Privacy Policy
Provisional draft, version of Monday, September 28, 2026, which is the effective date of this policy. The name of the operator, the contact address and the postal address on this page are provisional. The parts marked “to be completed” are not decided yet.
Who is responsible
The controller of the personal data described here is A Century Late company (provisional name). You can write to us at [email protected] (provisional address) about anything on this page. Postal address: [to be given] (provisional). Data protection officer: to be completed.
This policy covers the site acenturylate.com and its test version, test.acenturylate.com, the newsletter, and the tools with which we publish our own posts on social networks.
In short
- The site sets no cookies and stores nothing in your browser.
- We do not measure visits. There is no analytics, no advertising and no tracking, and no script or font is loaded from another company.
- Our server keeps a log of the requests it receives, for 14 days.
- If you sign up for the newsletter, we keep your email address.
- Photographs and page images reach your browser from Cloudflare, which stores them for us.
What our server records
Like every web server, ours writes a line in its access log for each request: the IP address it came from, the date and time, the address requested (what you type in the search box is part of that address), the answer given and its size, the page you came from, and the identification your browser sends. On the test site, which asks for a password, the log also holds the user name typed at the prompt.
Why: to run the site, find faults and protect it from abuse. Legal basis: our legitimate interest in running a working and secure site (Article 6(1)(f) of the General Data Protection Regulation, GDPR). How long: the access log is renewed every day and each day's log is deleted after 14 days.
The program that builds the pages also notes each request it answers (the IP address, the address requested and the answer) in the server's system journal. That journal has no fixed period: its oldest entries are removed when it reaches its size limit. A fixed period is to be completed.
The newsletter
If you sign up, we keep your email address, the language of the site you signed up from, when you signed up, and whether you are subscribed. Nothing else is asked.
Why: to send you the edition by email. Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time by writing to us; withdrawing does not affect what was done before.
Today no newsletter is sent. No email service is connected yet, and the test site sends no email.
How long: while you are subscribed. When you unsubscribe, the address stays in our list marked as unsubscribed, so that we do not write to it again. If you want it deleted, write to us.
Giving your address is not required by law or by a contract. Without it, you simply do not receive the newsletter.
Images served by Cloudflare
The photographs and the images of newspaper pages on our pages are stored for us by Cloudflare, Inc., and your browser loads them from media.acenturylate.com, an address served by Cloudflare. Requests to acenturylate.com itself also pass through Cloudflare; the test site, test.acenturylate.com, is answered by our server directly. Like any server, Cloudflare receives your IP address and the address requested, and it asks browsers to report to it the connections to these addresses that fail (Network Error Logging). Cloudflare also answers the domain name lookups for acenturylate.com. Cloudflare's own policy: cloudflare.com/privacypolicy.
Where the data are kept
Our server is a virtual server rented from a hosting company (Sitebunker; the company and the location of the server are to be confirmed). The database of the site is on that server. A copy of the production database is made each day and stored in Cloudflare R2, Cloudflare's storage service. The newsletter addresses given on the test site are in the test database, which is not copied.
What does not exist
There are no user accounts, no sign-in, no paid subscriptions, no payments and no comments on the site. Nothing is collected for them.
Our posts on social networks
We publish posts on our own pages and accounts on Facebook, Instagram, YouTube and TikTok. The tools that prepare and publish them work only with our own accounts. They do not collect anything about the people who see our posts or react to them; what you do on a network is governed by that network's own policy. Today these tools run as a test and publish nothing. Posts on TikTok are published by hand, from the TikTok app.
YouTube API Services
Our publishing tool uses YouTube API Services to upload our own videos to our own YouTube channel. Using it is subject to the YouTube Terms of Service, https://www.youtube.com/t/terms, and Google handles data according to the Google Privacy Policy, http://www.google.com/policies/privacy.
The tool acts with the authorisation of our own channel only. It keeps the identifier and the status of each video it uploads. It places no cookie, keeps nothing about YouTube users and shares nothing with anyone. The authorisation given to the tool can be withdrawn at any time on Google's security settings page, https://security.google.com/settings/security/permissions. What the tool kept is deleted on request, by writing to us, and after the authorisation is withdrawn, within the 7 calendar days that YouTube's policies set.
Facebook and Instagram
Our publishing tool uses Meta's programming interfaces to publish on our own Facebook Page and our own Instagram account. It uses no login of anyone else and receives no data about other people; it keeps the identifiers of the posts it publishes.
Deleting data. To ask that anything we hold about you be deleted, including anything received through Meta's or Google's services, write to [email protected] (provisional address) with the subject “Data deletion”, and say which address or account it concerns.
