Privacy policy

Vasile Sebastian Mihali, freelance software developer · VAT no. 01814790190 · Bagnolo Cremasco (CR), Italy · Email sebmihali07@gmail.com.

This policy covers sebastianmihali.com and enquiries about my professional activity. For information about the processing of your data, write to sebmihali07@gmail.com.

If you use the form, I process your name, email, message and, if you provide them, your indicative budget and how you found me, together with any company details or contact information you choose to include in the message. The message is sent to my mailbox through Mailjet SMTP: the site does not archive enquiries in a database, but correspondence remains in email.

I use the data to reply, evaluate a possible engagement and prepare a quote. The legal basis is steps requested by you before entering a contract (Art. 6(1)(b) GDPR) or, for general questions, my legitimate interest in replying (Art. 6(1)(f) GDPR).

Name, email and message are required: without them the form cannot send your enquiry. Your budget, how you found me and other details are optional. Health data or other particularly sensitive information is not requested.

To protect the form from spam and abuse, the site uses an anti-spam field and a temporary request counter associated with your IP address, without linking it to the message content. The legal basis is my legitimate interest in service security (Art. 6(1)(f) GDPR).

If you contact me by email or phone, I process your contact details and the information you provide for the same purposes and legal bases as the form. The email address shown on the site is hosted on Gmail, provided by Google.

• Google privacy policy

To display pages and protect the service, technical systems process your IP address, date and time, requested resource, request outcome and browser information. The legal basis is my legitimate interest in the operation, security and diagnosis of problems affecting the site (Art. 6(1)(f) GDPR).

When analytics is enabled, I use PostHog on its EU cloud to understand which pages are visited and how much the contact channels are used. It counts page visits, successful form submissions and phone number reveals. These events do not include your name, email, budget or message content.

Analytics includes the page visited, date and time and general browser and device information. URL parameters, fragments, referring domain and advertising campaign identifiers are excluded before sending. PostHog is configured without cookies, persistent browser storage, session recordings, automatic click collection or personal profiles. To distinguish visits within a day, the service derives a code from IP address, browser and domain using a key that changes daily; the IP address is removed from events before storage.

I use these measurements only to assess aggregate use of this site, without combining them with messages received, advertising profiles or browsing activity on other sites. The legal basis is my legitimate interest in improving content and access to contact channels (Art. 6(1)(f) GDPR). Analytics is disabled if your browser sends Do Not Track; you may also object by writing to sebmihali07@gmail.com.

• How PostHog cookieless tracking works

The site does not use profiling or advertising cookies. When you change the light or dark theme, your preference is saved in browser local storage under the name “theme”. This technical preference is requested by you, is not sent to the server and remains until you change it or clear the site’s data in your browser.

The analytics described above does not store persistent identifiers on your device. The absence of a banner relates to this configuration, limited to technical preferences and aggregate site measurements without profiling.

Fonts are hosted by the site: displaying them does not require connections to Google Fonts. No social widgets are embedded; when you open an external link, the destination site’s privacy policy also applies. Analytics requests go through the site’s own domain and are forwarded to PostHog.

• Italian Data Protection Authority: cookies and tracking tools

The providers involved are Hetzner Online GmbH for VPS hosting in the European Union, Mailjet (Sinch group) for email delivery, Google for the Gmail mailbox and PostHog Inc. for analytics on its EU cloud in Frankfurt. They receive the data needed for their respective services. Hosting, email delivery and analytics are services performed on behalf of the controller; the providers’ own privacy policies also apply to their independent processing.

Data is not disclosed or sold for marketing. If an enquiry becomes an engagement, the data needed may be shared with my accountant.

European hosting does not exclude all international transfers: Google and other providers may process data outside the European Economic Area, including for support or through their own providers. Google states that it relies on adequacy decisions, including the EU-U.S. Data Privacy Framework for Google LLC, and standard contractual clauses. Sinch and PostHog agreements provide transfer safeguards, including standard contractual clauses. You can request information about the applicable safeguards and obtain a copy by writing to sebmihali07@gmail.com.

• Data protection at Hetzner
• Sinch / Mailjet data processing agreement
• Google international transfer safeguards
• PostHog data processing agreement

• Enquiries that do not become an engagement: no more than 24 months after the last contact.
• Data needed for an engagement: for the duration of the relationship. Administrative and accounting records are retained for the periods required by law, generally 10 years; information needed for a dispute may be kept until it is resolved.
• Anti-spam counter: your IP address and request count remain in the server’s temporary memory for the one-hour checking window and are deleted when it expires.
• Technical logs: for the time needed to identify and resolve malfunctions or abuse; after an incident, only relevant records may be kept to establish the facts and protect rights.
• Analytics events: for the time needed to compare page and contact use in the period being analysed; daily code rotation does not delete events. Data no longer useful for this analysis is deleted; any summaries kept separately contain only aggregate counts without visitor codes.
• Theme preference: until you change your choice or clear the site’s data in your browser.

Where provided by the GDPR, you can request access, rectification, erasure, restriction and portability of your data by writing to sebmihali07@gmail.com. You may also object to processing based on legitimate interest on grounds relating to your particular situation.

You will normally receive a reply within one month. If your request is complex or there are numerous requests, this may be extended by up to two further months; I will notify you within the first month and explain why.

You may lodge a complaint with the Italian Data Protection Authority or the authority in the EU country where you live or work.

I do not carry out profiling or make decisions based solely on automated processing that produce legal or similarly significant effects on you.

• Italian Data Protection Authority: data subject rights