Privacy and Cookie Policy
Last updated: 17 September 2026
This Privacy and Cookie Policy explains how The Hairy Chin collects, uses, stores, and shares personal data when you visit www.thehairychin.com, subscribe to or interact with The Hairy Chin on Substack, listen to the podcast through an embedded player, contact us, purchase a product or service, make a financial contribution, download a resource, submit content, or otherwise interact with The Hairy Chin.
1. Who We Are
The data controller is:
Spencer Moore Landvater, trading as The Hairy Chin
Carrer Casp 148
08013 Barcelona, Spain
Email: hello@thehairychin.com
The Hairy Chin is based in Spain and processes personal data in accordance with the European Union General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights, and other applicable privacy and electronic communications laws.
In this policy, “The Hairy Chin,” “we,” “us,” and “our” refer to Spencer Moore Landvater, trading as The Hairy Chin.
2. Services Covered by This Policy
This policy applies to personal data processed in connection with:
The Hairy Chin website at www.thehairychin.com
The Hairy Chin publication and paid or free subscriptions hosted on Substack
Embedded Substack subscription forms on The Hairy Chin website
The Hairy Chin podcast and embedded podcast or media players
Contact forms, email communications, surveys, and applications
Digital resources, toolkits, downloads, products, and services
Paid subscriptions, purchases, financial contributions, and refunds
Consulting inquiries and related communications
Interviews, testimonials, stories, media, and other voluntary submissions
Any other service that links directly to this policy
Third-party platforms may process personal data for their own purposes under their own privacy policies. This policy explains The Hairy Chin’s processing and does not replace the privacy notices provided by Substack, Squarespace, Stripe, Printful, podcast platforms, social-media services, or other independent third parties.
3. Personal Data We Collect
The personal data we collect depends on how you interact with The Hairy Chin.
3.1 Information You Provide Directly
We may collect:
Your name, email address, telephone number, location, social-media handle, website, or other contact information
Information submitted through contact forms, emails, messages, surveys, questionnaires, applications, or consultation inquiries
Your subscription choices, communication preferences, and consent records
Information connected with an order, paid subscription, contribution, refund, or service request
Comments, replies, testimonials, stories, interview materials, photographs, recordings, audio, video, and other content you choose to submit
Information required to schedule, administer, or provide a consultation or other service
Any other information you voluntarily provide
3.2 Subscription and Publication Data
When you subscribe to or interact with The Hairy Chin on Substack, we may receive or process:
Your name and email address
Your free or paid subscription status
The date you subscribed, unsubscribed, upgraded, cancelled, or changed your subscription
Your publication and email preferences
Email-delivery and engagement information, including opens and link clicks where this functionality is enabled and legally permitted
Page views, referral sources, reader counts, general location information, and other publication analytics made available by Substack
Comments, likes, survey responses, messages, replies, or other information you provide through Substack
Limited payment and transaction information relating to a paid subscription, such as the amount, currency, payment status, and transaction date
We do not receive or store your complete payment-card number.
3.3 Purchase, Payment, and Transaction Data
If you purchase a resource, product, subscription, or service, or make a financial contribution, we may process:
Your name, email address, billing address, and delivery address, where applicable
The product, resource, subscription, or service purchased
The amount, currency, date, payment status, taxes, and transaction identifier
Information needed to provide customer service, issue a refund, prevent fraud, or comply with accounting and tax requirements
Order and fulfilment information shared with providers such as Printful when a physical product requires production or delivery
Complete payment-card details are processed by the payment provider presented during checkout, such as Stripe or a payment service made available through Squarespace or Substack. The Hairy Chin does not store complete payment-card details.
