NatureLaw Research

Privacy policy

Last updated: October 29, 2026

The short version

  • NatureLaw Research sets no cookies of its own for readers. We run no ads and no third-party analytics.
  • We count visits to articles, and clicks on the links to our partners, with our own counter. It uses no cookies and does not store your IP address. After 48 hours only daily totals remain, apart from copies in our encrypted backups. You can opt out of the counter’s scripts at any time, free of charge. Clicks on our partner links that start with /go/ are counted by our server, as explained below.
  • Cloudflare delivers and protects the site. It may set a security cookie.
  • Our web server keeps standard access logs, including IP addresses, for security and troubleshooting. They are deleted after about 10 days.
  • If you follow a link to one of our partners, the partner’s website may set its own cookies. That is how the partner knows we sent you.

Who is responsible for your data

NatureLaw Research (research.naturelawtrading.com) is run by Stefano Mastria. Under data protection law, he is the controller of the personal data described on this page.

Address: Via Romolo Murri 1, Casoria (NA), Italy.

Email: [email protected].

What we collect and why

Server logs

Like most websites, our web server records each request in a log file: the IP address, the date and time, the site and page requested, the request method, the response code, the size of the response, the referring page (when your browser sends it), the time taken to answer and the browser’s user agent string. Cloudflare sits in front of the server, and the server records the visitor’s IP address as Cloudflare passes it on.

We use these logs to keep the site secure, to investigate errors and to stop abuse. We manage the server ourselves, on infrastructure provided by Amazon Web Services (AWS) in its Europe (Milan) region, in Italy.

Cloudflare

All traffic to research.naturelawtrading.com passes through Cloudflare, Inc., which provides our network, caching and security services. To do that, Cloudflare processes your IP address and the details of each request. It uses them to deliver pages quickly, to block attacks and automated abuse, and to keep the site available. Cloudflare gives us aggregated statistics about traffic and threats.

Cloudflare may set strictly necessary security cookies, such as __cf_bm or cf_clearance, to tell people from bots or to remember that your browser passed a security check. The __cf_bm cookie expires after 30 minutes of inactivity. Cloudflare’s responses also ask your browser to remember, for 7 days, where to report network errors (Network Error Logging). Cloudflare handles this data under its data processing terms with us and its privacy policy (opens in a new tab).

Our visit and click counter

This site counts visits to its articles, and clicks on the links to our partners (the prop firms, brokers and trading tools whose affiliate programs we have joined), with an internal counter that uses no cookies and stores nothing on the visitor’s device. The IP address is not stored. For at most 48 hours the site keeps a pseudonymous identifier for each visitor and article, and one for each visitor and link, calculated with a random code that changes every day. They are used only to avoid counting reloads and repeated clicks twice and to estimate the number of unique visitors in a day. They cannot be linked across different articles or links. Once the site has deleted the daily code, the identifiers left on the site can no longer be traced back to a visitor. Our encrypted backups may also contain these pseudonymous identifiers and the daily code (see “How long we keep data”).

For the same period the site keeps pseudonymous counters for each IP address and network, without the address itself, so that repeated or automated requests don’t inflate the counts. After that, only aggregate counts remain. For visits: by day, article, traffic source (for example a search engine, social media or email) and market (United States, United Kingdom, European Union, other countries). For clicks: by day, article, link, partner and market.

How visits are counted: on article pages, a small script served from our own domain sends one request per visit to our server, with the page, the referring page and any utm_source and utm_medium values in the link.

How clicks are counted: most of our partner links point to an address on this site that starts with /go/ followed by the partner’s name. When you click one, your browser asks our server for that address, and our server sends you on to the partner’s website. At that moment our server counts the click, with the same rules as the rest of the counter: no cookie, the IP address not stored, and at most one count every 30 seconds for the same visitor and link. For partners whose affiliate program supports it, the address we send you to also carries the name of the article you came from (the last part of its web address), so that the partner’s report can tell us which article led to a sign-up or a purchase. It carries nothing about you. For partner links that don’t go through /go/, a second small script, also served from our own domain and loaded only on article pages that contain partner links, sends one request to our server when you click such a link (or open it in a new tab with the middle mouse button), with the page, the address of the link and our own reference for it. It doesn’t delay or change the link.

The daily identifier is calculated from your IP address (for IPv6, your network) and your browser’s user agent string. The market comes from the country that Cloudflare derives from your IP address, and we keep it only as United States, United Kingdom, European Union or other countries.

Counting a click doesn’t tell us who you are or whether you buy anything. Partners report sign-ups, purchases and commissions to us separately (see Links to our partners), and we combine those reports with our click totals only as totals, to estimate how much each article and each link earns.

