Privacy Policy

Effective October 20, 2026. How Cupcakes Holdings LTD collects, uses, shares and protects personal information when you use https://pastchronicles.com, and the rights and choices you have.

Effective date: October 20, 2026 Last updated: October 20, 2026

This Privacy Policy explains how Cupcakes Holdings LTD ("Cupcakes Holdings", "we", "us" or "our") collects, uses, discloses, retains and protects personal information in connection with Past Chronicles, available at pastchronicles.com, together with its subdomains, RSS feeds, newsletters (if offered), social media pages operated under the Past Chronicles name, and any other online service that links to this policy (collectively, the "Site" or the "Services").

We have written this policy to be as complete and transparent as possible. Please read it carefully. If you do not agree with it, please do not use the Services. By accessing or using the Services you acknowledge that you have read and understood this Privacy Policy. Where the law requires your consent for a particular processing activity, we will ask for it separately and you may refuse or withdraw it at any time.

The only way to contact us about anything in this policy is by email at [email protected].

1. Who we are

The Site is owned and operated by Cupcakes Holdings LTD, a private company incorporated and registered under the laws of the State of Israel. For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR"), the UK General Data Protection Regulation and Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), the Israeli Protection of Privacy Law, 5741-1981 and its regulations (the "Israeli Privacy Law"), and comparable laws elsewhere, Cupcakes Holdings LTD is the data controller (or "business", as that term is used in certain US state laws) responsible for personal information processed through the Services, except where this policy states that a third party acts as an independent controller.

Contact for all privacy matters: [email protected] Please use the subject line "Privacy request" so that your message is routed promptly.

We have not appointed a statutory data protection officer because we are not required to do so under applicable law. Our privacy team can be reached at the email address above, and every privacy enquiry is reviewed by a responsible member of staff.

2. Summary of key points

This summary is provided for convenience only. The full policy below governs.

• You can read everything without an account. We do not require registration, sign-in or payment to read our stories.
• We collect limited information. Most of what we process is technical data generated automatically when your browser connects to our servers, plus cookie and device data used by our analytics and advertising partners where enabled and permitted.
• We do not sell personal information for money. Some laws treat certain advertising-related disclosures as a "sale" or "sharing" of personal information. Where that is the case, you can opt out, as explained in Sections 9 and 11.
• You are in control. You can manage cookies through our consent tool, your browser settings, Global Privacy Control and industry opt-out tools.
• You have rights. Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal information, and to port it. Email [email protected] to exercise them.
• We do not knowingly collect information from children. The Services are intended for a general adult audience.

3. Scope of this policy

This policy applies to personal information processed by us or on our behalf in connection with the Services. It does not apply to:

1. websites, apps or services operated by third parties, even if you reach them via a link on the Site (including advertisers, affiliate merchants, image libraries, social networks and archives we cite);
2. the independent processing carried out by social media platforms (for example Facebook or Instagram) when you interact with our pages on those platforms, which is governed by the platforms' own policies; and
3. information that has been de-identified or aggregated so that it can no longer reasonably be linked to an individual or a device.

Where we operate pages on third-party platforms, we may in some jurisdictions be a joint controller with the platform for limited processing such as page insights statistics. In those cases the platform's own terms on joint controllership apply, and you may contact us at [email protected] or the platform directly.

4. Personal information we collect

"Personal information" (also called "personal data") means any information relating to an identified or identifiable natural person. We collect the following categories.

4.1 Information you provide to us directly

Correspondence. When you email [email protected] we receive your email address, your name (if included), the content of your message, any attachments, and the metadata that accompanies email (such as the date and time and the sending mail server). You may contact us to ask a question, suggest a correction, request a licence, report a copyright concern, make a privacy request, propose an advertising partnership or for any other reason.

Requests and claims. If you submit a correction, a copyright or takedown notice, a counter-notice, a privacy rights request or a complaint, we collect the information you include, which may comprise your contact details, details of your claim, proof of ownership or identity, and any signature you provide.

Newsletter and feeds. If we offer a newsletter and you subscribe, we collect your email address and records of your subscription, consent and unsubscription. If you subscribe to our RSS feed through a feed reader, the reader operator, not us, holds your subscription details; we see only ordinary technical request data.

We ask that you do not send us sensitive personal information (for example information about health, religion, political opinions, sexual orientation, criminal records, biometric or genetic data, or government identification numbers) unless it is strictly necessary for a request you are making, such as identity verification we specifically ask for.

