Privacy Policy
Privacy Policy
Last updated: June 2026
The protection of your personal data is of paramount importance to us. As explained in Section 1 below, we do not consider this website to be subject to the GDPR on a targeting basis; nonetheless, we apply data protection practices modelled on the GDPR and TDDDG as a matter of policy. This Privacy Policy describes data processing on mideastchronicle.com, with reference to the standards those frameworks set out.
1. Controller
Harbinger Bros. LLC
1309 Coffeen Avenue, Sheridan, WY 82801, United States
Email: support@harbingerpressmedia.com
Contact form: /contact
Middle East Chronicle does not specifically direct its content or services at residents of the European Union or European Economic Area, and we do not consider the GDPR to apply to us on a targeting basis under Art. 3 para. 2 GDPR. Nonetheless, as a matter of policy, we apply data protection practices modelled on the GDPR to all visitors regardless of location.
2. Data Protection Officer
No statutory DPO obligation given the limited scale of processing. Contact the controller directly for all data protection enquiries.
3. Principles of Data Processing (Art. 5 GDPR)
We strictly adhere to: lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. We use a single, cookie-less, anonymous analytics tool to measure aggregate visitor numbers (see Section 8 below); beyond that, we operate no tracking or advertising systems and create no user profiles.
4. Server Logs
When you visit our website, your browser automatically transmits technical connection data (IP address, date/time, URL, referrer, data volume, HTTP status, browser/OS) to our hosting provider. This is technically mandatory. Purpose: Secure operation, attack defence, error diagnosis. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest). Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. DPA in place per Art. 28 GDPR. Third-country transfer: SCCs (Art. 46 para. 2 lit. c GDPR) + EU-US DPF (Decision (EU) 2023/1795). Retention: Up to 30 days.
5. Database
Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992. DPA in place. SCCs for international transfers. Only editorial content is stored, with one exception: if you use the contact form, your name, email address, and message are stored here too — see the Contact Form section below. See Supabase Privacy Policy.
Image Delivery
Article images may be hosted on and served directly from Unsplash (Unsplash Inc., Montreal, QC, Canada). When your browser loads an image from Unsplash servers, Unsplash may receive your IP address and standard browser request headers as part of the HTTP connection. We have no control over Unsplash’s data processing. Unsplash’s privacy policy: unsplash.com/privacy
Article images may also be hosted on and served directly from Wikimedia Commons (Wikimedia Foundation, Inc., 1 Montgomery Street, Suite 1600, San Francisco, CA 94104, USA). When your browser loads an image from Wikimedia Commons servers, the Wikimedia Foundation may receive your IP address and standard browser request headers as part of the HTTP connection. We have no control over the Wikimedia Foundation’s data processing. Wikimedia Foundation’s privacy policy: foundation.wikimedia.org/wiki/Policy:Privacy_policy
6. Self-Hosted Fonts
All fonts hosted on our own servers. No connections to Google Fonts or similar external services.
7. Local Storage
| Name | Type | Purpose | Legal Basis | Retention |
|---|---|---|---|---|
hpm_cookie_consent | Local Storage (First-Party) | Storing cookie consent decision and timestamp | § 25 para. 2 No. 2 TDDDG; Art. 6 para. 1 lit. c GDPR | Until manually deleted |
This entry stays exclusively in your browser — never transmitted to servers or third parties. Delete via Developer Tools → Application → Local Storage → mideastchronicle.com → delete hpm_cookie_consent.
8. Anonymous Web Analytics and Other Tracking
We use Vercel Web Analytics, a cookie-less, anonymous analytics service provided by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA), to measure aggregate visitor numbers. It collects only aggregated, non-personal metrics (e.g. page views, referrers, approximate country-level location), sets no cookies, does not permanently store IP addresses, and does not re-identify visitors across sessions. Legal basis: our legitimate interest in understanding website usage (Art. 6(1)(f) GDPR); no consent is required as no information is stored on or read from your device (§ 25 TDDDG / Art. 5(3) ePrivacy Directive). More information: Vercel Web Analytics privacy documentation.
Beyond Vercel Web Analytics, we do not use: Google Analytics, Google Tag Manager, Matomo, Plausible, or any other cookie-based or profiling analytics service; Google Ads, Facebook Pixel, or any advertising network; social media plugins that auto-transmit data; session replay tools; browser fingerprinting; or cross-site tracking.
9. Third-Country Transfers
| Recipient | Country | Transfer Basis | Data |
|---|---|---|---|
| Vercel Inc. | USA | SCCs + EU-US DPF (Decision (EU) 2023/1795) | Server logs |
| Supabase Inc. | Singapore | SCCs (Art. 46 para. 2 lit. c GDPR) | Editorial content only |
10. Security Measures
TLS 1.3 encryption, HSTS, regular security updates, least-privilege access controls, encrypted database connections.
11. Privacy Rights We Extend to All Visitors
Although, as explained above, we do not consider the GDPR to apply to us on a targeting basis, we voluntarily extend the following rights, modelled on the GDPR, to all visitors: Right of access (Art. 15): Confirm and access data we process about you. Rectification (Art. 16): Correct inaccurate data. Erasure (Art. 17): Demand deletion where grounds exist. Restriction (Art. 18): Restrict processing under Art. 18 conditions. Data portability (Art. 20): Receive your data in machine-readable format. Objection (Art. 21): Object to processing based on legitimate interests. Withdraw consent (Art. 7 para. 3): Withdraw any consent at any time. Contact: support@harbingerpressmedia.com. Response within one month (Art. 12 para. 3 GDPR).