Because the scripts read information in your browser (the referring page, the address of the page and the partner link you click), the law treats them as access to information on your device. In the United Kingdom we rely on the exception for statistics: the counter is used only to produce statistics on how the site is used, such as which articles are read and which links readers follow, so that we can improve it, and its data is not shared except with the service providers that run the site for us. In the European Union we rely on the conditions under which the Italian data protection authority treats analytics tools like technical ones: the counter is run by us alone, it produces aggregate statistics only, and it does not identify you.

You can object at any time, free of charge, with the button below. Your choice is kept in your browser’s local storage as nlr_counter_optout, and the counter’s scripts then send nothing from this browser, for visits or for clicks. The choice applies to this browser only, so use the button again on other browsers and devices. If you clear the site data in your browser, the choice is deleted too. If your browser sends a Global Privacy Control signal, the counter’s scripts send nothing either, for visits or for clicks.

The button and the Global Privacy Control signal work inside your browser, so they cannot stop the count that our server makes when your browser asks for a /go/ address. That count is pseudonymous and is reduced to daily totals as described above. If you don’t want a click counted at all, go to the partner’s website directly instead of following our link: the partner then has no way to know we sent you.

The opt-out button needs JavaScript. With JavaScript turned off, the counter’s scripts cannot run either, so your visits are not counted. Clicks on our /go/ links are still counted by our server, as described above.

Many of our links are affiliate links: they tell the partner that the visit came from NatureLaw Research. When you follow one, the partner’s website, and any tracking platform the partner uses for its affiliate program, may set or read their own cookies, or use similar technologies, to credit us with a sign-up or a purchase. They may collect information such as your IP address, browser type and operating system, and use it under their own privacy policies. We don’t control these cookies, and our pages don’t set them. Some of our pages also show a discount code from a partner: if you use it, the partner may use the code to credit us as well.

The reports we receive from partners tell us about the sign-ups and purchases that came through our links or codes, and the commission due. Depending on the partner, a report may also include details such as the country of the purchase or an order or account reference. We use these reports only to check and attribute our commissions and to keep our accounts. We don’t receive your payment details, and we don’t ask partners for your name or contact details. Our own counter also counts clicks on these links, without cookies (see Our visit and click counter). More in our affiliate disclosure.

If you email us

If you write to us, we receive your email address, your message and anything you attach. We use them to reply to you. Our mailbox is on a mail server that we run ourselves, on the same AWS infrastructure in Italy as the site. The emails we send are delivered through Amazon Simple Email Service (Amazon SES).

Search data

We use Google Search Console to see which searches lead to our pages. Google provides these reports as aggregated data. Search Console adds nothing to our pages and sets no cookies on them.

What we don’t do

  • No advertising, and no third-party analytics such as Google Analytics.
  • No social media buttons, embedded charts, widgets, videos or tracking scripts from other companies on our pages.
  • No comments, reader accounts or newsletter.
  • We don’t sell personal data.

Cookies and similar technologies

NatureLaw Research sets no cookies of its own for readers. These are the cookies and similar technologies used when you read the site:

  • Our cookie notice. When you close it, your browser’s local storage keeps one entry, nl_cookie_notice, so the notice doesn’t come back on every page. It contains only the version of the notice you closed. It never leaves your browser and has no expiry date. You can delete it by clearing the site data in your browser.
  • Your choice about the counter. If you use the button in Our visit and click counter, your browser’s local storage keeps one entry, nlr_counter_optout, so the counter’s scripts send nothing, for visits or for clicks. It never leaves your browser and has no expiry date. You can delete it with the same button or by clearing the site data in your browser.
  • Our visit and click counter. It sets no cookies and stores nothing in your browser, but its scripts read the referring page and the address of the page and, on pages with partner links, note which partner link you click, as described in Our visit and click counter.
  • Cloudflare security cookies. Strictly necessary security cookies, as described above. __cf_bm expires after 30 minutes of inactivity.
  • Cloudflare network error reporting. Cloudflare’s responses ask your browser to remember for 7 days where to report connection failures (Network Error Logging).
  • HTTPS only. Our server asks your browser to remember for one year to use only HTTPS on research.naturelawtrading.com (HTTP Strict Transport Security).
  • Partner websites you visit through our links. Their own cookies, set on their websites after you follow a link, for as long as their own policies say.
  • Site editors. WordPress sets login cookies only for the people who sign in to manage the site. Readers never need to sign in.

In the European Union, the ePrivacy rules (in Italy, Article 122 of the Italian Personal Data Protection Code) require consent before a website stores or reads information on your device, unless it is strictly necessary for the service you asked for. The cookie guidelines of the Italian data protection authority (June 10, 2021) treat analytics tools like strictly necessary ones when they only produce aggregate statistics for the site that runs them and do not identify visitors. In the United Kingdom, the Privacy and Electronic Communications Regulations (PECR) have the same rule, with an exception for strictly necessary uses and, since February 5, 2026, one for uses that only produce statistics to improve the site, when you are told clearly and can object simply and free of charge. Our visit and click counter relies on these provisions (see Our visit and click counter). We consider everything else listed above either strictly necessary or set by another website, so we show a notice instead of asking for consent. If we ever add analytics, advertising, embedded charts or videos that need your consent, we will ask for it before they load.

