Privacy policy

Who we are

The controller of personal data for the Good Talks website is Asociatia Good Bureau, an association established in Romania. Good Talks is a podcast of that association.

Registration number (CUI): 36961299

Registered address: Str. Dâmbovița nr. 21, ap. 21, Sector 6, București, 060842, Romania

Privacy contact: ryan [at] goodtalks [dot] ro

What this page covers

This page explains which data is involved when you use goodtalks.ro: the contact form, the episode player, visit measurement, the episode catalogue, and hosting. We do not make automated decisions that produce legal effects about you, and we do not build advertising profiles.

Contact form

The contact page embeds the Tally form Yjj1a0. The fields are your name, email address, and message. All three are required. The form does not ask for anything else.

The message is sent to Tally, which stores it and delivers it to the Good Talks team, including by email notification. Tally may log ordinary technical data for a form submission, such as the IP address and the time of sending. Tally is the form provider. Asociatia Good Bureau is the controller for the content of the message.

The legal basis is GDPR Article 6(1)(b), when you write so that we can reply or take a step you asked for (a guest suggestion, a collaboration, a question), and Article 6(1)(f), the legitimate interest in reading and answering messages we receive. We keep a message for at most 24 months after the last reply, or longer only where the law requires it.

Episodes and YouTube

An episode page first shows a preview image from i.ytimg.com and a play button. The YouTube player does not load with the page. It loads only after you press play or a chapter time in the description, and it loads from youtube-nocookie.com. Google may then receive your IP address, browser data, and the fact that you asked for that episode, and it may set cookies. From that moment YouTube is an independent controller for what happens inside the player. Google’s policy is at policies.google.com/privacy.

Episode images on the home page and the episode list also come from i.ytimg.com, so you can recognise an episode. The basis for loading the player after you press play is Article 6(1)(b): we play the episode you asked for. Links to YouTube, Apple Podcasts, or Spotify leave this site, and those services apply their own rules.

Visit measurement

We use Vercel Web Analytics to see, in aggregate, which pages are opened. This tool does not use cookies and does not write to localStorage or sessionStorage. We do not build a visitor profile. Vercel may use the IP address briefly to derive a coarse geographic area. The basis is Article 6(1)(f), the legitimate interest in understanding whether the site works and which pages are used. We do not use the data for advertising.

Supabase

The episode catalogue (title, guest, description, duration, links, and publication date) is stored in a Postgres database on Supabase, in the eu-central-1 region (Frankfurt). The site reads that catalogue from the server. Form messages are not written to Supabase. Guest names are part of the published episode, not a visitor account. We keep an episode for as long as it stays published.

Hosting

The site is hosted by Vercel. Vercel processes technical connection data (IP address, browser type, page requested, and time) in operations and security logs. The basis is Article 6(1)(f), the legitimate interest in keeping the site available and protecting it. Vercel keeps those logs for the operational period of the service. We do not keep a separate visitor database.

Cookies and analytics

Vercel Web Analytics stays cookieless. It measures visits in aggregate, does not write to localStorage, and does not build an advertising profile. The basis for that measurement is GDPR Article 6(1)(f).

Google Analytics 4, provided by Google Ireland Ltd., starts only after you press Accept. Until then, the analytics script is not loaded. It collects pseudonymous usage data (pages opened, device and browser type, and a coarse area). GA4 anonymizes the IP address. The cookies are _ga and _ga_*, kept for up to 2 years under Google’s settings. The legal basis is consent, Article 6(1)(a). Advertising stays off: we do not enable ad storage or ad personalization.

Your choice is kept in localStorage on this device, not in a tracking cookie. You can withdraw it at any time from the “Cookie settings” link in the footer: Decline stops analytics and deletes the _ga cookies for goodtalks.ro. The YouTube player, which can set its own cookies, starts only after you press play or a chapter time, on youtube-nocookie.com. The Tally form loads only on the contact page.

Transfers outside Romania

Asociatia Good Bureau is established in Romania. Some providers may process data outside the European Economic Area. Vercel Inc. is in the United States and may process hosting and analytics there or in the European Union. YouTube is a Google service, and its processing can include the United States. Supabase stores this catalogue in Frankfurt; the Supabase company is in the United States and may access the data from outside the EEA for support. Tally hosts the form. Where a provider moves data outside the EEA, the transfer rests on an adequacy decision, including the EU–US Data Privacy Framework where it applies, or on standard contractual clauses.

Your rights

You can ask for access, rectification, erasure, restriction, and portability, under GDPR Articles 15 to 20. You can object to processing based on legitimate interests, under Article 21. Where the basis is consent, you can withdraw it, without affecting processing already carried out. You are not subject to a decision based solely on automated processing. Write to the contact address above. We reply within one month, or within a further two months if the request is complex, and we tell you if we extend the time.

Complaint to the ANSPDCP

You can lodge a complaint with a supervisory authority. In Romania, that authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 Gheorghe Magheru Boulevard, Sector 1, Bucharest, dataprotection.ro, anspdcp@dataprotection.ro. You can also use the authority of the member state where you live or work.

Changes

If we change this policy, we update the date above and publish the new text on this page.