4.2 Information collected automatically

When you visit the Site, certain information is generated and processed automatically by our hosting, content delivery and security provider and by our own systems, including:

• Network and device data: Internet Protocol (IP) address, approximate location derived from the IP address (country, region, city level only), browser type and version, operating system, device type, screen resolution, language settings and time zone;
• Usage data: pages and stories requested, referring URL, search terms that led you to the Site where passed by the referrer, the date and time of each request, time spent on pages, links clicked, scroll depth, and HTTP status codes;
• Security data: signals used to distinguish human visitors from automated traffic, detect abusive requests, rate-limit, and mitigate denial-of-service attacks and other threats; and
• Log data: server and edge logs that record the above for operational and security purposes.

4.3 Information from cookies and similar technologies

We and, where enabled and permitted, our analytics and advertising partners use cookies, local storage, pixels, tags, scripts, SDKs and device or advertising identifiers. These may collect cookie identifiers, ad identifiers, impressions and clicks, interactions with ads, inferred interests, and similar information. See our Cookie Policy for full details, including how to accept, refuse or withdraw consent.

4.4 Information from third parties

We may receive information about you from:

• advertising and measurement partners, such as aggregated campaign reports, fraud signals and, where permitted, information about how our content performs;
• social media platforms, such as aggregated statistics about engagement with our pages and posts, and any public profile information visible when you comment on, message or tag our pages;
• service providers that help us detect fraud, abuse and security threats; and
• publicly available sources, for example when we research the background of a correction request or a rights claim.

4.5 Information we do not collect

We do not intentionally collect payment card details, bank account details, precise geolocation (GPS-level), government identification numbers (except where you choose to send identity documents to verify a rights request and we have asked for them), biometric data, or information about children.

5. How we use personal information

We use personal information for the following purposes:

1. Providing the Services: delivering pages, images and feeds to your device; remembering your preferences such as consent choices; and making the Site work across devices and browsers.
2. Security and integrity: protecting the Site, our readers and our partners from fraud, invalid traffic, bots, scraping, spam, malware and attacks; investigating suspicious activity; and enforcing our Terms of Use.
3. Analytics and improvement: understanding, in aggregate, which stories are read, how readers find us and how the Site performs, so that we can plan editorial coverage, fix errors and improve design, speed and accessibility.
4. Advertising and funding: serving advertisements that fund our free journalism and content; measuring ad delivery and effectiveness; capping how often you see an ad; preventing ad fraud; and, where you have consented or have not opted out (depending on your location), personalising ads based on inferred interests.
5. Communications: reading and responding to your emails; handling corrections, licensing requests, partnership proposals and complaints; and, if you have subscribed, sending you a newsletter.
6. Rights requests and legal claims: processing privacy requests, copyright notices and counter-notices; establishing, exercising or defending legal claims.
7. Legal compliance: complying with applicable laws, regulations, court orders and lawful requests from authorities; keeping records required by law; and meeting our tax and accounting obligations.
8. Business transactions: evaluating or carrying out a merger, acquisition, financing, reorganisation, sale of assets or similar transaction, subject to confidentiality protections.
9. Other purposes with notice or consent: any other purpose we describe to you at the time of collection or for which you give consent.

We do not use your personal information to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Ad personalisation by our partners may involve automated profiling for marketing purposes; you can object to it at any time as described in Section 9.

6. Legal bases for processing (EEA, UK and Switzerland)

If you are located in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases:

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms, and you may request information about that balancing test by emailing [email protected]. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

7. How we disclose personal information

We disclose personal information only as described below.

7.1 Service providers (processors). We use vendors that process personal information on our behalf and under our instructions, including providers of website hosting, content delivery, DNS and security (such as Cloudflare); source code hosting and deployment; email services; analytics; consent management; and professional productivity tools. They are contractually required to protect personal information and to use it only to provide services to us.

7.2 Advertising and measurement partners. Where enabled and, where required, where you have consented, advertising networks, ad exchanges, supply-side platforms, demand-side platforms, ad verification and measurement providers may collect or receive information through cookies and similar technologies on the Site. Many of these partners act as independent controllers and use the information in accordance with their own privacy policies. Some of these disclosures may be considered a "sale" or "sharing" for "targeted advertising" under certain US state laws.

7.3 Social media platforms. If you interact with our social media pages or with social sharing features, the relevant platform receives information directly from you under its own terms and policies.

7.4 Professional advisers. We may disclose information to lawyers, accountants, auditors, insurers and other professional advisers who are bound by confidentiality obligations.

7.5 Legal and safety. We may disclose information where we believe in good faith that disclosure is necessary to comply with a law, regulation, legal process or enforceable governmental request; to enforce our Terms of Use; to detect, prevent or address fraud, security or technical issues; or to protect the rights, property or safety of Cupcakes Holdings, our readers or the public.

