Privacy Policy

1. Who Is Responsible

Ivan Melnyk ("I", "me") is the data controller for ivanmelnyk.dev.

Contact: ivanmelniknik1999@gmail.com

2. What Data I Collect

Contact form — when you send a message I collect:

• Name, email address, message content
• Your consent timestamp (checkbox)

This data is stored in a private Directus instance on an EU-based server and used only to reply to your inquiry.

Google Analytics 4 — only if you click "Accept" on the cookie banner:

• Pages visited, time on site, browser and device type
• Events: calculator interactions, form submission, CTA clicks
• IP address (anonymized — last octet removed before storage)

Analytics data is processed by Google LLC (USA) and retained for 14 months per GA4 defaults. You can opt out at any time via the Cookie Preferences link in the footer.

Google Fonts — this site loads Inter and Outfit fonts from Google's CDN. Your IP address is transmitted to Google's servers when fonts are fetched. This is a standard web practice and processed under Google's Privacy Policy.

Server logs — the web server (Caddy) automatically records:

• IP address, request path, browser, response code, timestamp

Logs are retained for 30 days for security and diagnostic purposes, then deleted.

3. Legal Basis (GDPR)

• Analytics cookies: Consent (Art. 6(1)(a) GDPR) — collected only after you accept the banner.
• Contact form: Legitimate interest / pre-contractual steps (Art. 6(1)(b) and (f)) — to respond to your project inquiry.
• Google Fonts / server logs: Legitimate interest (Art. 6(1)(f)) — necessary for basic site operation and security.

4. Cookies

This site uses one first-party cookie-like storage entry (cookie_consent in localStorage) to remember your cookie choice. No tracking cookies are set unless you accept analytics.

When analytics is enabled, Google Analytics sets its own cookies (_ga, _ga_*) to distinguish users and sessions.

You can change your cookie preference at any time via the Cookie Preferences link in the footer of the main page.

5. Third Parties

• Google LLC (Google Analytics 4, Google Fonts) — USA, covered by EU–US Data Privacy Framework (DPF) and Standard Contractual Clauses.
• Directus / botika.cloud — contact form storage, EU-based servers.
• Hetzner Online GmbH — VPS hosting provider, EU-based (Germany).

I do not sell, rent, or share your personal data with any other third parties.

6. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access the personal data I hold about you
• Rectify inaccurate information
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Data portability — receive your data in a machine-readable format
• Withdraw consent at any time (for analytics cookies)
• Lodge a complaint with your local Data Protection Authority

To exercise any right, email me at ivanmelniknik1999@gmail.com. I will respond within 30 days.

7. Data Retention

• Contact form submissions: up to 2 years from date of submission
• Analytics data: 14 months (GA4 default, then automatically deleted)
• Server logs: 30 days
• Cookie consent record: stored locally in your browser until you clear it

8. Security

All traffic is encrypted via TLS (HTTPS). The server enforces HSTS, CSP headers, and other security best practices. Access to stored contact form data is restricted to me personally.

9. Children's Privacy

This site is not directed at children under 16. I do not knowingly collect personal data from minors.

10. Policy Updates

If this policy changes materially, the "Last updated" date above will be updated. Continued use of the site after changes constitutes acceptance of the updated policy.