Privacy Policy

1. Who We Are

This website, cgdixon.com (the "Site"), is the official author website of C.G. Dixon ("I," "me," "my"). I write romance and women's fiction, and I use this Site to share information about my books and to keep interested readers updated through my VIP Reader List. This Privacy Policy explains what personal information I collect, why I collect it, how I use and protect it, and the rights you have over it. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, I am the "data controller" of your personal information. You can reach me at contact @ cgdixon.com.

2. A Few Important Things Up Front

• No sales are made on this Site. I do not sell books, merchandise, or anything else directly through cgdixon.com. All "buy" links send you to third-party retailers such as Amazon and Barnes & Noble.
• There are no affiliate links. I earn no additional affiliate commission when you click a retailer link; none of my outbound links are affiliate, referral, or commission-tracking links.
• I do not sell or share your personal information. I do not sell your personal information for money or anything of value, and I do not "share" it for cross-context behavioral (targeted) advertising, as those terms are defined under US state privacy laws.
• This Site is for adults. It is not directed at children, and I do not knowingly collect information from anyone under 16.

3. Information I Collect

Information you give me voluntarily:

• Your email address when you sign up for the VIP Reader List.
• Any information you include when you contact me — for example, your name, your email address, and the content of your message.

Information collected automatically:

Whenever anyone visits a website, some basic technical data is typically logged by the web host and by any analytics tool in use. This can include your IP address, browser type and version, device type, operating system, the website that referred you, and the pages you viewed with dates and times.

I do not use Google Analytics or any third-party analytics tool; only my web host's standard server logs apply.

Cookies and similar technologies:

A cookie is a small text file stored on your device by a website. This is a static website that may set few or no non-essential cookies by my website host. If cookies are used, they may include strictly necessary cookies and, if analytics is enabled, analytics cookies. See Section 8. I do not use advertising or cross-site tracking cookies.

4. How I Use Your Information — and My Lawful Bases (GDPR)

Under the EU and UK GDPR, I must have a "lawful basis" for each way I use your personal information. Here is how and why I use it:

You can withdraw your consent at any time (see Section 11). Withdrawing consent does not affect any processing that already took place before you withdrew it.

5. Third-Party Services and Processors

I use a small number of trusted service providers ("processors") to run the Site and my email list. They process your information only on my instructions and are contractually required to protect it.

• Email/newsletter provider(s): Mailchimp, Kit (formerly ConvertKit), MailerLite, Substack, and Formspree. The provider stores your email address and delivers my emails.
• Web hosting provider: Hostinger. This provider stores the Site's files and may keep server logs that include IP addresses.
• Analytics provider: n/a, None.
• Fonts / content delivery (if any): Google Fonts. Note: Google Fonts loaded from Google's servers can transmit visitor IP addresses to Google.

I do not sell or rent your information to anyone. I may disclose information only if legally required to do so — for example, in response to a valid legal request from a public authority.

6. International Data Transfers

I am based in the United States. If you are located in the EU, the UK, or elsewhere, your information may be transferred to and processed in the United States or other countries where my service providers operate. Those countries may have data protection laws that differ from your own.

Where personal information is transferred from the EU or UK to the United States, I (through my providers) rely on appropriate safeguards, which may include:

• The EU–U.S. Data Privacy Framework (and its UK Extension / "UK–U.S. Data Bridge"), where my provider is certified. The Framework was established by the European Commission's adequacy decision of 10 July 2023 (Commission Implementing Decision (EU) 2023/1795) and is enforced in the U.S. by the Federal Trade Commission; and/or
• Standard Contractual Clauses approved by the European Commission (with the UK International Data Transfer Addendum where applicable), which remain a valid fallback safeguard.

7. How Long I Keep Your Information

• VIP Reader List: I keep your email address until you unsubscribe or ask me to delete it, after which it is removed within a reasonable period.
• Contact messages: I keep these only as long as needed to handle your inquiry and for a reasonable period afterward.
• Automatically collected / analytics data (if any): Retained according to my provider's default retention settings.

8. Cookies and Tracking

A cookie is a small text file stored on your device by a website.

• If it uses only strictly necessary cookies and no analytics or advertising cookies: no cookie consent banner is legally required.
• If you enable analytics or any other non-essential cookies: under the EU ePrivacy rules, you must obtain visitors' prior, opt-in consent through a cookie banner before those cookies load. (Note: under the UK's Data (Use and Access) Act 2025, which came into force in 2026, certain low-risk analytics cookies can be set on an opt-out basis for UK visitors — but you must still provide clear information and an easy way to opt out.)

This is a simple static site. I do not use analytics, advertising, retargeting, or cross-site tracking cookies. You can also control cookies through your browser settings.

9. Do Not Track and Global Privacy Control (GPC)

Some browsers can send an automated opt-out preference signal such as the Global Privacy Control (GPC). Where required by US state law, I treat a GPC signal from your browser as a valid request to opt out of any "sale" or "sharing" of personal information. Because I do not sell or share your personal information, there is nothing for such a signal to stop — but I honor it as an opt-out preference regardless.

