Privacy policy

Last updated: 10 October 2026. Effective from publication.

This page explains what data Companion Index collects, how it is used, and what choices you have. It is written to comply with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). It is not a substitute for legal advice.

Who we are

Companion Index is published by Le Bazar de Babylone, a French SASU registered as RCS Melun 949 972 475. Contact: privacy@thecompanionindex.com. Postal address is on our legal mentions page.

What we collect

We collect a small amount of data, in two categories.

Information you provide

• Email address, if you submit our newsletter signup form. Used solely to send you the newsletter you signed up for. Stored on Substack (or our newsletter provider of record), not on our servers.
• Email content, if you write to us. We keep the email exchange as part of normal correspondence and reference for future correspondence. Not shared with third parties.

Information collected automatically

• Analytics. When you accept analytics cookies, we use Google Analytics 4 and Microsoft Clarity. GA4 collects standard pageview data (URL, referrer, country, anonymised IP). Clarity records mouse movements, clicks, and scrolls; sensitive form fields and content (such as password inputs) are masked by default. Both are stored on Google and Microsoft servers respectively, under their privacy policies.
• Server logs. Our hosting provider (Vercel) maintains technical logs for the operation of the site (IP, request URL, user agent). These are retained per Vercel's standard policy.
• Audience statistics. Vercel Web Analytics counts visits without any cookie and without storing anything in your browser: the page viewed, the referring site, your country, your type of device and browser, and which app button you click. Vercel tells visits apart with a fingerprint of the request that it deletes after 24 hours, so the figures cannot be traced back to you.

Audience measurement

This measurement only gives us totals (visits per page and per country, clicks per app). It does not follow you to other sites and is never used for advertising. It is separate from the analytics cookies of the consent banner. You can turn it off in this browser at any time:

We do not collect data through behavioural advertising trackers. We do not sell or share personal data with third parties for marketing purposes.

Cookies

This site uses a small number of cookies and local storage entries:

• ci_cookie_consent (local storage): stores your choice to accept or refuse non-essential cookies. Strictly necessary, set with no expiry.
• Google Analytics 4 cookies (_ga, _ga_*): set only after you accept analytics cookies. Used for visitor measurement.
• Microsoft Clarity cookies (_clck, _clsk, CLID): set only after you accept analytics cookies. Used for behavioural analytics.

You can refuse non-essential cookies via the consent banner that appears on your first visit, and revisit your choice by clearing the ci_cookie_consent entry in your browser's local storage.

For the full breakdown of cookies including durations and purposes, see our Cookie Policy.

Legal basis for processing (GDPR)

Under GDPR, we rely on the following legal bases:

• Consent: for analytics cookies and newsletter subscriptions. You may withdraw consent at any time without affecting prior processing.
• Legitimate interest: for technical server logs, used to operate and secure the site, and for the cookieless audience statistics, which you can turn off above.

Your rights (GDPR + CCPA)

Regardless of where you live, you have the following rights:

• Access: request a copy of the data we hold about you.
• Correction: ask us to correct inaccurate data.
• Deletion: ask us to delete data we hold about you, subject to legal retention requirements.
• Objection: object to processing based on legitimate interest.
• Portability: receive your data in a machine-readable format.
• CCPA-specific (California residents): opt out of any "sale" of your data. We do not sell personal data, but you may issue the opt-out request anyway for the record.

To exercise any of these rights, write to privacy@thecompanionindex.com. We respond within 30 days.

Data retention

Email correspondence: retained until no longer relevant for the exchange, then deleted. Newsletter subscription: retained until you unsubscribe. Analytics data: retained per Google's and Microsoft's default retention policies (14 months for GA4 default, up to 13 months for Clarity). Audience statistics: 12 months in Vercel's reports; we keep only daily totals per page after that. Server logs: retained per Vercel's retention policy.

Third-party processors

The following third parties process data on our behalf:

• Vercel Inc.: hosting, CDN and cookieless audience measurement.
• Google LLC: Google Analytics 4, anonymised pageview tracking.
• Microsoft Corporation: Clarity, behavioural analytics.
• Substack Inc. (or successor provider): newsletter infrastructure.
• CrakRevenue Inc.: affiliate tracking. When you click an affiliate link, CrakRevenue's infrastructure registers standard request metadata (IP address, user agent, referrer) on its side, as is typical for affiliate networks. We do not transmit any additional personal data to them.

International data transfers

Some of our processors are located in the United States. Where applicable, transfers rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

Children's privacy

Companion Index is intended for adult readers only. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with data, please write to privacy@thecompanionindex.com and we will delete it.

Changes to this policy

We may update this policy. Material changes will be reflected by updating the "Last updated" date at the top. We recommend reviewing the policy periodically.

Contact and complaint

For privacy questions: privacy@thecompanionindex.com.

If you reside in the EU and believe your rights have not been respected, you may lodge a complaint with your national data protection authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL): cnil.fr.