PRIVACY
What this site collects, why, for how long, and how to have it erased.
Data controller
The controller for the processing described below is the publisher of this site.
- Controller
- Kevin Armache
- Contact for data requests
- kevinarmache@gmail.com
There is no data protection officer: the scale of this site does not require one. Requests go straight to the email address above, which is the contact point for every right listed further down.
What is collected, and why
Each row below is one separate purpose. Nothing is collected for a purpose that is not listed here.
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact form | Name, email address, subject, message. | Answering you. | Steps taken at your request before entering into a contract, and legitimate interest in answering a message you chose to send. | Kept in the publisher's mailbox for up to 3 years after the last exchange. |
| Testimonials | First name, last name, message, profile photo, and Instagram handle if you provide one. | Public display on the testimonials page, after review. | Your consent, given by ticking the box on the submission form. | Until you withdraw it. One email is enough. |
| Audience measurement | IP address, a hashed device signature, browser and operating system, device type, screen and window size, time zone, language, CPU cores, memory, touch support, country, region, city, postcode, approximate coordinates, network operator, referring page, pages visited, visit and page-view counters. | Counting distinct visitors, understanding where they come from and which pages they read, and showing a visitor counter and a world map on the site. | Your consent, given through the cookie banner. Nothing is recorded before you accept. | 25 months from your last visit, then automatically deleted. |
| Real-time presence | Cursor position, scroll position, page being viewed, and an anonymous session identifier drawn at random. | Showing other visitors present on the same page at the same moment. | Your consent, given through the cookie banner. | Nothing is stored. The data passes through the server in memory and disappears when you close the page. |
| Administrator account | Email address, name, hashed password, and for each session an IP address and a browser signature. | Securing access to the site's administration area. | Legitimate interest in protecting the site. | For the lifetime of the account. Sessions expire after 7 days. |
| Server logs | IP address, date, requested URL, browser signature, recorded by the hosting provider. | Site operation, security and incident diagnosis. | Legal obligation and legitimate interest in keeping the service secure. | Short retention set by the hosting provider. See its own policy. |
Audience measurement and real-time presence are the only two purposes that depend on your consent, and they are the only two you are asked about. Everything else is either strictly necessary to run the site or triggered by an action you take yourself, such as sending a message.
What is never done
- Your data is never sold, rented or exchanged.
- No advertising, no advertising network, no ad-targeting cookie.
- No tracking of your browsing on other sites.
- No automated decision producing legal effects concerning you.
- Visitor IP addresses and geolocation are never displayed publicly. The counter and the world map show aggregated figures only.
Recipients and processors
Only the publisher accesses this data. It is also handled by the technical providers below, who act on the publisher's instructions and for no purpose of their own.
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Website hosting, server logs, and Vercel Web Analytics. | United States |
| Neon Inc. | Managed PostgreSQL database holding testimonials and visitor records. | United States |
| Render Services, Inc. | Real-time presence server. Relays cursor positions between visitors; stores nothing. | United States (service instance hosted in Frankfurt, Germany) |
| ipapi.co | IP geolocation, called once per new visitor to resolve city, ISP and network. | United States |
| Email provider (SMTP) used for the contact form | Delivery of messages sent through the contact form. | See provider's policy |
Transfers outside the European Union
Some of the providers listed above are established in the United States, which means part of the data is processed outside the European Union. These transfers rely on the safeguards provided for by the GDPR: the European Commission's standard contractual clauses, and, where the provider is certified, the EU-US Data Privacy Framework.
Your rights
Under the GDPR you have the following rights over your data:
- Access — obtain a copy of the data held about you.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted.
- Restriction — have processing frozen while a dispute is resolved.
- Objection — object to processing based on legitimate interest.
- Portability — receive the data you provided in a reusable format.
- Withdrawal of consent — at any time, as easily as it was given, without affecting what was done before.
- Post-mortem directives — set instructions on what happens to your data after your death.
Two of these need no email at all. Withdrawing your consent to audience measurement, from the cookie banner, immediately deletes the visitor record associated with your device along with its cookie. Withdrawing consent to real-time presence stops the connection at once.
For anything else, write to kevinarmache@gmail.com. You will get an answer within one month. If your request concerns a testimonial, mention the first and last name it was published under.
If you believe your rights are not respected, you may lodge a complaint with a supervisory authority, for example:
- Authority
- CNIL (Commission nationale de l'informatique et des libertes)
- Address
- 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
- Complaints
- https://www.cnil.fr/fr/plaintes
Security
- All traffic is served over HTTPS.
- The visitor identifier cookie is httpOnly and inaccessible to page scripts.
- The device signature is stored as a one-way hash, never in clear text.
- Administrator passwords are hashed. Public sign-up is disabled and login attempts are rate-limited.
- Detailed visitor data is readable only from the authenticated administration area.
No system is perfect. Should a breach be likely to result in a high risk to your rights, you will be informed as required by Article 34 of the GDPR.
Minors
This site is not aimed at children. No data is knowingly collected from a person under 15. If you are the holder of parental authority and believe such data has been collected, write to kevinarmache@gmail.com and it will be deleted.
Changes to this policy
This policy may change as the site does. The date at the top of the page is the date of the version in force. A change affecting a purpose or a recipient resets the consent banner, so you are asked again rather than kept to a choice made about something else.