Privacy Policy

The short version

KookiOk provides consent controls and stores a consent cookie. ARM uses browser preferences for privacy choices, an opt-out and the motion setting you request.
No advertising, audience analytics, social-media widgets or tracking pixels are enabled in this website.
Optional technical error reports stay off worldwide. No reporting endpoint is active in this release. A separately reviewed reporting purpose requires fresh, matching permission.
The contact guide prepares a message for you to send from your own email account; it does not automatically submit your message to this website.
This is a portfolio and educational website, not a clinical intake or treatment service.

Rules applied: Explicit opt-in worldwide
Your setting: Optional reporting off by default
Global Privacy Control: Detected when controls load
Error reporting: Not active on this release

Cookies & privacy

1. Who I am

This website (“ARM”) belongs to Alejandro Ruelas-Mora, an individual based in the San Francisco Bay Area, California, United States. I am the person responsible for the information described here, which makes me the “controller” under European data protection law and the “business” (to the extent the law applies) under California law.

Privacy questions and requests: eastbaywebs@gmail.com, with “Privacy request” in the subject line. Website projects and general questions go to the same address; research collaborations go to aruelas-mora@paloaltou.edu.

2. What this policy covers

This policy covers the ARM website and the emails you send me through it. It does not cover other websites I link to, the systems of Palo Alto University or any other institution I am affiliated with, or websites I build for clients. Client projects are covered by the written agreement for that project and by the client’s own privacy policy.

3. Information I collect

Information you choose to send

If you send an email, the recipient receives your email address, your name if included, the message and any attachments you choose. Messages go to the address you choose: the Google-hosted ARM inbox for websites, healing, privacy and general questions, or the Palo Alto University email address for research collaborations. The public contact guide does not automatically send or store its entries.

Browser choices

The KookiOk ag_consent cookie records consent categories and decision information. ARM’s local-storage entries are arm-privacy for a current purpose-bound decision, arm-privacy-optout for a browser opt-out and arm-motion for a requested motion setting. The cookie inventory describes their purpose and duration.

Connection and consent information

GitHub Pages or Google Firebase Hosting serves the files, depending on the address used. The host receives information needed to serve and protect a request, such as IP address, requested file, browser information and request time. KookiOk’s CDN and consent service receive connection and consent information needed to provide privacy controls. These provider records are separate from local browser storage.

Optional diagnostics

No endpoint is active in this release. If a reviewed same-origin reporting endpoint is enabled later, a permitted report contains a broad page category, an error-type label, a known site component and minute-rounded time. The report excludes raw error messages, stacks, full URLs, query strings, fragments, user-agent strings and form entries. The receiving server still receives connection information such as an IP address, so reports are not described as anonymous. Updated provider and retention information and fresh permission are required before activation.

Information the website does not request

The website does not request account credentials, payment-card information, government identifiers or clinical details. It has no embedded social-media feed, audience analytics or advertising tags. Do not include health details or other unnecessary sensitive information in an ordinary email.

4. How I use information

Purpose	Information	Legal basis (EU, EEA & UK)
Replying to your message, scheduling a conversation, and preparing a website proposal	Your email and what it contains	Steps you ask for before a contract (Art. 6(1)(b) GDPR) or my legitimate interest in answering correspondence (Art. 6(1)(f))
Delivering and invoicing a website project you hire me for	Contact details, project details, billing records	Performing our contract (Art. 6(1)(b)); keeping records the law requires (Art. 6(1)(c))
Remembering your motion and privacy settings	Local storage entries on your device	Requested browser functionality and privacy compliance; any related personal-data processing relies on the relevant legal obligation or legitimate interest. The storage exception for a strictly necessary requested feature is separate from the GDPR legal basis.
Delivering the site securely	Hosting request records	Legitimate interest in a secure, working website (Art. 6(1)(f))
Finding and fixing errors (when active)	Error reports	Your consent (Art. 6(1)(a)), which you can withdraw at any time

I do not use personal information for advertising, profiling, or automated decisions that have legal or similarly significant effects on you.

6. Your privacy choices

Cookies & privacy is available on every page. Optional diagnostics are off worldwide until the current reporting purpose is separately enabled and permitted through a matching explicit Statistics decision. A time zone, inferred location, generic consent cookie or older purpose does not grant permission.

You can reject optional content, change cookie settings or withdraw permission. Global Privacy Control is honored as a browser sale/sharing opt-out and blocks optional reports even after a previous grant. A saved browser opt-out can be explicitly cleared when GPC is off; clearing it does not grant optional permission.

Do Not Track is separate from Global Privacy Control. This website does not use a Do Not Track setting to change its behavior, and no cross-site audience-tracking tags are enabled.

Cookies & privacy

7. Your rights

Depending on applicable law, you may request access or a copy, correction, deletion, portability, restriction, objection, consent withdrawal, or an applicable sale/sharing or sensitive-information limitation. Rights may be subject to lawful exceptions and proportionate verification. You may exercise applicable rights without discriminatory treatment.

Making a request

Email Alejandro Ruelas-Mora and describe the right and relevant interaction. Use the associated email where possible. No new account is required. Only information reasonably needed to locate records or verify an eligible request should be requested; do not send passwords, identity documents or payment-card details in ordinary email. An authorized agent may act subject to appropriate authority checks.

