by Cal.com on my behalf and land in my calendar. Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b)). Cal.com acts as a processor; the embedded calendar may set its own strictly-functional cookies inside its frame to make the booking work, and Cal.com’s own privacy notice — including the safeguards it applies to any processing outside the EEA — is at cal.com/privacy.

3. The newsletter (“Postcards from the exit”)

If you subscribe, I store your email addressand use it for exactly one thing: sending the postcards. Sign-up is double opt-in (you confirm by email before anything is sent), and every message carries a one-click unsubscribe link (RFC 8058) that works immediately. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time by unsubscribing or emailing me. Retention: while you’re subscribed; if you unsubscribe I keep only a record that you opted out, so you’re never re-added, and I’ll erase that too on request. Processors: the list lives in a Neon Postgres database, the postcards are delivered through Resend, and encrypted backups are kept in Vercel Blob storage — each acting as my processor under a data-processing agreement, none of them using your address for anything else.

4. Plain email

If you email me directly, I’ll have whatever you send, in my mailbox, for as long as the conversation warrants — same handling as the contact form.

5. Hosting and server logs

The site is hosted by Vercel. Like practically every host, Vercel keeps short-lived technical logs (IP address, browser type, pages requested, timestamps) to run and secure the service. Legal basis: my legitimate interest in operating a working, secure website (Art. 6(1)(f)). Vercel Inc. is a US company; where data is processed outside the EEA, the transfer is covered by the EU–US Data Privacy Framework and standard contractual clauses. Vercel’s privacy notice is at vercel.com/legal/privacy-policy.

6. Analytics

I use Vercel Web Analytics and Speed Insights to see, in aggregate, what gets read and how fast the pages load. This analytics is cookieless: it sets nothing on your device, doesn’t follow you across sites, and doesn’t build a profile of you. Visits are counted using a temporary anonymised identifier that isn’t tied to your identity. Legal basis: my legitimate interest in understanding how the site is used (Art. 6(1)(f)).

7. Things stored in your browser (and only there)

A few features remember your choices on your own device, in your browser’s own storage — never sent to me: the light/dark theme toggle, the “price it in your money” setting on the atlas (your country and monthly spend, so the tools can pre-fill), and the Exit Audit’s draft answers (kept only for your tab session, so a refresh doesn’t wipe them). Each is stored only when you actively use the feature, exists purely to make that feature work, and disappears when you clear your browser data (the audit drafts, when you close the tab). Storage that’s strictly needed for a feature you asked for doesn’t require a consent banner — which is why you don’t see one.

What I don’t do

  • No selling or renting of personal data. Ever.
  • No advertising, ad networks or third-party trackers.
  • No profiling and no automated decision-making about you.
  • No data collection from the calculators — your numbers stay in your browser.

Your rights

Under the GDPR you can ask me for access to the personal data I hold about you, ask for it to be corrected or deleted, ask me to restrict or object to how I use it, and ask for a portable copy. Where something runs on consent (the newsletter), you can withdraw that consent at any time, with no effect on what happened before. Email pablo@thefireexit.com and I’ll answer within a month.

If you think I’ve handled your data badly, you can complain to a supervisory authority — in Portugal that’s the CNPD, the Comissão Nacional de Proteção de Dados (cnpd.pt), or the authority where you live.

Children

This site is not directed at children, and I don’t knowingly collect data from anyone under 16.

Changes

If the site starts doing something new with data — a new provider, a new form — this page changes with it, and the date below moves.

Last updated: 10 July 2026. Questions? pablo@thefireexit.com — or read the terms of use.