10. Your Privacy Rights

10a. If you are in the EU or UK (GDPR / UK GDPR)

You have the right to:

• Access the personal information I hold about you;
• Rectify inaccurate or incomplete information;
• Erase your information (the "right to be forgotten");
• Restrict or object to processing;
• Data portability — receive your data in a portable, machine-readable format;
• Withdraw consent at any time; and
• Lodge a complaint with your data protection authority. In the UK this is the Information Commissioner's Office (ICO), ico.org.uk. In the EU it is your national supervisory authority.

To exercise any of these rights, email me at contact @ cgdixon.com. I will respond without undue delay and in any event within one month of receiving your request, as required by GDPR Article 12(3). That period may be extended by up to two further months where a request is especially complex or where you have made several requests; if so, I will provide details with my response and explain why.

Complaints handling (UK visitors): If you are in the UK, you may also complain directly to me about how I handle your personal data before going to the ICO. I will acknowledge your complaint and respond within the timeframes set out in UK data protection law. (This reflects the complaints-handling duty introduced by the UK Data (Use and Access) Act 2025, in force from 19 June 2026.)

10b. If you are a resident of a US state with a privacy law

Depending on your state — for example, California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota, Maryland, Tennessee, Indiana, Kentucky, or Rhode Island — you may have the right to:

• Know / access the personal information I have about you;
• Correct inaccurate information;
• Delete your personal information;
• Obtain a portable copy; and
• Opt out of the sale/sharing of personal information and of targeted advertising.

I do not sell or share your personal information, and I do not use it for targeted advertising. You also have the right not to be discriminated against for exercising your privacy rights — I will never deny you service, charge you a different price, or provide a different quality of experience because you exercised a right.

To exercise any right, email me at contact @ cgdixon.com. You may use an authorized agent to submit a request on your behalf where the law allows; I may ask for proof of authorization. If I ever deny a request, you may appeal by replying to my response.

Most of these state laws do not legally apply to a small author website like mine, because I fall far below their coverage thresholds. For example, the California Consumer Privacy Act (CCPA) applies to a business only if it meets one of three thresholds (Cal. Civ. Code § 1798.140): (1) annual gross revenue exceeding $26,625,000 for the 2026 compliance year (the $25M statutory figure, inflation-adjusted effective Jan. 1, 2025); or (2) buying, selling, or sharing the personal information of 100,000 or more California consumers or households per year; or (3) deriving 50% or more of annual revenue from selling or sharing personal information. I meet none of these.

10c. California-specific disclosures (CCPA / CPRA)

• I have not sold or shared the personal information of any consumer in the past 12 months, and I do not sell or share personal information.
• The only category of personal information I collect is "identifiers" (your email address, plus your IP address if analytics is enabled).
• I do not offer any financial incentive in exchange for your personal information, so no "notice of financial incentive" applies.
• California residents have the rights to know, delete, correct, opt out, and to non-discrimination, as described in Sections 10a–10b above.

11. How to Unsubscribe from the VIP Reader List

You can unsubscribe at any time by clicking the "unsubscribe" link at the bottom of any email I send you, or by emailing me at contact @ cgdixon.com — I will remove you promptly. In line with the US CAN-SPAM Act, every marketing email I send includes a working unsubscribe method and my valid physical postal address, and I honor all opt-out requests promptly (within 10 business days at most, and usually much sooner). Unsubscribing is free and requires nothing more than your email address.

12. Children's Privacy (COPPA)

This Site is intended for adults and is not directed at children. I do not knowingly collect personal information from children under 13 (or under 16 in the EU/UK). I do not knowingly market to children, and this Site does not offer content aimed at children. If you believe a child has provided me with personal information, please contact me at contact @ cgdixon.com and I will delete it. (The FTC's amended COPPA Rule became fully enforceable on April 22, 2026; because this Site is a general-audience adult site that does not knowingly collect children's data, the Rule's specific parental-consent obligations do not apply.)

13. Security

I take reasonable steps to protect your information, and I rely on reputable service providers that maintain their own security measures. However, no method of transmitting or storing data over the internet is 100% secure, and I cannot guarantee absolute security.

14. Links to Third-Party Sites

This Site links to third-party retailers (such as Amazon and Barnes & Noble) and may link to other external sites. When you click one of these links, you leave cgdixon.com and are subject to that site's own privacy policy and terms. I am not responsible for the privacy practices or content of any third-party site. This Policy applies only to cgdixon.com. Please review the privacy policy of any third-party site before providing information to it.

15. Changes to This Policy

I may update this Policy from time to time — for example, if I add a new tool or my practices change. The "Last Updated" date at the top shows when it last changed. Significant changes will be posted on this page, and where required by law I will take additional steps to notify you.

16. Contact Me

Questions about this Policy or your personal information? Email me at contact @ cgdixon.com.