3.4 Technical and Website-Usage Data
When you visit the website or an embedded service loads, we and our service providers may process:
Your Internet Protocol address
Browser type and version
Device type and operating system
Language and approximate location derived from your IP address
Referring website or link
Pages viewed and links selected
Date, time, and duration of a visit
Cookie identifiers and consent preferences
Information needed to protect the website, identify technical problems, and prevent fraud or misuse
3.5 Health and Other Sensitive Information
The Hairy Chin publishes content about women’s health and medical self-advocacy. You may choose to disclose health information in an email, interview, story, survey, consultation inquiry, comment, or other communication. Health data is considered special-category personal data under the GDPR.
Please do not include private health information in a public comment or other public area. Information posted publicly may be viewed, copied, or shared by other people. Do not provide health information about another identifiable person unless you have the legal right and appropriate permission to do so.
When you intentionally provide sensitive information directly to us for a stated purpose, we will use it only as reasonably necessary for that purpose and in accordance with applicable law. Where explicit consent is required, we will request it separately. Publishing an interview, testimonial, health story, photograph, or other identifiable submission may also require a separate release or consent process.
4. How We Collect Personal Data
We collect personal data:
Directly from you when you subscribe, contact us, complete a form, purchase something, make a contribution, submit material, or communicate with us
Automatically through cookies and similar technologies when you use the website
Through Substack when you subscribe to or interact with The Hairy Chin’s publication
Through Squarespace when you visit or interact with the website
Through payment, commerce, fulfilment, podcast, media, accessibility, analytics, and other service providers used to operate The Hairy Chin
From publicly available sources or professional platforms when reasonably necessary to respond to an inquiry, prepare an interview, administer a professional relationship, or protect our legal interests
If we receive personal data from another source, we will use it only when we have a lawful basis to do so.
5. Why We Use Personal Data and Our Lawful Bases
We process personal data only when we have a lawful basis under the GDPR.
Operating and protecting the website: We use technical, website-usage, security, and consent information to operate, secure, maintain, and administer the website. We rely on our legitimate interests and, where applicable, compliance with legal obligations.
Sending free publication emails: When you subscribe, we use your name, email address, subscription preferences, and consent record to send The Hairy Chin publication emails. The lawful basis for this processing is your consent.
Providing paid Substack subscriptions: We use contact, subscription, transaction, and payment-status information to establish and administer paid subscriptions. We rely on the performance of our contract with you and compliance with applicable legal obligations.
Processing purchases, contributions, payments, refunds, and deliveries: We use contact, billing, transaction, order, and fulfilment information to complete purchases, accept financial contributions, process refunds, and arrange deliveries. We rely on the performance of a contract, compliance with legal obligations, and our legitimate interests in preventing fraud and resolving disputes.
Responding to communications and service inquiries: We use your contact details and the contents of your communications to respond to contact forms, emails, questions, and inquiries about our services. Depending on the nature of the inquiry, we rely on steps you have requested before entering a contract, the performance of a contract, or our legitimate interests in responding to communications.
Providing consulting and other requested services: We use contact, scheduling, service, communication, and transaction information to administer and provide consulting or another service you have requested. We rely on steps requested before entering a contract, the performance of a contract, and compliance with applicable legal obligations.
Measuring website and publication performance: We may use technical, website-usage, referral, and engagement information to understand how visitors and subscribers interact with the website and publication. We rely on consent where required for cookies, pixels, and similar technologies. Where the law permits processing without consent, we may rely on our legitimate interests in understanding and improving our services.
Remembering website and privacy choices: We use cookie and preference information to remember settings and privacy selections. We rely on consent for non-essential functions. Strictly necessary technologies may be used where required to operate the website, provide a requested function, or remember your privacy choices.
Publishing submitted material: If you agree to participate in an interview or provide a testimonial, story, photograph, recording, or other submission, we use your identity, submitted material, media, and associated information to prepare and publish that content. Depending on the arrangement, we rely on your consent, the performance of an agreed publication arrangement, or our legitimate interests. We will obtain explicit consent where required to process health information or other sensitive personal data.
Maintaining business and legal records: We use relevant contact, consent, transaction, and communication records to maintain business, accounting, tax, and compliance documentation. We rely on applicable legal obligations and our legitimate interests in maintaining appropriate records and establishing, exercising, or defending legal claims.
