Privacy

Who processes your data

This is a personal site; there is no company behind it. The data controller is its author, and the contact point for anything on this page is admin@itstatinxd.dev.

What is measured, exactly

Two things, and neither of them identifies you by name.

• Web server logs. Every request leaves one line with the date and time, the page requested, the response code, the size, the browser you report, the referring page if you arrived from a link, and your IP address.
• Aggregate audience measurement. Page views, approximate country, device type, browser, and where the visit came from. It is computed on the server itself and stored already aggregated, with no persistent identifier following you from one visit to the next.

There are no forms on this site: you are never asked for a name, an email address, or anything else. If you want to get in touch you send an email, and that email is treated as what it is — a conversation.

On what legal basis

Legitimate interest, Article 6(1)(f) GDPR. The interest is twofold and specific: keeping the site available and detecting abuse — logs are the only way to see a scan or an intrusion attempt — and knowing whether the portfolio is actually read, so I can decide whether it is worth more of my time.

The balancing test, which is the part almost nobody writes down: you are not identified, not profiled, not tracked across sites, the data is not combined with any other source, and it is not shared with anyone. The most sensitive item, your IP address, is kept for 14 days and disappears along with the file holding it. You can still object — see below.

How long it is kept

• Server access logs, including the IP address: 14 days. Rotation deletes them; it does not archive them.
• Aggregate audience metrics, already stripped of IP addresses: 12 months.
• Emails you send me: for as long as the conversation is live, and at most 12 months after it closes.

These are not intentions: they are the server configuration. If it changes there, this page changes too.

Cookies: there are none

This site sets no cookies at all. None of its own, none from third parties, no analytics and no advertising. That is why there is no consent banner: there would be nothing to consent to.

One exception, because "no cookies" is not "nothing at all". If you switch between light and dark mode, that preference is stored in your browser's local storage. It never leaves your device, it is never sent to the server, and it cannot identify you: it is a customisation you asked for, which is why it is exempt from consent. Clearing the site data removes it.

And the clarification that usually goes missing: having no cookies does not remove the obligations. Your IP address is processed either way in order to serve you the page, even if it is discarded afterwards. That is why this page exists rather than a line claiming nothing is collected here.

Where the data lives, and who else sees it

The site is static and served from a server located in Spain. The metrics are computed on that same machine, with self-hosted software. There are no international data transfers: no processor outside the European Economic Area is involved. The only third party in the picture is the data centre provider hosting the machine, inside the EU.

Nor are there third parties loading inside the page: the fonts are served from this same domain, and there are no embedded videos, maps, social buttons or external analytics tags. You can check it in your browser's network tab — it takes thirty seconds, and you are welcome to.

What is not done

• No data is sold or shared with anyone.
• There is no advertising and no cross-site tracking.
• There are no automated decisions and no profiling.
• No attempt is made to identify anyone from the logs. If it ever became necessary it would be for a specific security incident, with the IP address as the only thing available.

Your rights and how to exercise them

You can request access, rectification, erasure, restriction, portability, and object to the processing. Email admin@itstatinxd.dev saying what you need; I answer within one month at the latest, and usually within days.

An honest note on what is actually possible: to locate your access log entries I would need you to tell me your IP address and a rough time window, and in most cases they will already have expired under the 14-day retention. Nothing is stored that would let me find you any other way — which is precisely the point of the design.

If you believe the processing is not lawful, you can lodge a complaint with the Spanish Data Protection Agency, or with the supervisory authority where you live. I would rather you told me first, but the right is yours and it does not go through me.

Changes to this page

If what is measured or how long it is kept changes, this page and its update date change with it. There are no archived earlier versions: this is the first.