Legal bases

NatureLaw Research is run from Italy, so the EU General Data Protection Regulation (EU GDPR) applies to the data described on this page. For readers in the United Kingdom, the UK GDPR applies too. Both require a legal basis for each use of personal data. We rely on:

  • Legitimate interests (Article 6(1)(f)) for server logs and Cloudflare: running a secure, fast and available website.
  • Legitimate interests for the visit and click counter: knowing which articles are read, where readers come from and which of our links they follow, using pseudonymous data that is reduced to daily totals after 48 hours.
  • Legitimate interests for partner reports: checking that our commissions are correct and which articles they come from.
  • Legitimate interests for emails: replying to you.
  • Legal obligation (Article 6(1)(c)) when the law requires us to keep or disclose data, for example accounting and tax records.

You can object to any processing based on legitimate interests (see “Your rights” below). For the counter’s scripts, the simplest way is the button in Our visit and click counter: it works at once, and you don’t need to write to us.

Who receives the data

These service providers process data on our behalf:

  • Cloudflare, Inc.: network, caching and security.
  • Amazon Web Services (AWS), Europe (Milan) region, in Italy: the server that runs the site and our mailbox.
  • Amazon Web Services (Amazon S3): encrypted backups of the site.
  • Amazon Web Services (Amazon SES): delivery of the emails we send.

Partners receive data directly from your browser when you follow a link to them, and handle it under their own policies. We may disclose data when the law requires it.

International transfers

Our server and our mailbox are in the European Union, in Italy. UK law recognizes the countries of the European Economic Area, including Italy, as providing adequate protection for personal data. Some of our providers, such as Cloudflare and Amazon Web Services, are based in the United States and operate worldwide, so they may also process data there or in other countries. When data goes to a country outside the European Economic Area and the UK, we rely on the provider’s data processing terms, which include the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, or on the EU-US Data Privacy Framework and its UK Extension where the provider is certified under it.

How long we keep data

  • Server logs: about 10 days. The log files are rotated every day and deleted after about 10 days, or sooner if a file grows too large. Copies may also remain in our encrypted backups (see below).
  • Visit and click counter: pseudonymous identifiers and per-address counters for at most 48 hours on the site; after that, daily totals only. Copies of the identifiers and of the daily code may remain in our encrypted backups (see below).
  • Cloudflare: as described in Cloudflare’s privacy policy.
  • Partner reports: for as long as accounting and tax law requires us to keep the records of our income.
  • Emails: for as long as we need them to answer you and to handle any follow-up, then we delete them.
  • Backups: encrypted backups of the site, which may contain the data above, are kept for up to about six months: one a day for the last 7 days, one a week for the last 4 weeks and one a month for the last 6 months.

Your rights

Under the EU GDPR and the UK GDPR you have the right to:

  • get a copy of the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data deleted;
  • ask us to restrict how we use it;
  • object to processing based on legitimate interests;
  • receive your data in a portable format, where this right applies.

Wherever you live, to use these rights email [email protected]. We aim to reply within one month. We may ask for information to confirm that the request is yours. For server logs, it helps to tell us your IP address and roughly when you visited. Our visit and click counter does not store IP addresses and deletes its identifiers within 48 hours, so we usually cannot link counter data to you. To stop the counter’s scripts, use the button in Our visit and click counter.

You can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it (opens in a new tab)), or to the data protection authority of the EU country where you live, where you work or where you believe the problem occurred. In the United Kingdom you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint (opens in a new tab). We would appreciate the chance to fix the problem first.

Readers in the United States

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising. We don’t track you across other websites. If your browser sends a Global Privacy Control signal, the counter’s scripts send nothing, as if you had used the opt-out button. Nothing else on the site changes with a Do Not Track or Global Privacy Control signal: the only other count is the one our server makes when you follow a /go/ link, described in Our visit and click counter.

Children

NatureLaw Research is written for adults. It is not directed to anyone under 18, and we don’t knowingly collect personal information from children.

Security

Every page is served over HTTPS. Access to the server, its logs and its backups is limited to the people who run the site, and backups are encrypted.

Changes to this policy

When we change how we handle data, for example by adding analytics, embedded charts, videos or a newsletter, we update this page before the change goes live and change the date at the top.

Contact

Questions about this policy: [email protected]. See also Affiliate disclosure, Risk disclaimer and Editorial policy.