Privacy Policy

1. Who is responsible for your data

The data controller is:

This is a personal website. No Data Protection Officer is appointed because one is not required (Art. 37 GDPR). For any privacy question or request, write to the email above.

2. Summary

• The site uses Umami, a privacy-friendly, cookieless analytics tool, to count visits and, with its recorder, to record anonymous sessions.
• The site offers a live chat powered by Chatwoot. Anything you write there is stored so I can reply.
• Both tools are self-hosted on my own servers (analytica.alexchaplyha.dev and conversation.alexchaplyha.dev). Your data is not sold, not shared with advertisers and not used for profiling.
• Analytics starts when you open the site because it uses no cookies. The chat sets cookies, so it loads only if you accept cookies in the banner or press “Init chat”. You can change either choice at any time (see section 8).

3. Visitor analytics (Umami)

What is collected: the pages you view, the referring website, the approximate country derived from your IP address, browser, operating system, device type, screen size, language, and the time of the visit. Umami does not use cookies and does not store your full IP address; visits are counted using a short-lived, anonymised hash that cannot be used to identify you or track you across sites.

Purpose: to understand how many people visit the site, which content is useful, and how visitors find it.

Legal basis: my legitimate interest in understanding and improving the site (Art. 6(1)(f) GDPR). Because the data is minimal and cookieless, this does not override your interests. You can object at any time (section 8).

Retention: analytics data is kept for up to 24 months and then deleted.

4. Session recording (Umami recorder)

What is collected: how you interact with the page — scrolling, clicks, mouse movement and the screen layout as it changes — so a visit can be replayed. It is linked to the same anonymised visit data as section 3, not to your name or identity.

Purpose: to find usability and layout problems (for example, content that is hard to read on a phone).

Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You can object at any time with the opt-out in section 8, which turns off both analytics and recording.

Retention: recordings are deleted after 30 days.

5. Live chat (Chatwoot)

When it loads: only after you click “Accept cookies” in the banner, or press the “Init chat” button (which also counts as accepting chat cookies). If you decline, the chat is not loaded and no chat cookies are set.

What is collected: the messages you send, any name or email address you choose to give, the page you were on, your browser and device details, and your IP address. To keep your conversation open between visits, Chatwoot stores an identifier in a cookie and in your browser’s local storage.

Purpose: to answer your questions and continue the conversation, for example about job opportunities.

Legal basis: your consent for loading the chat and setting its cookies (Art. 6(1)(a) GDPR and Art. 22(2) of the Spanish LSSI), and steps taken at your request before possibly entering into a contract for the messages you send (Art. 6(1)(b) GDPR). You can withdraw consent at any time in section 8; this does not affect processing that took place before.

Retention: conversations are kept for up to 12 months after the last message, unless you ask for earlier deletion or a longer period is needed for an ongoing hiring process.

6. Hosting, server logs and CV download

When you load any page, the web server and network provider automatically process technical data needed to deliver it: your IP address, the requested URL, date and time, and browser user agent. This is necessary to run the site securely (Art. 6(1)(f) GDPR). Such logs are kept for no longer than 30 days unless needed to investigate a security incident.

Downloading the CV from /resume is a normal page request and is not tracked separately beyond the analytics described above. Links to external sites such as LinkedIn are governed by those sites’ own privacy policies.

7. Cookies and local storage

Umami analytics sets no cookies. No advertising or social-media cookies are used.

8. Your privacy choices

Change your chat-cookie choice or turn off Umami analytics and session recording on this device. Your choices are saved in your browser and apply to future visits from it. Withdrawing consent stops the chat from loading; to delete existing chat cookies, also clear this site’s data in your browser.

9. Who receives your data

Your data is accessed only by me. It is stored on servers I control, and the following service providers act as data processors under Art. 28 GDPR:

• the hosting provider of the servers that run the site, Umami and Chatwoot;
• Cloudflare, Inc., which provides network delivery and protection for the site’s subdomains and may process IP addresses for that purpose.

Where a provider processes data outside the European Economic Area (for example Cloudflare in the United States), the transfer is protected by the EU–US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses (Art. 45–46 GDPR). Data is never sold or shared for marketing.

10. Your rights

Under the GDPR you have the right to:

• access the personal data I hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict how your data is processed (Art. 18);
• receive your data in a portable format (Art. 20);
• object at any time to processing based on legitimate interest, including analytics and session recording (Art. 21).

To use any of these rights, email [email protected]. I will reply within one month. Because analytics data is anonymised, I may not be able to link it to you; in that case the opt-out in section 8 is the most effective option.

You also have the right to lodge a complaint with a supervisory authority — in Spain, the Agencia Española de Protección de Datos (AEPD), or the authority in your own EU country.

11. Automated decisions and children

No automated decision-making or profiling with legal or similar effects takes place. The site is not directed at children under 14, and I do not knowingly collect their data.

12. Changes to this policy

If the way personal data is processed changes, this page will be updated and the date at the top changed. Significant changes will be highlighted on the site.