Protecting The Hairy Chin and its users: We may use technical, security, transaction, and communication information to identify misuse, secure our accounts and services, investigate suspected fraud, and establish or defend legal claims. We rely on our legitimate interests and, where applicable, compliance with legal obligations.
Where we rely on legitimate interests, we consider whether our interests are proportionate and whether your rights and interests require the information to be protected or processed differently.
Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.
6. The Hairy Chin on Substack
The Hairy Chin uses Substack to host and distribute free and paid publication content, manage subscribers, deliver emails, provide reader features, display publication pages, and process paid subscriptions.
For personal data associated with The Hairy Chin’s subscriber list and publication activities carried out on our behalf, The Hairy Chin is the data controller and Substack, Inc. acts as a data processor. Substack also acts as an independent data controller for certain platform-level activities, including account administration, platform security, recommendations, fraud prevention, legal compliance, and other purposes described in Substack’s own privacy policy.
When you use an embedded Substack subscription form on The Hairy Chin website, information entered into the form is sent to Substack. Loading or interacting with the embedded form may also allow Substack to receive technical information such as your IP address, device or browser information, the referring page, and cookie or similar identifiers.
We use subscriber information to deliver the publication, administer free and paid subscriptions, provide subscriber benefits, understand general readership and engagement, respond to readers, maintain records, and manage the publication.
Substack is based in the United States. According to Substack, transfers from the European Economic Area may be protected through its participation in the EU-US Data Privacy Framework. Substack’s Data Processing Addendum also incorporates the European Commission’s Standard Contractual Clauses where an additional transfer mechanism is required.
Paid-subscription payments are processed through the payment provider selected by Substack, currently Stripe. We may receive limited transaction and subscription information, but not your complete payment-card details.
You can unsubscribe from The Hairy Chin emails at any time using the unsubscribe link included in each publication email. Unsubscribing from The Hairy Chin does not necessarily delete your Substack account or personal data that Substack processes independently. Requests concerning your complete Substack account should be submitted directly to Substack.
You can review Substack’s policies at:
Substack Privacy Policy: https://substack.com/privacy
Substack Publisher Agreement and Data Processing Addendum: https://substack.com/pa
7. Website Hosting and Squarespace
The Hairy Chin website is hosted through Squarespace. Squarespace may process website content, form information, transaction information, device information, IP addresses, security data, and cookie information to host and deliver the website, provide commerce or payment functions, maintain security, and provide website analytics and technical support.
Depending on the function involved, Squarespace may act as a processor for The Hairy Chin or as an independent controller for its own business, security, payment, and legal-compliance purposes. Squarespace and its service providers may process information outside the European Economic Area using legally recognised transfer safeguards.
8. Payments, Purchases, Contributions, and Fulfilment
Payments may be processed by Stripe, Substack’s payment provider, Squarespace Payments, or another payment option identified at checkout. Payment providers process payment credentials, billing information, transaction information, device information, and fraud-prevention data under their own privacy terms and legal obligations.
If you order a physical product fulfilled by Printful, the information necessary to produce and deliver the order may be sent to Printful and its fulfilment and delivery partners. This may include your name, delivery address, contact information, selected product, and order details. Printful may process information in countries outside the European Economic Area using appropriate transfer safeguards.
We do not sell or rent personal data to third parties.
9. Podcast Players, Videos, Social Media, and External Content
The website may contain links to or embedded content from podcast hosts, listening platforms, video services, social-media platforms, or other third-party websites. When embedded content loads, the provider may receive technical and usage information, including your IP address, browser information, the page visited, and cookie identifiers. If you are logged into that provider, it may associate your interaction with your account.
Non-essential embedded media should be blocked until you provide the relevant cookie consent where required. If you follow an external link, the destination provider’s own privacy and cookie policies apply.
