Privacy Policy
Last updated: 17 October 2026
Website: jaymes.io
Data controller: Jaymes Payten
Privacy, shoulder pads, and other things that should never go out of fashion
We take your personal information more seriously than Joan Collins took her shoulder pads. And if you survived the 1980s, you'll know that's a fairly substantial commitment.
Welcome to jaymes.io, a place for Stories about marketing, AI, technology, SEO, AEO, and whatever else catches my eye. This Privacy Policy explains what personal information I collect, why I need it, who may help process it, how long it stays around, and what rights you have. Think of it as the instruction manual your Commodore 64 should have come with, except you don't need to type LOAD "*",8,1 to get started.
The short version: I don't sell your personal information. I only collect and use information for legitimate, explained purposes, and optional analytics require your consent. Where this policy describes accounts, Community, or newsletters, those provisions apply when the relevant feature becomes available.
Who's running this arcade?
Jaymes Payten is the data controller for personal information processed through jaymes.io. That means I'm responsible for deciding why and how that information is used.
The quickest way to reach me about anything in this policy is by email:
Privacy email: [email protected]
Website: jaymes.io
If a formal request genuinely needs a postal address, email me and I'll provide one. No carrier pigeons, no fax machines, and definitely no messages hidden in the sleeve notes of a 12-inch single.
What information do I collect?
It depends on how you use the site. Reading a Story doesn't require you to introduce yourself, present a Blockbuster membership card, or explain why you once owned chocolate-scented soap.
Information you choose to provide
- Contact forms: first name, last name, email address, and the message you send.
- Member registration, when available: display name, email address, and an authentication credential, such as a securely hashed password or a Google sign-in identifier.
- Optional profile details: a profile image or avatar, where the feature permits one.
- Community activity, when available: comments, replies, votes, moderation history, and related account activity.
- Newsletter sign-up, if introduced: the email address you provide, your subscription choice, and relevant consent or unsubscribe records.
- Other correspondence: information you voluntarily include in an email or other communication.
Please don't put passwords, bank-card details, or sensitive personal information into comments or contact messages. This isn't a 1980s television competition. Nobody needs your mother's maiden name to win a toaster.
Information generated when you use the website
To operate and protect the site, technical systems may process information such as your IP address, request date and time, browser and device information, pages requested, error messages, and security events. These details can help identify attacks, prevent spam, and troubleshoot faults.
If you consent to optional analytics, additional usage information may be collected, such as pages viewed, approximate location, traffic source, and interactions with Stories. The exact analytics cookies and their lifetimes will be explained in the separate Cookies Policy.
What do I do with it?
I use personal information only for relevant purposes, including to:
- Respond to messages and enquiries.
- Create, verify, and manage member accounts when registration is available.
- Enable Community participation, comments, replies, and voting.
- Moderate contributions and prevent spam, harassment, and misuse.
- Operate, maintain, debug, and secure the website.
- Understand website usage through optional analytics, where you've consented.
- Send a newsletter if you separately choose to subscribe after that feature launches.
- Meet applicable legal obligations and establish, exercise, or defend legal claims where necessary.
I don't sell your personal data. I also don't need to know whether you completed Pac-Man, although I reserve the right to be impressed.
The legal reasons for processing
Under the EU General Data Protection Regulation (GDPR), personal information needs a lawful basis. Depending on the activity, these may include:
| Activity | Typical lawful basis |
|---|---|
| Answering a contact enquiry | Legitimate interests in responding to enquiries, or steps requested before entering a contract where applicable |
| Creating and operating a member account | Performance of a contract under the site's applicable terms |
| Providing requested Community functions | Performance of a contract under the site's applicable terms |
| Moderation, anti-spam, and website security | Legitimate interests in maintaining a safe and functioning service, balanced against users' rights |
| Optional analytics | Consent |
| Optional newsletter marketing | Consent, where required |
| Legal recordkeeping and compliance | Legal obligation |
| Handling legal disputes | Legitimate interests or another applicable lawful basis, depending on the circumstances |
Where processing relies on consent, you can withdraw it. Withdrawal won't make earlier lawful processing unlawful. Where processing relies on legitimate interests, you may have the right to object.
Unlike the instructions for assembling an IKEA unit in 1987, these reasons aren't supposed to leave you with three mysterious screws.
Cookies, analytics, and the biscuit situation
Cookies are small pieces of information websites can store on your device. They are not custard creams, bourbon biscuits, or those suspiciously dry things at the bottom of your nan's biscuit tin.