Responses and appeals

If an applicable request is refused in whole or part, the response should explain the reason and any available appeal or complaint route. You can reply with “Privacy appeal” to request review. Applicable state or national deadlines and permitted extensions govern the response.

8. Notice for California residents

CCPA applicability depends on the actual business and activities. Where it applies, California residents may have rights to know/access, correct, delete, opt out of sale/sharing, limit certain uses of sensitive information and receive non-discriminatory treatment.

The categories involved in the current website and correspondence workflow can include identifiers/contact details you supply, technical request/consent information, professional details you include and project/billing details when you engage website services. Sources are you, your browser and the providers delivering the relevant service. Purposes and recipients are described above; retention is described below. These descriptions are not an assertion about every historical business record.

No advertising or cross-context audience-tracking integration is enabled on this website. Use Cookies & privacy for the browser opt-out, or contact Alejandro about information held separately. Browser opt-outs require no account or identity verification.

Covered California requests to know, correct or delete require acknowledgement within 10 business days and a substantive response within 45 calendar days from receipt, subject to permitted exceptions and extensions with notice. Applicable sale/sharing opt-outs and limitation requests must be handled as soon as feasible within their legal deadline. The website’s browser control acts immediately on future optional reporting.

For questions about disclosures for third parties’ direct marketing, including California’s “Shine the Light” law where applicable, use the privacy contact route.

9. Notice for the EU, EEA, UK & Switzerland

Where relevant European, UK or Swiss data-protection law applies, rights can include access, correction, erasure, restriction, portability, objection and withdrawal of consent without affecting previous lawful processing. GDPR requests generally require a response without undue delay and within one calendar month; a permitted extension requires reasons and timely notice.

The lawful basis depends on the activity, as described above. Where legitimate interests are used, those interests must be weighed against your rights. Any applicable representative, officer or additional disclosure requirement depends on the actual processing and cannot be inferred merely from website traffic.

You may complain to your relevant supervisory authority, including the European data-protection authorities, the UK Information Commissioner’s Office or the relevant Swiss authority. You do not have to contact ARM first to exercise that right.

10. International transfers

ARM is based in the United States. Hosting, consent and email providers may process information in the United States and other countries where they operate. The laws in those places may differ from those where you live. Contact Alejandro for information about processing locations and the transfer arrangements or safeguards relevant to your information. No provider certification, Standard Contractual Clauses or accepted agreement is claimed without confirmation of the applicable arrangement.

11. How long information is kept

Correspondence and project information should be kept only as long as needed for the relevant inquiry or service, legitimate recordkeeping, legal obligations, resolving disputes or an applicable hold. The appropriate period depends on the record and circumstances; contact Alejandro about the records relating to your interaction.

Browser choices: ARM’s purpose-bound decision expires after 180 days; a saved opt-out after 365 days. Expired choices cannot enable reports. A requested motion setting remains until changed or cleared.
Consent service and hosting records: provider retention is separate from browser-cookie lifetimes and depends on the applicable service/account settings.
Diagnostics: no reporting endpoint is active. An actual retention rule and receiving service must be reviewed and disclosed before activation.
Financial or legally required records: applicable retention duties and lawful holds may prevent deletion of particular records; they do not justify retaining unrelated information indefinitely.

12. Security

The site uses HTTPS on its configured public hosts and a Content Security Policy restricting script, font and connection origins. KookiOk’s supplied consent script and necessary service origins are permitted; no advertising or audience-analytics tag is enabled. Optional diagnostics are restricted to a separately reviewed same-origin endpoint and an explicit current-purpose choice.

Account access, provider settings, record retention and any applicable agreements must also be maintained appropriately. A source configuration does not certify those operations. No method of transmission or storage is perfectly secure. Ordinary email is not a secure clinical intake channel; avoid unnecessary sensitive information.

13. Health information and clinical boundaries

ARM is a portfolio and educational website. It does not offer therapy, neuropsychological assessment or clinical intake. Future clinical services are to be determined. Do not send symptoms, diagnoses, patient records, test results or another person’s health information through ordinary email.

Information actually received must be handled under the law and circumstances that apply. This website does not waive legal protections or claim that consumer-health-data laws, including Washington’s My Health My Data Act, can never apply to a received message. Please use the privacy contact route for a concern about information you have already sent.

Writing about curanderismo and food as medicine shares cultural and educational knowledge, not medical advice.

If you are in crisis, call or text 988 in the United States or call 911 for an emergency. Outside the United States, use your local crisis or emergency service, such as 112 in the European Union.

14. Children

This portfolio is intended for adults and is not directed to children under 13. Do not send children’s personal information through the contact guide. If you believe a child’s information was received, contact Alejandro so the relevant records and any applicable deletion, consent or retention duties can be assessed.

15. Other websites

Links to Instagram, LinkedIn, Venmo, universities, conferences, and client websites take you to services I do not control. Their own privacy policies apply once you leave this site.

16. Changes to this policy

When this policy changes, I will update the “last updated” date at the top. If a change is significant, for example if error reporting is switched on or a new service receives information, I will say so clearly at the top of this page. Where a change relies on your consent, I will ask again.

17. Contact

Alejandro Ruelas-Mora · San Francisco Bay Area, California, United States
Privacy, websites and general questions: eastbaywebs@gmail.com · Research collaborations: aruelas-mora@paloaltou.edu