10. Accessibility Tools
The website may use UserWay or another accessibility service to provide accessibility functions. When an accessibility widget loads or is used, the provider may process technical information, accessibility preferences, and information needed to deliver the selected functionality. Accessibility preferences may be stored so that the website can remember your choices.
Where an accessibility function is necessary to provide a feature you request, the associated storage may be treated as necessary or functional. Any additional non-essential analytics or tracking used by the provider will require consent where applicable.
11. Who Receives Personal Data
We may share personal data only as reasonably necessary with:
Squarespace and website-hosting, security, analytics, and technical-service providers
Substack and its authorised subprocessors
Stripe, Squarespace Payments, or another payment provider displayed at checkout
Printful and relevant fulfilment, postal, courier, or delivery providers when a physical order requires fulfilment
Podcast, audio, video, and media-hosting services when content or a player is accessed
UserWay or another accessibility provider used on the website
Professional advisers, including accountants, tax advisers, insurers, and lawyers
Government authorities, regulators, courts, law-enforcement bodies, or other recipients when disclosure is required by law or necessary to establish, exercise, or defend legal claims
A successor or prospective successor if all or part of The Hairy Chin is reorganised, transferred, or sold, subject to appropriate confidentiality and legal protections
Other recipients when you instruct us to make the disclosure or provide valid consent
Providers acting as processors may use personal data only under our instructions and contractual safeguards. Some providers also process certain information as independent controllers under their own privacy notices.
12. International Transfers
Some providers used by The Hairy Chin are based in or process personal data in the United States and other countries outside the European Economic Area. When personal data is transferred internationally, the transfer may be protected through:
A European Commission adequacy decision
The EU-US Data Privacy Framework, where the recipient is an active participant and the framework applies
European Commission Standard Contractual Clauses
Supplementary technical, contractual, or organisational safeguards where appropriate
Another transfer mechanism permitted by the GDPR
You may contact us for further information about the safeguards relevant to a particular transfer.
13. Data Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, accounting, security, and dispute-resolution requirements.
The following general periods apply:
Free newsletter and publication records: While you remain subscribed. After you unsubscribe, limited information may be retained to document and respect the opt-out and to meet legal requirements
Paid-subscription records: For the duration of the subscription and afterward for the period necessary to administer payments, refunds, disputes, accounting, and legal obligations
Purchase, contribution, invoice, tax, and accounting records: For the periods required by applicable Spanish tax, accounting, and commercial law
Contact and general inquiry records: Normally for up to two years after the last substantive communication, unless a longer period is necessary for an active relationship, legal obligation, or dispute
Consulting and contractual records: For the duration of the relationship and afterward for the applicable legal limitation and record-keeping periods
Consent and withdrawal records: For as long as reasonably necessary to demonstrate compliance and respect your preferences
Published interviews, stories, podcast episodes, testimonials, and related editorial records: For as long as the material remains published and afterward as reasonably necessary for archival, authorship, consent, and legal records
Cookie and consent choices: For the lifetime stated in the cookie preference tool or until you delete the cookie or change your preference
Security logs: For a limited period appropriate to investigating incidents and protecting the Services
Service providers may retain information in backups or where independently required by law. When identifiable information is no longer required, we will delete or anonymise it where reasonably practicable.
14. Your Rights
Subject to applicable conditions and exceptions, you may have the right to:
Obtain confirmation of whether we process your personal data and request access to it
Ask us to correct inaccurate or incomplete information
Ask us to erase personal data
Ask us to restrict certain processing
Object to processing based on legitimate interests
Object at any time to direct marketing
Receive certain personal data in a structured, commonly used, machine-readable format and ask for it to be transferred where technically feasible
Withdraw consent at any time when processing is based on consent
Lodge a complaint with a competent data-protection authority
Receive information about safeguards used for certain international transfers
To exercise a right, email hello@thehairychin.com. We may request information reasonably necessary to verify your identity. We normally respond within one month, although the GDPR permits an extension in certain complex cases. Rights may be limited where an exemption applies or where information must be retained to comply with law or protect legal claims.