Who else receives the data
The hosting company of our server and Cloudflare, as described above, only to provide their service to us. We do not sell personal data and we do not share it for advertising.
Outside the European Union. Cloudflare, Inc. is a company of the United States, and the images and the database copies may be processed outside the European Union. The safeguard on which such transfers rest is to be completed.
Your rights
Under the GDPR you may ask us for access to the data we hold about you (Article 15), for their correction (Article 16) or deletion (Article 17), for the restriction of their use (Article 18), and for a copy in a usable form (Article 20); you may object to their use based on our legitimate interest (Article 21), and withdraw your consent at any time (Article 7(3)). Write to [email protected] (provisional address). The GDPR gives us one month to answer (Article 12(3)).
You may also complain to a supervisory authority: in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro, or the authority of the country where you live or work.
We take no decision about readers by automated means, and we build no profile of readers (Article 22).
For readers in the United States
We expect most of our readers to be in the United States. What follows says how the United States rules that concern a site like ours stand today.
Children
A Century Late is a publication for a general audience. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that a child under 13 has given us an email address, we delete it. A parent who believes this has happened can write to [email protected] (provisional address).
What we collect, and who else receives it
- Collected: the email address you give for the newsletter, with the date you gave it, the language of the site you gave it on and whether you are subscribed; and, in our server's log, the IP address, the address requested, the page you came from and the identification your browser sends, deleted after 14 days. The IP address and the address requested are also noted in the server's system journal, which has no fixed period (see above).
- Who else receives it: the company that hosts our server, and Cloudflare, which delivers our images and receives the IP address and the address requested (see above). No one else.
- No sale: we do not sell personal information, and we do not share it for advertising. We do not sell, rent or give subscriber addresses to anyone.
- Other parties: we do not let advertising, analytics or social-media companies collect information through our site.
- Do Not Track and Global Privacy Control: we do not collect information about your activity across other websites, and we do not sell or share personal information for advertising, so the site behaves the same whether or not your browser sends one of these signals.
- Seeing or correcting what we hold: write to [email protected] (provisional address); the rights described above apply to every reader, wherever they live.
- Changes: a new version of this policy is published on this page, with its new date at the top.
The newsletter
Today no newsletter email is sent. The address you give is used only for the newsletter you asked for.
State privacy laws
California's Consumer Privacy Act and most of the similar laws of other states apply only to a business above a threshold: of revenue, of the number of residents whose personal data it handles or sells, or of the share of its revenue that comes from selling personal data. A few also apply to any business that sells personal data or handles sensitive data, such as data about health or a precise location. We are far below these thresholds today, we do not sell personal information and we ask for no sensitive data. The laws of Texas and Nebraska set no such number; the rights described on this page, and the appeal below, are open to their residents as to every reader.
Nevada residents may still send a request not to have their information sold to [email protected] (provisional address); there is nothing to sell. If we refuse a request about your data, you may ask us to reconsider by writing to the same address with the subject “Appeal”. Postal address for requests: [to be given] (provisional).
Where the requirements come from
This page answers these requirements; each comes from the official page named.
- GDPR Article 13: the controller and its contact, the purposes and the legal basis, the legitimate interests, the recipients, transfers outside the EU, the retention period, the rights, the withdrawal of consent, the complaint to an authority, whether giving the data is required, automated decisions: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
- GDPR Article 12: clear and plain language; one month to answer a request: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
- The Romanian supervisory authority (ANSPDCP), for complaints: https://www.dataprotection.ro/
- ePrivacy Directive Article 5(3): information stored in or read from the user's device, and consent: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02002L0058-20091219
- YouTube API Services Developer Policies III.A: say that YouTube API Services are used, link to the YouTube Terms of Service and to the Google Privacy Policy, what is collected and shared, cookies, how to revoke access at Google's security settings page, a contact; deletion within 7 calendar days: https://developers.google.com/youtube/terms/developer-policies
- YouTube API Services Terms of Service, section 7: a published privacy policy for the API client: https://developers.google.com/youtube/terms/api-services-terms-of-service
- Google OAuth verification: the privacy policy on the domain of the home page, linked from the home page, saying how Google user data are used: https://support.google.com/cloud/answer/13464321
