Privacy notice

Who is responsible

The data controller is Diego Ferreyra Diaz ("I", "me"), an independent software engineer based in Lima, Perú. For any privacy question or to exercise the rights below, write to[email protected].

What I collect and why

• Contact-form submissions. When you send a brief through/contact I receive the name, email address and message you type, plus a Cloudflare Turnstile token used only to check you're human.Purpose: to read and reply to your enquiry.Legal basis: steps taken at your request prior to entering a contract (GDPR Art. 6(1)(b)) / your consent under Ley 29733.
• Technical request data. Like any web server, mine records IP address, user-agent and timestamps in short-lived logs, and uses your IP transiently for spam/abuse rate-limiting on the contact endpoint.Purpose: security, abuse prevention and basic operation.Legal basis: my legitimate interest in keeping the site available and free of abuse (GDPR Art. 6(1)(f)).
• Privacy-respecting analytics. I use PostHog to understand aggregate traffic. Personal identifiers (email, IP, address, phone) attached to server-side error events are hashed before they leave my server, and analytics profiles are created only for identified actions.Purpose: measuring and improving the site.Legal basis: legitimate interest (GDPR Art. 6(1)(f)).

I do not sell personal data, and I do not use it for automated decision-making or profiling that produces legal effects.

Who processes data on my behalf

I rely on a small set of vetted processors. Each acts only on my instructions and under a data-processing agreement:

• Cloudflare, Inc. — CDN, reverse proxy, and the Turnstile anti-bot challenge. Processes request metadata and the Turnstile token.
• Google (Google Workspace / Gmail). — delivers and stores the email generated by your contact-form submission so I can reply.
• PostHog, Inc. — product analytics and error tracking, as described above.
• Server logs (systemd journal). — short-lived operational logs held on the server that hosts this site.

Some of these providers are based in, or transfer data to, the United States. Where that happens, transfers rely on the providers' Standard Contractual Clauses or equivalent safeguards.

How long I keep it

• Contact emails: kept while our conversation is active and for as long as needed to manage the resulting relationship, then deleted.
• Server / request logs: rotated and discarded within a short period (days to a few weeks).
• Analytics: retained in aggregate per PostHog's retention settings; no raw PII is stored unhashed.

Your rights

Under the GDPR and Ley 29733 you can ask me to: access the data I hold about you; correct it; delete it; restrict or object to its processing; and receive it in a portable format. Where processing relies on consent, you can withdraw that consent at any time. To exercise any of these, email[email protected] — I'll respond within the timeframes the law requires.

EU/EEA visitors also have the right to lodge a complaint with their local data protection authority. Visitors in Peru may contact the Autoridad Nacional de Protección de Datos Personales (ANPDP) at the Ministerio de Justicia.

Changes to this notice

If the processing described here changes, I'll update this page and the "last updated" date above. Material changes affecting active conversations will be communicated directly where practical.