7.6 Rights claims. When you submit a copyright notice, counter-notice or similar claim, we may forward it, including your contact details, to the person whose material is the subject of the claim, and may submit a copy to services such as the Lumen database, with personal contact details removed where possible.

7.7 Corporate transactions. If we are involved in a merger, acquisition, financing, reorganisation, bankruptcy, receivership, sale of assets or transition of service to another provider, personal information may be transferred as part of that transaction, subject to this policy or a policy that is at least as protective.

7.8 Affiliates. We may disclose information to companies under common control with Cupcakes Holdings LTD, which will process it consistently with this policy.

7.9 With your consent or at your direction. We may disclose information for other purposes with your consent or at your direction.

We may also disclose aggregated or de-identified information that cannot reasonably be used to identify you, for any lawful purpose.

8. International data transfers

Cupcakes Holdings LTD is based in Israel. The European Commission has recognised Israel as providing an adequate level of protection for personal data, and the United Kingdom and Switzerland have made corresponding determinations. Our service providers and partners may process personal information in the United States, the European Union and other countries whose laws may differ from those of your country.

Where we transfer personal information from the EEA, UK or Switzerland to a country that has not been recognised as adequate, we rely on appropriate safeguards, which may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, or other lawful mechanisms. You may request a copy of the relevant safeguards by emailing [email protected].

9. Your choices

Cookie consent. Where required by law, we display a cookie banner when you first visit the Site. You can accept, reject or customise non-essential cookies. You can change your choices at any time using the "Cookie settings" link in the footer of every page.

Browser controls. Most browsers let you block or delete cookies and clear local storage. If you block strictly necessary cookies, parts of the Site may not work properly.

Global Privacy Control (GPC). We honour GPC signals sent by your browser or extension as a valid request to opt out of the sale or sharing of personal information and of targeted advertising, where those rights apply under the law of your place of residence. The opt-out applies to the browser that sends the signal.

Industry opt-out tools. You can opt out of interest-based advertising by participating companies through optout.aboutads.info (Digital Advertising Alliance), youronlinechoices.eu (European Interactive Digital Advertising Alliance), and optout.networkadvertising.org (Network Advertising Initiative). These tools rely on cookies, so you will need to repeat the opt-out if you clear cookies or change browser or device.

Mobile device settings. Your mobile operating system may allow you to reset your advertising identifier or limit ad tracking.

Do Not Track. Some browsers send "Do Not Track" signals. Because there is no common industry standard for interpreting them, we do not respond to DNT signals separately; we do honour GPC as described above.

Emails. If you subscribe to a newsletter, every message will include an unsubscribe link. You can also unsubscribe by emailing [email protected].

Opting out of interest-based advertising does not mean you will stop seeing ads; you will continue to see ads that are not personalised to you.

10. Your rights

Depending on where you live, you may have some or all of the following rights:

• Access / right to know: to confirm whether we process your personal information and to obtain a copy, together with information about how and why it is processed;
• Correction / rectification: to have inaccurate or incomplete information corrected;
• Deletion / erasure: to have your personal information deleted, subject to legal exceptions;
• Restriction: to ask us to limit how we use your information in certain circumstances;
• Objection: to object to processing based on legitimate interests, and to object at any time to processing for direct marketing, including profiling;
• Portability: to receive information you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller;
• Withdraw consent: at any time, where processing is based on consent;
• Opt out: of the sale or sharing of personal information, targeted advertising and certain profiling;
• Limit use of sensitive personal information: where applicable (we do not intentionally use sensitive personal information for purposes that would trigger this right);
• Non-discrimination: not to receive discriminatory treatment for exercising your rights;
• Lodge a complaint: with a supervisory authority (see Section 10.4).

10.1 How to exercise your rights

Email [email protected] with the subject line "Privacy request". Please tell us which right you wish to exercise, your country or US state of residence, and enough information for us to locate the relevant data (for example the email address you used to write to us, or the cookie identifier shown in our consent tool where available).

10.2 Verification

To protect your information, we may need to verify your identity before acting on a request. The steps we take depend on the sensitivity of the request and the information involved. We will not ask for more information than is reasonably necessary, and we will use information provided for verification only for that purpose. Because most of the information we hold is linked to cookies or IP addresses rather than names, we may not be able to match some requests to specific records; if so, we will explain why.

10.3 Authorised agents

Where permitted by law, you may use an authorised agent to submit a request on your behalf. We may require the agent to provide proof of authorisation and may ask you to verify your identity directly with us.

10.4 Response times, appeals and complaints

We aim to respond within one month (extendable by a further two months for complex requests where permitted) under EU and UK law, and within 45 days (extendable by a further 45 days where permitted) under US state laws. We will tell you if we need an extension and why. If we decline your request, we will explain our reasons.

If you are a resident of a US state that provides a right to appeal, you may appeal our decision by replying to our response with the subject line "Privacy appeal". We will respond within the time required by law. If you are not satisfied with the outcome, you may contact your state Attorney General.

You have the right to complain to a data protection authority. In the EEA, you may contact the supervisory authority in your country of residence (a list is available from the European Data Protection Board). In the UK, you may contact the Information Commissioner's Office. In Switzerland, you may contact the Federal Data Protection and Information Commissioner. In Israel, you may contact the Privacy Protection Authority. We would appreciate the chance to address your concern first, so please consider contacting us at [email protected].

11. Additional information for United States residents

This section supplements the rest of this policy for residents of US states with comprehensive consumer privacy laws, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, as and when each law applies.

Categories collected in the past 12 months: identifiers (such as IP address, cookie identifiers, advertising identifiers and email address); internet or other electronic network activity information (such as browsing on the Site and interactions with ads); approximate geolocation derived from IP address; inferences drawn to create a profile about preferences (by advertising partners, where enabled); and, if you email us, the contents of your communications.

Sources: you; your device and browser; our service providers; and our advertising, analytics and social media partners.

Purposes: those described in Section 5.

Disclosures for a business purpose: each category above may be disclosed to service providers and professional advisers for the purposes in Section 5.

"Sale" and "sharing": we do not sell personal information for monetary consideration. Where advertising and analytics partners are enabled, identifiers, internet activity, approximate geolocation and inferences may be made available to them in a way that may constitute a "sale", "sharing" or processing for "targeted advertising". You may opt out by using the "Cookie settings" link, by enabling Global Privacy Control, or by emailing [email protected] with the subject "Do not sell or share".

Sensitive personal information: we do not collect or process sensitive personal information for the purpose of inferring characteristics about consumers.

Minors: we do not have actual knowledge that we sell or share the personal information of consumers under 16.

Retention: see Section 12.

Shine the Light (California Civil Code § 1798.83): California residents may request information about disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes within the meaning of that law. Requests may be sent to [email protected].

Nevada: Nevada residents may submit a request to opt out of the sale of covered information by emailing [email protected]. We do not currently sell covered information as defined by Nevada law.

Notice of financial incentive: we do not offer financial incentives in exchange for personal information.

12. Retention

We keep personal information only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, reporting or dispute-resolution requirements. Typical retention periods are:

Cookies placed by our partners are retained for the periods stated in their own policies and in our Cookie Policy. When information is no longer needed, we delete it, anonymise it or, where that is not possible (for example in backups), securely isolate it until deletion is possible.

13. Security

We take reasonable technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include encryption in transit (HTTPS/TLS) across the entire Site, a hardened static site architecture that minimises the data we hold, reputable hosting and security providers, access controls based on need-to-know, multi-factor authentication on administrative accounts, and regular review of our practices.

No method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant authorities where and as required by law.

Please do not send confidential information to us by unencrypted email. If you discover a security vulnerability on the Site, please report it responsibly to [email protected] with the subject line "Security".

14. Children's privacy

The Services are intended for a general adult audience and are not directed to children. We do not knowingly collect personal information from children under 16 years of age (or under 13 in the United States for the purposes of the Children's Online Privacy Protection Act, or such higher age as local law requires for valid consent). If you are a parent or guardian and believe your child has provided personal information to us, please contact [email protected] and we will delete it promptly.

15. Third-party websites, embeds and links

Our stories link to and cite third-party resources, including museums, libraries, archives, image repositories and reference works. The Site may also contain advertisements, affiliate links and embedded content. When you follow a link or interact with embedded content, the third party may collect information about you under its own privacy policy. We are not responsible for the privacy practices of third parties and encourage you to review their policies.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, technology or applicable law. The "Last updated" date at the top shows when it was last revised. If we make material changes, we will provide notice on the Site and, where required by law, seek your consent. Your continued use of the Services after the effective date of an update means that you acknowledge the updated policy. We encourage you to review this page periodically.

17. Language

This policy is drafted in English. If we provide a translation, the English version prevails to the extent permitted by law in the event of any inconsistency.

18. Contact us

For any question, request or complaint about this Privacy Policy or our handling of personal information, email:

[email protected] (subject line: "Privacy request")

Cupcakes Holdings LTD, Israel Publisher of Past Chronicles