Some cookies or similar storage may be necessary to keep the website working, remember your privacy choices, protect sessions, and support security. Optional analytics cookies are used only with your consent. Advertising trackers are not part of the initial plan; if that changes, the relevant disclosures and consent controls must change too.
The website uses Google Tag Manager, container GTM-KZP3ZWMC, to manage website tags. Google Analytics 4 is the intended analytics service, subject to consent and configuration. Google Tag Manager itself is a tag-management tool; what information is processed depends on the services deployed through it.
You can accept, reject, or customise optional cookie categories and revisit your choices through Cookie settings in the footer. Rejecting optional cookies shouldn't prevent you from reading Stories or using essential website features.
For specific cookie names, providers, purposes, and durations, see the Cookies Policy. If you remember waiting for a ZX Spectrum cassette to load for 20 minutes only to get a tape-loading error, you'll appreciate why we want our settings to work the first time.
Accounts and Google sign-in
When member registration becomes available, you'll be able to create an account using an email address and password or sign in with Google.
For email-and-password registration, the service will require email verification and store passwords in a securely hashed form, not as readable text. Password resets and safeguards against automated abuse will also be provided.
If you use Google sign-in, the site will request only basic information needed to identify your account, such as your name, email address, and profile picture, depending on the permissions shown to you. It will not request access to your Gmail messages, Google Contacts, or Google Drive. Google's handling of information is also governed by its own privacy terms.
Your email address and authentication details won't be shown publicly simply because you've joined. This is a member account, not a Top of the Pops audience participation segment.
Community, comments, and the great joystick wars
When Community launches, members will be able to comment on Stories, reply to others, and vote on comments. Like the eternal Commodore 64 versus ZX Spectrum argument, discussions may become spirited. Unlike that argument, they still need rules.
Publicly visible information may include: your display name, avatar, comments, replies, comment scores, and account creation date. Please remember that anything you publish publicly may be read, copied, or quoted by other people.
Not publicly displayed: your email address, IP address, security logs, password information, and your individual upvote or downvote choices. Public scores may show totals, but not a list identifying who cast each vote.
To reduce spam, a member's first comment will require review. Once approved, later comments may appear immediately unless moderation or anti-abuse systems flag them. Content may be removed or restricted for safety, legal, or moderation reasons.
If you delete your account
You may request account deletion. Personal account details will be deleted or retained only where a lawful reason requires retention. Existing comments and replies may remain to preserve discussion context, but they will be attributed to Deleted User and the link to your former account will be removed. Votes associated with the account will be deleted or irreversibly anonymised.
There is one important distinction: removing an account label does not guarantee that the text of a comment is anonymous if you previously included identifying details in it. You can ask for specific contributions to be reviewed for removal or anonymisation, subject to applicable rights and legal exceptions.
No one needs a permanent online monument to their 1984 mullet. Unless they specifically want one.
Contact forms and email updates
If you send a message through a contact form, I use the details provided to respond and manage the correspondence. The form asks for your first name, last name, email address, and message. A telephone number is not required.
A newsletter may be introduced later. There is no newsletter subscription merely because you contact the site or register for Community. If a newsletter launches, subscribing will be optional, and each marketing email will offer a straightforward unsubscribe method. A limited suppression record may be retained where necessary to honour unsubscribe requests.
If I ever send you an unsolicited chain letter promising seven years of bad luck unless you forward it to ten friends, you have my permission to question whether I've been replaced by a 1980s photocopier.
Who else handles information?
Running a website involves service providers. Depending on the functions in use, these can include hosting and infrastructure providers, content-delivery and security services, email delivery providers, authentication services, analytics tools, and database or backup services.
The site's infrastructure uses Hostinger-hosted server services, and Cloudflare is used for DNS and related web infrastructure. Google Tag Manager is configured, and Google Analytics 4 is planned for consent-based measurement. Google sign-in will be relevant once that registration option launches.
Providers should receive only the information needed to perform their services and must be subject to appropriate privacy and security arrangements. Personal information may also be disclosed where required by law, to protect legal rights, or to respond to a valid legal process.
I do not sell personal information. I don't trade it for a Sinclair C5, a Walkman, or even a mint-condition arcade cabinet.
AI and automated publishing
Some Stories may be researched, drafted, or published with the assistance of AI systems. That doesn't mean private account details, contact messages, or unpublished Community data are automatically sent to an AI provider. If a future feature uses AI to process personal information, its purpose, relevant provider, and lawful basis must be assessed and disclosed before activation.
Great Scott! International data transfers
Great Scott! Your information might travel further than Marty McFly's DeLorean, but it doesn't get a free pass through the space-time continuum.
