Privacy Policy

Last updated: 29 October 2026

IT Professor (itprofessor.cloud) is a blog about Microsoft security, run by me, Bartosz Wysocki, from the United Kingdom. I'm the data controller for the personal data described here, which means I decide what's collected and why. If you have a question about any of it, email me at itprofessorcontact@gmail.com.

The short version

  • There are no adverts, no Google Analytics and no tracking for marketing. Your data isn't sold or shared with advertisers.
  • If you subscribe, I keep your email address, and your name if you give it, so I can send you new posts.
  • If you become a Supporter, Stripe takes the payment. I never see your card details.
  • Visitor numbers come from Ghost's built-in analytics, which doesn't use cookies. Everything the site stores in your browser is listed in the Cookie Policy.

What I collect and why

When you subscribe to the newsletter

Your email address, your name if you add it, the date you signed up, your newsletter preferences and your approximate location (city and country, worked out from your IP address when you sign up). Ghost also records which page you signed up from, so I can see which posts bring readers in.

I use this to send you each new post by email. The legal basis is your consent, and you can withdraw it at any time with the unsubscribe link in every email or from your account settings.

Ghost also records whether newsletter emails are opened and which links in them are clicked. I use that to see which posts are useful, never to profile you. Blocking images in your email client stops the open tracking.

When you become a Supporter

The Supporter tier is a paid subscription. Stripe processes the payment and handles your card and billing details under its own privacy policy. I can see your name, email address, plan and payment status, but never your card number. The legal basis is the contract between us, and I keep payment records for as long as UK tax rules require.

When you comment

Comments are open to Supporters. Your name, your comment and anything you add to your commenter profile, such as your job title, are shown publicly next to the comment. The legal basis is the contract between us, plus my legitimate interest in running a useful discussion. You can edit or delete your own comments.

When you email me

Whatever you choose to send. I use it to reply to you, under my legitimate interest in answering, and delete it once the conversation is over unless I need it to sort out a dispute.

When you read the site

Ghost's built-in web analytics records the page you viewed, the site that sent you, your country, and your browser and device type. It doesn't set cookies or use stored identifiers to follow you between visits; it counts unique visitors within 24-hour windows. If you're signed in, it also records your member ID and whether you're a free or paid member. I use this to see which posts are worth writing more of. The legal basis is my legitimate interest in understanding how the site is used.

Like any website, the servers that deliver these pages process your IP address so the page can reach you and to protect the site against attacks. Ghost handles this as part of hosting the site.

Who else handles your data

I use a small number of services to run the site. They process data on my behalf, and only for these purposes:

  • Ghost (Ghost Foundation): hosts the site, member accounts, the newsletter and the analytics.
  • Mailgun: delivers the newsletter and sign-in emails for Ghost.
  • Tinybird: processes the web analytics for Ghost.
  • Stripe: takes Supporter payments and checks them for fraud.

Some posts embed content from other sites, such as YouTube videos. If you load or play one, that site receives your data under its own privacy policy.

I don't sell your data, and I don't share it with anyone else unless the law requires it.

International transfers

Some of these providers process data outside the UK, including in the European Union and the United States. Where they do, they rely on recognised safeguards such as standard contractual clauses or the UK Extension to the EU-US Data Privacy Framework.

How long I keep it

  • Member accounts: for as long as you have an account. Unsubscribing stops the emails; to delete your account completely, email me.
  • Supporter payment records: normally six years, because UK tax rules require it.
  • Comments: until you delete them or your account.
  • Emails: until the conversation is over.
  • Analytics: kept by Ghost under its own retention rules.

Your rights

Under UK data protection law you can ask for a copy of your data, ask me to correct or delete it, object to or restrict how I use it, ask for it in a portable format, and withdraw your consent at any time. Email me and I'll reply within a month. Once you're signed in, you can also change your email address, name and newsletter preferences yourself from the Account button at the top of the site.

If you're unhappy with how I've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. I'd appreciate the chance to put it right first.

Keeping it secure

Members sign in with one-time links sent by email, so there are no member passwords to leak. The site runs on Ghost's managed hosting over HTTPS. No system is perfectly secure, so if a breach ever affects your data, I'll tell you and the ICO as the law requires.

Children

This site is written for security professionals and isn't aimed at children. Please don't sign up if you're under 13.

Changes to this policy

If I change this policy, I'll update the date at the top. If a change affects how I use your data, I'll tell subscribers by email first.