Privacy | Matthew Soo Ho

Who looks after your information

I'm Matthew Soo Ho, and I run matthewsooho.com. This notice describes how this personal site handles information about visitors and the newsletter being tested on protected staging. Where data protection law uses that term, I'm the controller of the personal information I collect through the site.

For privacy questions or requests, email matthew@matthewjames.ca. This is also my contact for the personal site; you don't need to subscribe to ask a question.

Visiting the site

You can read the site without joining a mailing list. Hosting and security services process technical information needed to deliver pages and protect the site, such as your IP address, browser information, requested pages, and request times. Cloudflare provides the site's delivery and security services.

The map shows my saved location. It doesn't ask for or determine your device's location. When the map loads, your browser requests map images from OpenStreetMap's tile service, which receives your IP address and request information.

Pages that contain embedded YouTube videos connect to YouTube when the embed loads. YouTube may receive device and request information and use cookies or similar technologies, including before you press play. Ordinary links to Instagram, LinkedIn, and other sites take you to those providers only when you follow the link.

Optional emails about new posts

The newsletter is for links when I publish something new. Protected staging tests use real confirmation emails. It won't subscribe you to Matthew James, PoweredOps, or another mailing list. Any different newsletter or promotional use would need its own clear explanation and any consent required by law.

If you choose to subscribe, including during testing, the mailing system uses your email address. It also keeps subscription, confirmation, and unsubscribe records and information about delivery failures or spam complaints. The signup service uses technical request information and temporary protected records to prevent abuse.

Signup uses a confirmation email. You will need to follow its confirmation link before receiving post notifications. Choosing not to subscribe has no effect on your ability to read the site.

The intended post-notification newsletter won't use open or click tracking. During the current staging test, confirmation emails contain Maileroo tracking links and an open-tracking image. These can record link clicks and image loads. That setup is being reviewed before public launch. Delivery information is still needed to send messages and stop sending to addresses that bounce or report spam.

Why information is used

I use information to deliver and protect the site, provide the updates you request, respect your subscription choices, respond to messages, and meet applicable legal obligations.

Where a legal basis is required, newsletter emails rely on your consent. Limited processing needed to run a secure site, answer correspondence, and maintain necessary records may rely on legitimate interests or a legal obligation, where the applicable law allows it. These purposes don't include profiling you for advertising or making automated decisions with legal or similarly significant effects.

I don't sell or rent subscriber addresses or use personal information for targeted advertising.

Subscriber records are held in a listmonk mailing system I manage. The delivery setup uses Maileroo to send messages and Activepieces to handle relevant delivery failures and complaints. Those services may process recipient addresses, message content or delivery metadata, and records needed to prevent unwanted email.

Cloudflare processes website traffic for hosting and security. OpenStreetMap processes requests for the map, and Google/YouTube processes requests for embedded videos where they appear. More information about these providers is available here:

Information may also be disclosed when required by law or when reasonably necessary to investigate abuse or protect people's rights and security. A service provider's own notice doesn't replace my responsibility for information I control.

Cookies and similar technologies

Security and access services may use cookies or similar technologies to distinguish legitimate visitors and keep protected pages secure. Embedded video providers may also use them. Browser settings can help control cookies, but blocking them may affect those features.

I don't run advertising pixels on this site. If I introduce nonessential tracking, I'll explain it and provide the choices or consent controls required by applicable law. Changing browser settings doesn't unsubscribe an email address from a newsletter.

The site doesn't change its behavior in response to a browser's Do Not Track signal. The providers linked above explain their own cookie and tracking practices.

International visitors and processing

People can visit from different countries, and service providers operate internationally. Your information may be processed outside the country where you live, where legal protections may differ.

Applicable data protection law may require safeguards for international transfers. You can contact me for information about the providers involved and the arrangements relevant to your information. Simply visiting the site is not treated as consent to marketing or as a waiver of your privacy rights.

Keeping and removing information

Subscription information is kept for as long as needed to provide requested updates and manage your preferences. After you unsubscribe, limited records may still be needed to avoid contacting you again, document consent and withdrawal, investigate delivery problems, or meet a legal obligation. Unsubscribing stops newsletter delivery; it doesn't necessarily erase every related record.

Other records are kept only for the purpose that justifies them, such as security, correspondence, or handling a privacy request. Retention depends on that purpose, applicable requirements, and the provider's relevant retention settings. Protected backup copies may remain until they are replaced through the backup cycle.

You can ask what information is held about you or request deletion. I'll explain any information that needs to be retained and why.

Your choices and rights

Once the newsletter is available, each post-notification email will include an unsubscribe link. You can also email me to withdraw consent. Withdrawal doesn't change the lawfulness of processing that happened before it.

Depending on your location and the law that applies, you may have rights to access or correct your information, request deletion or a portable copy, restrict processing, or object to certain uses. You may also have the right to complain to your local data protection authority and, where applicable, appeal a decision about a request.

Contact me using the email above to make a request. I may need enough information to verify that the request relates to you, and I'll respond within the time required by applicable law. Some rights have exceptions, which I'll explain when relevant.

The newsletter isn't directed at children, and I don't deliberately collect children's personal information. If you believe a child has provided information, contact me so it can be reviewed and removed where appropriate.

Changes to this notice

I'll update this notice when the site's practices change and revise the date at the top. Before using information for a new purpose, I'll provide any additional notice and seek any new consent required by applicable law.