Privacy Policy.

1. Controller

2. General Processing When Visiting This Website

When this website is accessed, technically necessary data is processed so the site can be delivered, operated reliably, and secured. This may include IP address, date and time of access, requested URL, referrer URL, browser, operating system, and technical connection data.

The legal basis is Art. 6 para. 1 lit. f GDPR. The legitimate interest is the secure and functional operation of this website.

3. Hosting by Vercel

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel processes technical access data to deliver the website, defend against attacks, and operate the infrastructure.

The processing is based on Art. 6 para. 1 lit. f GDPR. Where data is transferred to the USA, this is based on appropriate data protection safeguards, in particular EU Standard Contractual Clauses or an adequacy decision where applicable.

4. Umami Analytics and Vercel Speed Insights

This website uses Umami Analytics in its EU region for aggregate usage analysis and Vercel Speed Insights for technical performance measurement. Umami processes page views and fixed interaction categories for project pages, project links, downloads, primary calls to action, blog interactions, and successful contact submissions. It derives rotating anonymous sessions from technical request information but does not use tracking cookies or cross-site identifiers. Only the fixed link source categories resume, portfolio, linkedin, and github are collected through utm_source to understand which shared links lead to visits and interactions. All other URL search parameters, unknown source values, and fragments are excluded. The source is kept in page memory during navigation and is not stored in cookies or browser storage.

Analytics events do not include names, email addresses, subjects, messages, verification tokens, external destination URLs, or other form data. User identification, heatmaps, and session replay are not enabled, and the browser's Do Not Track preference is respected.

The legal basis is Art. 6 para. 1 lit. f GDPR. The legitimate interest is technical and content optimization, error analysis, and understanding whether visitors can reach the website's key portfolio actions. You may object to this processing by enabling Do Not Track in your browser or contacting the controller.

5. Contact Form

If you use the contact form, your name, email address, subject, and message are processed to respond to your inquiry. The information is not used for advertising.

The legal basis is Art. 6 para. 1 lit. b GDPR where the inquiry relates to pre-contractual or contractual communication, otherwise Art. 6 para. 1 lit. f GDPR.

6. Cloudflare Turnstile

Cloudflare Turnstile is used to protect the contact form against automated abuse. It is provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Technical data such as IP address, browser information, and interaction data may be processed to verify whether a request is made by a human.

The legal basis is Art. 6 para. 1 lit. f GDPR. The legitimate interest is protecting the website against spam, abuse, and automated attacks.

7. Email Delivery by Resend

Messages from the contact form are delivered by email through Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend processes the form contents and technical delivery data where required for email delivery.

The legal basis is Art. 6 para. 1 lit. b GDPR or Art. 6 para. 1 lit. f GDPR. Where data is transferred to the USA, this is based on appropriate data protection safeguards.

8. Retention Period

Personal data is stored only for as long as necessary for the respective purpose or as required by statutory retention obligations. Contact inquiries are deleted once the inquiry has been finally processed and no legal reasons require further storage.

9. Your Rights

Under the GDPR, you have the right to access, rectification, deletion, restriction of processing, data portability, and objection to certain processing activities. Where processing is based on consent, you may withdraw that consent at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority.

10. Effective Date

This Privacy Policy applies from September 9, 2026.