Some service providers may process or access personal information outside Cyprus or the European Economic Area (EEA). Where a transfer is subject to GDPR restrictions, it must have a lawful transfer mechanism, such as a relevant European Commission adequacy decision or appropriate safeguards including Standard Contractual Clauses, together with any additional measures required in the circumstances.
The precise countries and safeguards depend on the providers and services actually in use. You can contact me for more information about relevant transfer safeguards.
How long is information kept?
Personal information isn't kept indefinitely just because a storage cupboard is available. Even in the 1980s, there came a point when someone had to throw out the Betamax tapes.
The following are the intended retention rules for jaymes.io, subject to any longer period required by law or necessary for a legitimate dispute:
| Information | Intended retention |
|---|---|
| Contact form enquiries | Up to 12 months after receipt, unless an ongoing matter requires longer |
| Member account details | While the account remains active; removed following a valid deletion request, subject to lawful exceptions |
| Public Community contributions | While published; after account deletion, retained only with the account link removed as described above, or removed where required |
| Votes | While associated with an active account; deleted or irreversibly anonymised on account deletion |
| Newsletter subscription details, if introduced | Until unsubscribed, with limited suppression evidence retained where necessary |
| Analytics data | According to the configured analytics retention settings and applicable consent |
| Security and server logs | For a limited period appropriate to security, troubleshooting, and legal needs; extended only where justified |
| Consent records | For as long as reasonably needed to demonstrate and honour privacy choices |
| Records needed for legal claims or compliance | For the applicable legal period or while a relevant claim remains unresolved |
Backups may take additional time to rotate out of protected storage. If deleted information exists in a backup, it should not be restored into active use except where necessary and lawful, and deletion controls should be reapplied where appropriate.
Security, without the floppy-disk drama
Reasonable technical and organisational measures are used to protect information against unauthorised access, loss, alteration, and disclosure. Measures appropriate to the service include access controls, encrypted connections, password hashing, secure backups, updates, and anti-abuse protections.
No online system can promise absolute security. Remember when someone could ruin your entire afternoon by placing a fridge magnet near a floppy disk? Modern threats are different, but the need to be careful hasn't gone away.
If you suspect a security issue involving your information, email [email protected].
Your rights, no cheat codes required
Under the GDPR, depending on the circumstances, you may have the right to:
- Access personal information held about you.
- Rectify information that's inaccurate or incomplete.
- Erase information in circumstances where the right to erasure applies.
- Restrict certain processing.
- Object to processing based on legitimate interests or to direct marketing.
- Receive or transfer certain information where data portability applies.
- Withdraw consent at any time for processing based on consent.
- Complain to a competent data protection authority.
You also have rights relating to certain decisions based solely on automated processing that produce legal or similarly significant effects, where applicable. The website does not plan to make such decisions as part of ordinary Story reading or Community participation.
To exercise your rights, email [email protected]. I may need to verify your identity before fulfilling a request, and some rights have lawful limits. Requests will be handled within the timeframes required by applicable law, normally within one month, subject to permitted extensions.
You won't need the Konami Code, a Rubik's Cube solution, or three tokens for the arcade machine.
Complaints
If you're concerned about how your information is handled, please contact [email protected] so I can look into it.
You also have the right to lodge a complaint with a competent supervisory authority. In Cyprus, the relevant authority is:
Office of the Commissioner for Personal Data Protection
15 Kypranoros Street
1061 Nicosia
Cyprus
Email: [email protected]
Telephone: +357 22 818 456
The applicable framework includes the EU GDPR and Cyprus data protection legislation. Complaints aren't handled by a man in a shell suit shouting into a brick-sized mobile phone. Thankfully.
Other websites
Stories may link to other websites, platforms, or services. Once you follow an external link, that destination may collect information under its own policies. I don't control third-party privacy practices.
Treat unfamiliar links like a bargain-bin VHS labelled Definitely Not Recorded Off The Telly. Check what you're getting into.
Changes to this policy
This policy may change as the website develops, especially when accounts, Community, newsletters, or new service providers become active. Material changes will be communicated where appropriate, and the Last updated date at the top will be revised.
The 1980s gave us New Coke, leg warmers, and an astonishing number of questionable hairstyles. Change isn't always progress, but privacy notices do need to keep up with reality.
Contact details
For privacy questions, data rights requests, or concerns:
Jaymes Payten
Email: [email protected]
Website: jaymes.io
And if you've read this far, congratulations. You've survived a complete Privacy Policy without needing to rewind a cassette with a Bic biro.
Now go enjoy the Stories. Pac-Man would approve. 👾