Privacy Policy

Who is responsible

This site is operated by Max Buzin, an independent freelance web developer based in the United Arab Emirates. For anything in this policy, write to hello@maxbuzin.com. Full operator details are on the Legal Notice page.

No Data Protection Officer has been appointed. The scale and nature of the processing described here does not meet the threshold in Article 37 of the GDPR.

What this policy covers

The public website: the home page, the projects pages, and these legal pages. The administration area is a private tool used only by the site operator to manage portfolio content, and it is not part of the service offered to visitors.

What is collected

Analytics, only with your consent

If you accept analytics, Google Analytics 4 records which pages you view, an approximate location derived from your IP address, your device and browser type, the referring source, and interaction events such as scrolling. It stores the cookies listed in the Cookie Policy. Google does not retain your full IP address in Analytics reporting, it is used in transit to estimate location and then discarded.

If you decline, or simply ignore the banner, the Google Analytics script is never requested and none of this happens.

Server logs

The hosting provider records standard request metadata for every page served: IP address, timestamp, requested path, user agent, and response status. This is part of operating and securing any website. It is not a marketing dataset and is not linked to analytics.

Abuse prevention

Requests to API paths are rate limited. A short lived counter keyed to the requesting IP address is held in Upstash Redis and expires within minutes. It is not linked to an identity and is never used for analytics.

What is not collected

This is a portfolio site, and the list of things it does not do is longer than the list of things it does:

• No forms. There is no contact form, no newsletter signup, no comment system, and no search box. There is no input field anywhere on the public site.
• No accounts. Visitors cannot register or sign in. The private admin area is for the site operator only.
• No payment data. Nothing is sold here and no card details are ever entered or processed.
• No advertising or cross site tracking. There are no ad networks, no remarketing tags, and no social media pixels.
• No font tracking. Fonts are self hosted, so loading a page makes no request to Google Fonts.

Who else receives data

Loading this site involves a small number of third parties. Each one is listed below with the reason it is involved.

• Google (Google Analytics). Analytics processor, used only after you accept. Data may be processed in the United States. See the Google Privacy Policy.
• Google (Google Drive image hosting). Some project cover images are served directly from Google Drive to your browser. This means Google receives your IP address and the referring page whenever you view a project, and it happens regardless of your analytics choice, because the image cannot be displayed otherwise. This is image delivery, not analytics, and no cookie is set by it.
• Vercel. Hosting and content delivery. Processes request metadata and server logs as described above.
• Upstash. Redis storage for the short lived rate limit counters described above.

The site database (Neon) holds only content entered by the operator, such as project and client records. It holds no visitor data. No advertising network, data broker, or analytics provider other than Google Analytics receives anything.

Why this processing is lawful

• Analytics: your consent, Article 6(1)(a). You can withdraw it at any time.
• Server logs and rate limiting: legitimate interest, Article 6(1)(f), in keeping the site available and resistant to abuse.
• Serving images from Google Drive: legitimate interest, Article 6(1)(f), in delivering the page content you asked for.
• Replying to an email you send: Article 6(1)(b) and 6(1)(f), taking steps at your request and answering correspondence.

How long data is kept

• Analytics cookies: up to two years from your last visit, unless you clear them sooner.
• Analytics event data held by Google: according to the retention period configured on the Google Analytics property, which is a maximum of 14 months.
• Server logs: according to the hosting provider retention period for the plan in use.
• Rate limit counters: minutes, then automatic expiry.
• Emails you send: for as long as the correspondence and any resulting work require.

International transfers

The operator is based in the United Arab Emirates, which is not the subject of a European Commission adequacy decision. The processors named above may process data in the United States and elsewhere. Where personal data from the European Economic Area or the United Kingdom is transferred, those providers rely on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework.

Your rights under the GDPR

If you are in the European Economic Area or the United Kingdom, you have the right to:

• access the personal data held about you (Article 15)
• have inaccurate data corrected (Article 16)
• have data erased (Article 17)
• restrict how data is processed (Article 18)
• receive your data in a portable format (Article 20)
• object to processing based on legitimate interest (Article 21)
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3))
• lodge a complaint with the supervisory authority in your country of residence or workplace

Analytics consent can be withdrawn at any moment using the Cookie settings link in the footer of every page. No email is required for that.

Your rights under the LGPD

If you are in Brazil, Lei 13.709/2018 gives you the right to confirmation that processing takes place, access to your data, correction of incomplete or outdated data, anonymisation or blocking or deletion of unnecessary or excessive data, portability, information about parties with whom data has been shared, information about the consequences of refusing consent, and revocation of consent.

How to exercise your rights

Email hello@maxbuzin.com. A reply will follow within 30 days.

One honest limitation: this site deliberately collects no identifier that links analytics data to you as a person. In most cases there is therefore no way to locate data about a specific individual, and the law does not require additional information to be collected purely to make identification possible (GDPR Article 11). Where that applies, it will be explained in the reply.

Children

This site is not directed at children under 16 and does not knowingly collect anything from them.

Changes to this policy

Any material change is reflected in the date shown at the top of this page. If the scope of analytics ever changes, consent will be requested again rather than assumed.