You can lodge a complaint with the Spanish Data Protection Agency:
Agencia Española de Protección de Datos
Website: https://www.aepd.es/
Address: Calle Jorge Juan 6, 28001 Madrid, Spain
You may also contact the supervisory authority in the European Economic Area country where you live, work, or believe an infringement occurred.
15. Marketing and Unsubscribing
We send newsletter and publication emails when you have subscribed or when another valid legal basis permits the communication. You can unsubscribe at any time through the link included in the email or by contacting hello@thehairychin.com.
Withdrawing from marketing does not prevent us from sending a communication that is necessary to administer an existing purchase, paid subscription, requested service, refund, legal notice, or privacy request.
We may retain a minimal suppression record to ensure that an unsubscribe request continues to be respected.
16. Whether You Must Provide Personal Data
You are not generally required to provide personal data simply to read publicly available website content.
An email address is required if you want to receive The Hairy Chin by email. Payment and transaction information is required if you purchase a paid subscription, product, resource, or service, or make a financial contribution. Delivery information is required for a physical order. If required information is not provided, we may be unable to complete the requested subscription, transaction, delivery, or service.
Other information, such as a display name, comment, survey response, story, or testimonial, is generally optional.
17. Automated Decision-Making
The Hairy Chin does not use personal data to make solely automated decisions that produce legal or similarly significant effects concerning you.
Third-party providers may use automated systems for fraud prevention, platform security, spam detection, recommendations, accessibility, analytics, content moderation, and similar operational purposes under their own policies.
18. Children
The Hairy Chin’s Services are intended for adults and are not directed to children under 16. We do not knowingly collect personal data directly from children under 16. If you believe a child has provided personal data to us, contact hello@thehairychin.com so that we can assess and, where appropriate, delete it.
19. Security
We use reasonable technical, organisational, and administrative measures intended to protect personal data. These include limiting access, using established service providers, maintaining account security, and using secure payment processors. No website, email service, transmission, or storage system can be guaranteed completely secure.
20. Third-Party Links
The website, publication, podcast, and resources may link to websites or services that The Hairy Chin does not control. The destination provider is responsible for its own privacy practices. We encourage you to review its privacy and cookie information before providing personal data.
21. Cookie Policy
21.1 What Cookies Are
Cookies are small text files stored on a computer, phone, tablet, or other device when a website is visited. Similar technologies include pixels, tags, local storage, software development kits, and identifiers used in emails or embedded services.
Some cookies are necessary for the website to work. Others remember preferences, measure website use, support embedded services, or help providers understand interactions.
21.2 Legal Basis for Cookies
Strictly necessary cookies may be used without consent because they are required to provide the website or a feature you request, maintain security, process a transaction, or remember privacy choices.
Analytics, advertising, non-essential functionality, and other non-essential cookies or similar technologies will be used only after consent where required by applicable law. Consent can be refused or withdrawn without affecting access to the basic website, although a particular optional feature may not work.
21.3 Cookie Categories
The website may use the following categories of cookies and similar technologies:
Strictly necessary cookies: These cookies are used to operate and secure the website, balance traffic, maintain sessions, process requested transactions, prevent fraud, and remember cookie-consent choices. They may be provided by Squarespace, payment processors, and security providers. Depending on their function, they may remain active only for the current browsing session or for up to two years.
Functional cookies: These cookies remember settings, store accessibility preferences, load subscription forms or media features requested by visitors, and support enhanced website functions. They may be provided by Squarespace, UserWay, Substack, and embedded-media providers. Depending on their function, they may remain active for the current browsing session or for up to two years.
Analytics and performance cookies: These cookies measure website visits, page use, referral sources, performance, and technical errors. This information helps us understand how people use the website and publication and identify areas that may need improvement. These technologies may be provided by Squarespace Analytics, Substack analytics, and analytics associated with embedded services. Depending on the provider and configuration, they may remain active for the current browsing session or for up to two years.