- Google API Services User Data Policy: a privacy policy that documents how the application uses user data: https://developers.google.com/terms/api-services-user-data-policy
- Meta Platform Terms, section 4: a public privacy policy saying what data are processed, how, why, and how deletion can be requested; section 3.d, deletion: https://developers.facebook.com/terms/dfc_platform_terms/
- Meta App Dashboard: the privacy policy URL and the data deletion instructions URL, which may be a section of the privacy policy: https://developers.facebook.com/documentation/development/create-an-app/app-dashboard/basic-settings.md
- Meta data deletion: apps must tell users in their privacy policy how to ask for deletion: https://developers.facebook.com/docs/development/create-an-app/app-dashboard/data-deletion-callback
- COPPA: who it covers (sites directed to children under 13, or with actual knowledge); a general-audience site that learns a user is a child must meet the rule, for example by deleting the child's information: https://www.ecfr.gov/current/title-16/part-312 and https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions
- CAN-SPAM: what a commercial email must contain (true headers and subject, postal address, a working opt-out honored within 10 business days, no sale of addresses); it applies once emails are sent: https://www.govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-chap103-sec7704.htm and https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business
- California Consumer Privacy Act: who is a covered business (revenue over 26,625,000 dollars; buying, selling or sharing the personal information of 100,000 consumers or households; or half the revenue from selling or sharing it): https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.140 and https://cppa.ca.gov/regulations/cpi_adjustment.html
- California Online Privacy Protection Act: categories collected and shared, the review process, how changes are notified, the effective date, Do Not Track, other parties' tracking: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22575
- Delaware Online Privacy and Protection Act: the same elements: https://delcode.delaware.gov/title6/c012c/index.html
- Nevada NRS 603A.340 and 603A.345: the notice and an address for requests not to sell: https://www.leg.state.nv.us/nrs/nrs-603a.html
- Texas Data Privacy and Security Act (no numeric threshold; small businesses as defined by the SBA exempt): the rights, the appeal, two methods for requests: https://capitol.texas.gov/tlodocs/88R/billtext/html/HB00004F.htm
- Rhode Island 6-48.1-3: a commercial website designates a controller: https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm
- FTC Act section 5: a privacy statement must be kept; no promise that is not kept: https://www.govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-chap2-subchapI-sec45.htm and https://www.ftc.gov/news-events/topics/protecting-consumer-privacy-security/privacy-security-enforcement
- State privacy law threshold, Virginia 59.1-576: not met today: https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-576/
- State privacy law threshold, Colorado 6-1-1304 (as enacted, SB21-190): not met today: https://content.leg.colorado.gov/sites/default/files/2021a_190_signed.pdf
- State privacy law threshold, Connecticut 42-516: not met today: https://www.cga.ct.gov/2026/sup/chap_743jj.htm
- State privacy law threshold, Utah 13-61-102 (annual revenue of 25,000,000 dollars or more, and 100,000 consumers, or 25,000 with over half of revenue from selling data; the text in force from 1 January 2027, H.B. 357 of 2026, keeps these thresholds): not met today: https://le.utah.gov/xcode/Title13/Chapter61/13-61-S102.html and https://le.utah.gov/Session/2026/bills/enrolled/HB0357.pdf
- State privacy law threshold, Oregon 646A.572: not met today: https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html
- State privacy law threshold, Montana 30-14-2803: not met today: https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html
- State privacy law threshold, Iowa 715D.2: not met today: https://www.legis.iowa.gov/docs/code/715D.2.pdf
- State privacy law threshold, Delaware 12D-103 (35,000 consumers, or 10,000 with more than 20% of revenue from selling data; from 1 January 2027, 10,000 or 5,000, H.B. 380 of 2026): not met today: https://delcode.delaware.gov/title6/c012d/index.html and https://legis.delaware.gov/BillDetail/143105
- State privacy law threshold, New Jersey C.56:8-166.5: not met today: https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM
- State privacy law threshold, New Hampshire 507-H:2: not met today: https://gc.nh.gov/rsa/html/LII/507-H/507-H-2.htm
- State privacy law, Nebraska 87-1103: no numeric threshold; small businesses as defined by the SBA exempt, which a foreign operator may not be (not confirmed): the rights and appeal section covers it: https://www.nebraskalegislature.gov/laws/statutes.php?statute=87-1103
- State privacy law threshold, Tennessee 47-18-3202: not met today: https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf
- State privacy law threshold, Minnesota 325M.12: not met today: https://www.revisor.mn.gov/statutes/cite/325M.12
- State privacy law threshold, Maryland Commercial Law 14-4702: not met today: https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4702&enactments=false and https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf
- State privacy law threshold, Indiana IC 24-15-1-1, in force since 1 January 2026 (100,000 Indiana consumers, or 25,000 with more than half of revenue from selling data): not met today: https://iga.in.gov/ic/2026/Title_24/Article_15.pdf
- State privacy law threshold, Kentucky (HB 15, 2024): not met today: https://apps.legislature.ky.gov/recorddocuments/bill/24RS/hb15/bill.pdf
- State privacy law threshold, Rhode Island 6-48.1-4: not met today: https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm