Privacy Policy
Who I am
Film on Paper (www.filmonpaper.com) is a personal website about film posters, run by Eddie Shannon in the UK. I am the data controller for personal data collected through this site.
For anything about your privacy, email me at [email protected].
In short
You can browse this site without giving me any personal details. Like every website, it handles some technical data, such as your IP address, to deliver pages, keep the site secure and count visits.
- I don’t sell your data, show adverts or send newsletters.
- Visitors can’t create accounts here.
- If you leave a comment or email me, I hold what you send.
- A few trusted services help run the site, and each is listed below.
Comments
If you leave a comment, I collect the name, email address and website you enter, your comment, and your IP address and browser details.
- What’s public: your name, website and comment. Your email address is never shown.
- The comment form is provided by Jetpack, a service run by Automattic (the company behind WordPress.com). Your details pass through Automattic’s servers, and the form may let you sign in with a WordPress.com account instead.
- Spam checking: every comment is checked by Akismet, also run by Automattic, which receives your comment details, IP address and browser details.
- Profile pictures: a scrambled version of your email address (a “hash”) may be sent to Gravatar, another Automattic service, to see whether you have a profile picture there.
I handle this data because you choose to comment, and because I have a legitimate interest in keeping spam off the site.
Visitor statistics
I use Jetpack Stats, run by Automattic, to count visits and see which pages are popular. It records details such as your IP address, browser, the pages you view, the page that linked you here and your approximate country.
I only see totals and trends, such as views per page and visits by country. I can’t see who you are. I don’t use Google Analytics or any advertising trackers.
I rely on my legitimate interest in understanding how the site is used.
Security and hosting
To keep the site fast and protect it from attacks, some technical data is processed every time a page loads.
- Cloudflare sits in front of the site. Every visit passes through its network, which sees your IP address, browser details and the pages you request, and uses them to block malicious traffic and deliver pages quickly.
- DreamHost hosts the site. Its servers keep standard logs of requests, including IP addresses.
- Wordfence, a security plugin made by Defiant, checks each request for attacks. It records blocked requests, login attempts and suspicious activity, including IP addresses and browser details. It looks up the approximate location of IP addresses using Wordfence’s servers, and shares the IP addresses of attackers with Wordfence’s security network.
I rely on my legitimate interest in keeping the site and its visitors safe.
Fonts, embedded content and sharing
- Fonts: the site’s typefaces load from Adobe Fonts. Your browser connects to Adobe’s servers, which receive your IP address and browser details. Adobe uses this to deliver the fonts and count page views for licensing.
- Embedded content: some posts may include videos or other content from sites such as YouTube. Embedded content behaves exactly as if you had visited the other site. That site may collect data about you, use cookies and track your interaction with it, especially if you’re logged in there.
- Sharing buttons: the buttons for sharing a page on social media are plain links. Nothing is sent to those networks unless you click one.
Cookies
This site doesn’t use advertising or tracking cookies. The cookies it may set are:
| Cookie | Set by | Why | How long |
|---|---|---|---|
| Comment details | WordPress / Jetpack | Remembers your name and email for next time, if you choose | Up to 1 year |
| Security check | Cloudflare | Tells real visitors apart from bots | Up to 30 minutes |
| Login | WordPress, Wordfence | Keeps the site’s admin signed in; not set for visitors | Up to 2 weeks |
Embedded content from other sites may set its own cookies, as described above. You can block or delete cookies in your browser settings; the site still works without them.
Who receives your data
These services process data on the site’s behalf. Most are based in the United States, so your data may be transferred outside the UK. They rely on recognised safeguards for this, such as the UK–US data bridge or standard contractual clauses.
| Service | What it does | Privacy policy |
|---|---|---|
| Automattic (Jetpack, Akismet, Gravatar) | Comment form, spam checking, visitor statistics | automattic.com/privacy |
| Cloudflare | Security and fast delivery of pages | cloudflare.com/privacypolicy |
| DreamHost | Web hosting | dreamhost.com privacy policy |
| Defiant (Wordfence) | Security plugin and firewall | wordfence.com/privacy-policy |
| Adobe (Adobe Fonts) | Website fonts | adobe.com/privacy |
I don’t sell or share your data with anyone else, unless the law requires it.
How long data is kept
| Data | Kept for |
|---|---|
| Comments and their details | As long as the comment is on the site, or until you ask me to remove it |
| Wordfence security logs | Up to 30 days |
| Emails you send me | As long as needed to deal with them |
| Data held by the services above | As set out in each provider’s privacy policy |
Your rights
Under UK data protection law, you can ask me to:
- give you a copy of the personal data I hold about you
- correct anything that’s wrong
- delete your data, such as a comment you’ve left
- stop or limit how I use it, or object to it
Email [email protected] and I’ll reply within one month. Some security records may need to be kept to protect the site.
If you’re unhappy with how I’ve handled your data, you can complain to the Information Commissioner’s Office.
Changes to this policy
If anything here changes, I’ll update this page. Last updated: 1 October 2026.