Privacy policy

The controller for any personal data described here is the entity identified at the bottom of this page. You can reach me at the email address shown there, and that address is the fastest route for any request about your data.

While you browse, nothing. There is no login, no comment section and no newsletter signup. The site writes no cookies and uses no browser storage, so there is nothing on your device to consent to, and that stays true when you use the contact form.

There is also no analytics or advertising of any kind: no Google Analytics, no Meta pixel, no heatmaps, no session recording. The fonts are served from this site rather than from Google, so loading a page does not tell any font provider that you visited.

Like any website, requests reach a server, and that server keeps short-lived technical logs: the requested address, the time, an IP address, and the browser's user agent string. These exist so the site can be operated and abuse can be investigated, which is a legitimate interest under Article 6(1)(f) GDPR. They are not used to profile anyone and are not combined with anything else.

The form sends me your name, your email address, your message, the language of the page you wrote from and the time. That is all it collects. It is stored in a database run by Supabase in Frankfurt, inside the European Union, and only I can read it.

To stop the form being used for spam, the server keeps a one-way fingerprint of your IP address (a salted hash, from which the address cannot be recovered) for 24 hours, to limit how many messages one connection can send. The IP address itself is not stored with your message or anywhere else.

The form sends no automatic reply, so nothing is emailed to the address you type unless I answer you myself.

Whether you use the form or write to the address on this site, I receive what you put in the message: typically your name, your email address and a description of the work you are considering. I use it to answer you and, if we go on to work together, to run the project and meet accounting obligations.

The legal basis for your message is taking steps at your request before entering a contract, under Article 6(1)(b) GDPR, and afterwards a legal obligation under Article 6(1)(c) for anything an invoice has to keep. The short-lived fingerprint used against spam rests on a legitimate interest under Article 6(1)(f): keeping the form usable.

The providers named at the bottom of this page act as processors on my instructions: Vercel operates the servers and therefore handles the technical logs described above, and Supabase stores the messages sent through the contact form, in Frankfurt.

Email is handled by my email provider. Nothing is sold, and nothing is shared for advertising, because there is no advertising here. Where a processor is outside the European Economic Area, transfers rely on the European Commission's standard contractual clauses.

Server logs are short-lived and rotate automatically. Messages sent through the contact form are deleted automatically after 12 months, or sooner if you ask or once the conversation is clearly finished with; the anti-spam fingerprint is deleted after 24 hours. Email correspondence that does not lead to a project is deleted when it is clearly finished with. Where we do work together, documents that accounting law requires are kept for as long as that law requires and no longer.

You can ask for a copy of the data I hold about you, ask me to correct it, ask me to delete it, ask me to restrict or stop a particular use, and ask for it in a portable form. Where processing rests on legitimate interest you can object to it.

Ask by email and you will get an answer within one month. There is no charge, and I do not need a reason. A message you sent through the form is deleted from the database as soon as you ask.

If you think I have handled your data badly, tell me first and I will try to fix it. You also have the right to complain to the Romanian supervisory authority, ANSPDCP, at dataprotection.ro, or to the authority in the country where you live.

If the site starts collecting something, this page changes in the same release, and the date at the top changes with it. There is no version of this site that quietly starts tracking you.