Last updated: 18 October 2026
This policy explains what personal data I collect on cards-on-the-table.com, why, who else handles it, how long I keep it, and what rights you have. I keep it short and use only what I need.
Paolo Falcioni, Dreefweg 21, 1820 Steenokkerzeel, Belgium. Enterprise number 1043.075.840. I am the data controller. I have not appointed a data protection officer, as the law does not require one for an activity of this size. For any question or request about your data, email me at paolo.falcioni@gmail.com.
Cards on the Table — The Meeting After the Meeting shares meeting stories and practical questions by email, with no fixed sending schedule.
I send you the newsletter because you asked for it. The legal basis is your consent (Article 6(1)(a) of the General Data Protection Regulation, GDPR). You give it by entering your email address and then clicking the link in the confirmation email (double opt-in). I never sign you up without that confirmation, and buying the game does not put you on the newsletter.
I count link clicks based on my legitimate interest in knowing which stories readers find useful (Article 6(1)(f) GDPR). You can object at any time, or simply unsubscribe.
No. Subscribing is entirely voluntary. Without an email address, though, I cannot send you the newsletter.
Every newsletter has an unsubscribe link at the bottom. One click and you stop receiving it. You can also simply reply and ask. Withdrawing consent does not affect anything I did before you withdrew it.
When you order the game, I use your name, postal address, email and phone number to process the payment, deliver the game and handle any return or guarantee claim. The legal basis is the contract with you (Article 6(1)(b) GDPR) and my legal obligation to keep accounting records (Article 6(1)(c) GDPR).
You need to give these details to place an order: without them I cannot take your payment or deliver the game.
I keep order records for the period Belgian accounting and tax law requires, and then delete them. I use your order details only for your order. I do not send you marketing because you bought something. The terms of sale give more detail.
The blog uses Hyvor Talk for comments. If you choose to comment, Hyvor Talk stores the name, email address and comment you give. The legal basis is your consent (Article 6(1)(a) GDPR), which you give by choosing to post. Your comment stays online until you delete it or ask me to remove it.
The comment box comes from Hyvor Talk, and it loads only when you click “Show comments” under a post. Until you click, your browser does not contact Hyvor Talk and nothing from Hyvor Talk is stored on your device. The site does not remember your click, so the comments stay hidden on every page until you ask for them. By clicking, you agree to load them (Article 6(1)(a) GDPR and the ePrivacy rules on storing information in your browser).
Once loaded, the comment box can store information in your browser, in cookies or local storage. According to Hyvor Talk's privacy policy, this includes a login token when you log in to comment, and may include your comment drafts and display preferences. Hyvor Talk controls this storage, not this website. To remove it, clear this site's cookies and stored data in your browser. For the full and current list, see Hyvor Talk's privacy policy.
If you comment GREAT on a post or Reel by @cards_on.the_table, the Cards on the Table Replies app can send you a private message with the meeting checklist. Meta sends the app your comment text, comment ID, account ID and post ID so it can recognise the request and reply. This does not subscribe you to the newsletter.
The app runs on Vercel and uses Upstash to avoid duplicate messages. Upstash stores hashed comment and account identifiers, the selected message variation and delivery status. Comment and delivery records expire after 30 days; the account cooldown expires after 24 hours. The app does not store comment text, usernames or conversation history in this database. Meta retains the comment and conversation under its own policies. The reply is selected from prepared wording; your comment is not sent to an AI service.
To ask about or delete the app's records, email the contact in section 10 with your Instagram username and a link to the relevant comment. I may ask you to confirm that you control the account. Removing the app's record does not remove your public Instagram comment or the message in your Instagram inbox; manage these in Instagram. You can stop requesting replies by not using the keyword.
The website runs on Vercel. Like any web server, it records technical data such as your IP address, browser type and the pages you request, to deliver the site and keep it secure. The legal basis is my legitimate interest in running a safe website (Article 6(1)(f) GDPR). Vercel keeps these logs for no longer than 24 hours.
I do not use analytics or advertising cookies. The site itself sets only one cookie: a technical one during checkout, so the thank-you page can show your payment result. It is strictly necessary and expires after 24 hours. The blog's comment box loads only if you click “Show comments”, and can then store its own data in your browser, as described in section 4.
I do not sell or rent your data. These providers handle it only on my instructions, under a data processing agreement, and only for the purposes above:
For orders, I share your details with two organisations that decide for themselves how to handle them, as independent controllers, under their own privacy policies:
Vercel and Resend are based in the United States, and the code that handles newsletter sign-ups and orders runs on Vercel servers in the United States. Both companies are certified under the EU-US Data Privacy Framework, which the European Commission recognises as giving adequate protection. Vercel also relies on the Commission's standard contractual clauses. Where any other provider, or one of their own sub-processors, handles data outside the European Economic Area, the transfer is protected by an adequacy decision of the European Commission or by its standard contractual clauses.
I do not make decisions about you by automated means, and I do not use your data for profiling.
Under the GDPR you can at any time ask me to:
Email me at paolo.falcioni@gmail.com. I reply within one month. I may ask you to confirm your identity first. Some rights have limits: for example, I cannot delete order records that the law requires me to keep.
If you think I have not handled your data correctly, you can complain to the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, autoriteprotectiondonnees.be / gegevensbeschermingsautoriteit.be, or to the authority in your own country. I would appreciate the chance to sort it out with you first.
If I change this policy, I will update the date at the top. If a change affects how I use your newsletter data, I will tell subscribers by email first.