Marketing and external-media cookies: These cookies may measure engagement with campaigns, load third-party content, or allow an external provider to recognise a visitor across different websites or services. They may be used by Substack or by social-media, podcast, video, and other embedded-content providers where these features are enabled. Depending on the provider, they may remain active for the current browsing session, for up to two years, or for another period specified in the provider’s privacy or cookie policy.
The exact cookies used may change when Squarespace or another provider updates its services or when website features are added, changed, or removed. The website’s cookie-preference tool should display the current cookie categories available on the visitor’s device. The privacy and cookie policies of the providers identified in this policy contain additional information about their technologies and retention practices.
21.4 Squarespace Cookies
Squarespace uses cookies and related technologies to operate and secure the website. Depending on the site configuration and the visitor’s choices, Squarespace may also use cookies for analytics, performance, commerce, sessions, and preference functions.
Squarespace cookies may include session or security cookies, cookies that remember cookie-banner choices, and analytics cookies that distinguish visitors and measure website activity. Non-essential Squarespace analytics should remain disabled until consent is obtained where required.
21.5 Embedded Substack Forms
The website uses embedded Substack forms to allow visitors to subscribe to The Hairy Chin. When an embedded form loads or is used, Substack may receive technical data and may use cookies or similar technologies for security, functionality, subscription administration, analytics, or other purposes described in its privacy policy.
Where the embedded form or associated technology is not strictly necessary and requires consent, it should not load until the visitor accepts the relevant cookie category. A visitor may alternatively subscribe directly through The Hairy Chin’s Substack page, where Substack’s own privacy and cookie controls apply.
21.6 Payment and Commerce Technologies
Stripe, Squarespace, Substack, or another payment provider displayed at checkout may use cookies or similar technologies to process payments, authenticate users, prevent fraud, maintain security, remember checkout information, and comply with legal obligations. Technologies strictly necessary to complete a transaction requested by the visitor may operate without optional cookie consent. Any separate analytics or marketing technology remains subject to applicable consent requirements.
21.7 Embedded Podcast, Video, and Social Content
Embedded podcast players, video players, social-media content, and other external media may place cookies or transmit information to the provider. Where required, these embeds should be blocked until the visitor accepts the relevant category. A notice or placeholder may be shown until consent is given.
21.8 Accessibility Preferences
An accessibility tool may store a visitor’s selected accessibility settings so that the website can provide and remember the requested experience. Storage strictly necessary to deliver an accessibility preference selected by the visitor may be treated as functional or necessary. Additional non-essential tracking requires consent where applicable.
21.9 Managing Cookie Choices
When the website presents a cookie banner or preference centre, you should be able to:
Accept all optional cookies
Reject all optional cookies as easily as accepting them
Select cookie categories
Change or withdraw consent later
You can also delete or block cookies through your browser settings. Blocking strictly necessary cookies may prevent certain website, checkout, subscription, accessibility, or security functions from operating correctly.
Withdrawing consent does not affect the lawfulness of technology used before consent was withdrawn.
21.10 Email Tracking
Publication emails may contain pixels or tracked links that allow Substack to report whether an email was delivered or opened and whether a link was selected. We use this information only where enabled and legally permitted to understand publication performance, manage delivery, and improve content.
Where consent is legally required for email tracking, the technology should be used only with the appropriate consent. Depending on the email service and email application, you may also limit tracking by disabling automatic image loading or using privacy-protection settings.
22. Changes to This Policy
We may update this Privacy and Cookie Policy when our Services, providers, website features, or legal obligations change. The date at the top shows when the policy was last updated. If a change materially affects how we use personal data, we will provide additional notice where appropriate.
23. Contact
Questions, privacy requests, and cookie questions may be sent to:
Spencer Moore Landvater, trading as The Hairy Chin
Carrer Casp 148
08013 Barcelona, Spain
Email: hello@thehairychin.com