Privacy notice

This site is run by Ever Barreto, trading as Borealis, from Asunción, Paraguay. I am the person who decides what happens to anything you send here, and I am the only person who reads it.

Reading the site

Browsing this site sets no cookie at all. There is no tag manager, no advertising pixel and no session cookie on any public page. That is not a policy statement, it is how the site is built: public pages are served through a middleware stack that deliberately leaves out sessions and cookies entirely, so that they can be cached at the edge.

I do count page views, using Cloudflare Web Analytics. It records the page, where you arrived from and a rough country. It sets no cookie, does not fingerprint your device, and builds no profile of you. I can see that a page was read. I cannot see that you read it.

The site is served through Cloudflare, which sits in front of it as a cache and as protection against attack traffic. Cloudflare sees the requests it serves, including your IP address, in the same way any network carrying your traffic does.

The server keeps ordinary web-server logs, which include IP addresses, for operational and security purposes.

The contact form

The contact form asks for, and stores, exactly this:

what you want built, and what is blocking you

whether something exists today

a budget band and a timeline band

your name and your email address

optionally, your country

the IP address the form was submitted from

Two things happen when you submit it. The answers are stored in this site's own database, on a server I rent from DigitalOcean in New York, and they are emailed to me through Amazon SES so that I see the enquiry without having to go looking for it.

The form is protected by Cloudflare Turnstile, which is there to keep automated submissions out. Completing that challenge sends your IP address to Cloudflare. Submitting the form also sets one session cookie, which exists to carry the security token that proves the submission came from the form rather than from somewhere else.

Who else sees it

Nobody. What you write goes to me and is not sold, shared, published, or added to any mailing list. There is no mailing list.

Three companies handle it in the sense that they run the infrastructure it passes through, and each is bound by its own contract to process it only as instructed: DigitalOcean hosts the server, Amazon Web Services delivers the notification email, and Cloudflare serves the site and runs the anti-bot check. None of them is a party to the enquiry.

Because the server and the mail service are in the United States, an enquiry sent from elsewhere is transferred there.

Why I am allowed to hold it

You sent it to me in order to start a conversation about work, and holding it is what lets me reply and keep track of that conversation. If we end up working together, the record of how the engagement started is part of the business record.

How long I keep it

Until you ask me to delete it, or 24 months after we last spoke, whichever comes first.

What you can ask for

Ask and I will tell you exactly what I hold about you, correct it, or delete it. There is no form to fill in and no process to go through: reply to any email you have had from me, or send the request through the contact form, and say what you want done.

If you are in the UK or the EU and you think I have handled your information badly, you are entitled to complain to your national data protection authority. I would rather you told me first, so I can fix it.

Changes

If this notice changes in a way that affects information I already hold, I will say so here rather than quietly rewriting it.