12. Raising Concerns with a Data Protection Authority
Although we do not consider ourselves subject to the jurisdiction of EU/UK supervisory authorities for the reasons explained above, if you believe such an authority nonetheless has jurisdiction over your complaint, you may contact the supervisory authority in your country of residence, workplace, or the place of the alleged infringement.
13. Additional Notices for Other Jurisdictions and Data Breaches
13.1 United Kingdom (UK GDPR)
The rights described in Section 11 apply equally to visitors in the United Kingdom under the UK GDPR and the Data Protection Act 2018. The supervisory authority is the Information Commissioner's Office (ICO).
13.2 California, USA (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA/CPRA”) grants you the following rights: the right to know what personal information we have collected about you, its sources, and the purpose of collection; the right to delete personal information we have collected from you, subject to certain exceptions; the right to correct inaccurate personal information; and the right to non-discrimination for exercising your rights. We do not sell or share your personal information, so no opt-out mechanism is required. We do not collect sensitive personal information as defined under the CPRA. To submit a request, email support@harbingerpressmedia.com with the subject line “California Privacy Request.” We respond within 45 days, with a possible 45-day extension where reasonably necessary. Categories of personal information collected in the preceding 12 months: internet or electronic network activity information (server log data including IP addresses and browser identifiers). We have not sold or shared any personal information.
13.3 Canada (PIPEDA)
Visitors from Canada have rights under the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and applicable provincial legislation, including the right to access your personal information held by us and to challenge its accuracy. To exercise these rights, contact support@harbingerpressmedia.com.
13.4 Australia (Privacy Act 1988)
If you are located in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to our processing of your personal information. You have the right to access and seek correction of your personal information, and to lodge a complaint about a potential breach of the APPs. Complaints may be directed to us at support@harbingerpressmedia.com and, if unresolved, to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
13.5 India (DPDP Act 2023)
If you are located in India, the Digital Personal Data Protection Act, 2023 (“DPDP Act”) applies to our processing of your personal data. As a Data Principal, you have the right to obtain a summary of the personal data we process about you, the right to correction and erasure of your personal data, and the right to grievance redressal. To exercise these rights or raise a grievance, contact support@harbingerpressmedia.com. Unresolved grievances may be escalated to the Data Protection Board of India.
13.6 South Korea (PIPA)
If you are located in South Korea, the Personal Information Protection Act (“PIPA”) applies to our processing of your personal information. You have the right to access, correct, delete, and suspend the processing of your personal information. To exercise these rights, contact support@harbingerpressmedia.com. Complaints may also be directed to the Personal Information Protection Commission (PIPC) of the Republic of Korea.
13.7 United Arab Emirates (PDPL)
If you are located in the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”) applies to our processing of your personal data. You have the right to access, correct, and request erasure of your personal data, and to object to its processing. To exercise these rights, contact support@harbingerpressmedia.com. Complaints may also be directed to the UAE Data Office.
13.8 Saudi Arabia (PDPL)
If you are located in Saudi Arabia, the Personal Data Protection Law (Royal Decree No. M/19) applies to our processing of your personal data. You have the right to access, correct, and request destruction of your personal data. To exercise these rights, contact support@harbingerpressmedia.com. Complaints may also be directed to the Saudi Data & Artificial Intelligence Authority (SDAIA).
13.9 Qatar (PDPPL)
If you are located in Qatar, Law No. 13 of 2016 concerning Personal Data Privacy Protection applies to our processing of your personal data. You have the right to access and request correction of your personal data. To exercise these rights, contact support@harbingerpressmedia.com. Complaints may also be directed to the Compliance and Data Protection Department of the National Cyber Security Agency (NCSA) of Qatar.
13.10 Notification of Personal Data Breaches
Although we do not consider ourselves bound by Articles 33–34 GDPR for the reasons explained above, we apply, as a matter of policy, breach-notification practices modelled on those provisions: in the event of a personal data breach likely to result in a risk to your rights and freedoms, we aim to notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, describing the nature of the breach and the measures taken or proposed.
14. No Automated Decision-Making
We do not use automated decision-making or profiling (Art. 22 GDPR).
15. Media Privilege
Middle East Chronicle invokes the journalistic media privilege (Art. 85 GDPR) for journalistic work and source protection — with particular emphasis given the press freedom risks in the MENA region.
16. Contact Form
If you use the contact form at /contact, we collect and store your name, email address, and message content in our application database in order to respond to your inquiry. This data is stored via our database provider, Supabase Inc., and is accessible only to authorised personnel who handle correspondence. Legal basis: Art. 6(1)(b) GDPR (necessary to respond to your request) or, where no contractual relationship is established, Art. 6(1)(f) GDPR (legitimate interest in handling incoming communications). We retain contact form submissions for as long as necessary to address your inquiry and for a reasonable period thereafter for documentation purposes, typically no longer than 12 months, unless a longer retention period is required by law. You may request earlier deletion of your message at any time by contacting us.
17. Changes
This Privacy Policy may be updated to reflect legal changes or service modifications. The last update date appears above.