Who you are dealing with, and what happens to your data.

This page answers the security, privacy and reliability questions a reader of Breakwise should be able to answer without asking. It is editorial, not a certification. Where it conflicts with the Legal Notice or the Terms, those prevail.

Trust · Legal · Terms · Disclosures

Educational research, not investment advice. I'm not a licensed adviser.

01Who you are dealing with

Breakwise is published and operated by Anthony Meijer, trading as ‹trade name›, registered with the Dutch Chamber of Commerce under ‹KvK number›, at ‹business address›. The publisher is the controller under the General Data Protection Regulation (EU) 2016/679 and the Dutch implementation act (UAVG). Contact: awvmeijer@gmail.com.

02Shared responsibility

The publisher is responsible for the application code, the editorial content, access control and configuration. The infrastructure providers named below are responsible for the platforms beneath. You are responsible for the address you sign in with, the devices you use, and using the content within the Terms.

03Sign-in and access

• Signed-in areas use Cloudflare Access with one-time codes sent to your email. Breakwise holds no passwords, so none can leak.
• Access decisions are made at the edge before a request reaches any page; the application only ever sees a verified address.
• Sessions expire on their own and end when you sign out.

04What we process

The minimum that the service needs: your email address and the list you joined, where you came from (a short source tag such as "x"), the time you joined, the time you confirmed you are eighteen or older, the time you confirmed your address, the answers to the five optional questions on the sign-up page if you gave them (which wave you follow, which role fits you, what you want first, how you research, whether a pilot call suits you), a random unsubscribe token, the time you unsubscribed if you did, subscription status once billing exists, messages you send us, and request logs (address, user agent, timing) kept for security. Nothing else. No advertising identifiers, no behavioural profile, no third-party analytics.

Legal bases (Art. 6 GDPR): performance of the contract for the lists and the subscription; legitimate interest for security and abuse prevention; legal obligation for accounting once billing exists.

05Where it runs

• Cloudflare, Inc. (USA; EU data localisation available) — hosting and delivery of the site (Pages), the list store (D1), sign-in (Access), TLS, CDN and abuse protection, including Turnstile, the bot check on the sign-up page (it sees your IP address and browser signals, sets no tracking cookie, and is loaded on that page alone).
• Stripe Payments Europe, Ltd. (Ireland) — planned. Subscription checkout and recurring billing if the Desk is ever billed. Card data stays inside Stripe and never reaches Breakwise.
• Inference — the desk's models run on the producer's own equipment. No hosted model vendor processes reader data. Published output is produced on the desk and delivered as static files.

Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses and each provider's published data-processing terms.

06Encryption and transport

Every public endpoint is served over HTTPS with TLS terminated by Cloudflare. Data at rest is encrypted by the provider. The service does not claim end-to-end encryption: the publisher and the providers above can technically read stored data to operate the service.

07Retention and deletion

Every list email carries a one-click unsubscribe link and a List-Unsubscribe header; unsubscribing takes effect at once and no further list email is sent. An unsubscribed entry is kept, marked unsubscribed, only so a later sign-up is a fresh opt-in and never a silent re-add; ask and it is erased instead. A list entry is otherwise kept for twenty-four months after the last message you opened. Billing records, once they exist, are kept for seven years under Dutch fiscal retention rules. Request logs rotate on a short window. On a deletion request, personal data is erased or anonymised without undue delay except where a retention duty applies, in which case it is restricted from any further use.

08Your rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where consent is the basis: write to the contact address above; reasonable proof of identity may be requested. You may also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

09Cookies

Strictly necessary only: the sign-in session and Cloudflare's security cookies. No advertising cookies, no analytics cookies, no consent banner because nothing needs consent.

10Minors, reliability, vulnerabilities

The service is not directed at children; list members and account holders must be eighteen or older, and both sign-up forms ask you to confirm it. It runs on a best-effort basis with no uptime commitment. In the event of a personal-data breach the supervisory authority is notified within seventy-two hours where Art. 33 GDPR requires it, and affected readers without undue delay where Art. 34 requires it. Good-faith security research is welcome: write to the contact address with steps to reproduce; do not access other readers' data, run automated scanners against production, or test denial of service.

11Editorial posture and law

Breakwise is an informational publisher. Nothing it publishes is personalised, nothing is addressed to any person's situation, and the desk places no trades. Positions, the trading blackout and the dating of every publication are set out on the disclosures page. This page, the Legal Notice and the Terms are governed by Dutch law.

12Changes

Date	Change
2026-09-18	First version.
2026-10-12	04, 07, 10: the eighteen-or-older confirmation, the unsubscribe token and link, unsubscribed entries kept marked rather than re-added.
2026-10-13	The service is named Breakwise. 04: the optional sign-up answers, the source tag and the confirmation time.
2026-10-13	05: Turnstile on the sign-up page.