Privacy Policy
Last updated:
This page explains what happens to your data when you visit krolmic.dev, use the chat assistant, or send me a message, and which rights you have. I don’t sell your data and I don’t use it for advertising.
Who is responsible
The controller for this website, and your contact for any privacy question or request, is:
krolmic OÜ
Sepapaja tn 6, 15551 Tallinn, Estonia
Registry code 17087382
hello@krolmic.dev
Hosting and server logs
krolmic.dev runs on Cloudflare. To deliver the pages and protect the site against attacks, Cloudflare processes your IP address and request data such as the requested address, the time, your browser’s user agent, and the page you came from.
The contact page and the chat assistant run as server code on Cloudflare Workers. Its logs don’t record your requests. They only contain error messages from this code, which I use to find problems, and are deleted after at most 7 days.
Legal basis: my legitimate interest in running a secure and reliable website (Art. 6(1)(f) GDPR).
Analytics with PostHog
I use PostHog to understand how visitors use this site and to improve it. PostHog stores the data in the EU (AWS in Frankfurt, Germany). On your first visit a banner asks whether you accept analytics cookies. Until you choose, the PostHog script loads but sends no analytics data and stores nothing on your device. You can change your choice at any time with “Cookie settings” in the footer of every page.
If you accept
PostHog stores a random ID in a cookie and in your browser’s storage (see Cookies and storage), so your visits to this site can be linked over time, and keeps a profile for that ID. The profile never contains your name or email address: this site doesn’t send them to PostHog, and it removes them from every page address before an event is sent. With your consent PostHog records:
- pages you view and leave, the page you came from, and campaign parameters in the address
- clicks and form interactions without their contents, clicks on elements that do nothing, and click positions for heatmaps
- page performance (web vitals) and technical errors
- your browser, operating system, device type, screen size, and approximate location (country, region, city) derived from your IP address. PostHog then discards the IP address and doesn’t store it
- session recordings
- the custom events listed below
Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with Cookie settings. Withdrawing deletes PostHog’s cookie and storage items from your browser and doesn’t affect processing that happened before.
If you decline
PostHog stores nothing on your device and records only cookie-free statistics: pages viewed, clicks, heatmap positions, page performance, and the custom events below. There are no session recordings and no profiles. Instead of a cookie, PostHog’s server combines your IP address, your browser’s user agent, the site’s address, and a random value that changes every day into a one-way hash. The daily value is deleted once that day’s events are processed, so visits can be counted within a day but can’t be linked across days, and the hash can’t be turned back into your IP address. PostHog also derives an approximate location (country, region, city) from your IP address and then discards the IP address.
Legal basis: my legitimate interest in measuring how the site is used (Art. 6(1)(f) GDPR). You can object at any time by email.
Custom events
On top of PostHog’s standard data, the site sends these events. They never contain what you type, and their page address never includes query parameters.
- Consent: your banner choice and where you made it.
- Calls to action: clicks on buttons such as “Get in Touch”, service cards, and blog cards.
- Interest: CV downloads, App Store and Google Play badge clicks, clicks on social profiles and other external links, RSS clicks, and article shares.
- Contact form: started, submitted, and completed, and whether the chat assistant prefilled it (never the values).
- Chat assistant: see Chat assistant.
How long analytics data is kept
PostHog keeps events for 1 year and session recordings for up to 30 days on my current plan. After that they may be permanently deleted.
Session recordings
Only if you accept analytics, PostHog records how you use the pages: mouse movements, clicks, scrolling, and page changes, so I can replay a visit and find usability problems. Recordings shorter than 2 seconds are discarded.
Masking happens in your browser before anything is sent. Every input field is masked, including the contact form and the chat input, and so is the text of chat messages. Page text and layout stay visible. Recordings include the address and timing of each network request the page makes, without request or response headers or bodies. Names, email addresses, and messages are removed from every recorded address. Console logs and canvas content are not recorded.
Recordings are kept for up to 30 days. Legal basis: your consent (Art. 6(1)(a) GDPR).
Chat assistant
The chat assistant answers questions about my work and services. When you send a message, the site’s server forwards it to Anthropic, whose model Claude writes the reply. Your messages and the replies are stored as a session in my Anthropic account, which I can access. I delete chat sessions after 30 days. Anthropic doesn’t use them to train its models. If a conversation is flagged under Anthropic’s usage policy, Anthropic may keep it for up to 2 years for safety reviews.
Anthropic stores the data in the United States and may process it in other countries where it operates. The EU Standard Contractual Clauses in Anthropic’s data processing addendum protect this transfer.
Please don’t share sensitive personal data in the chat, such as health information or passwords. If you ask the assistant to prepare a message for me, it can open the contact form prefilled with your name, email address, and a summary. Nothing reaches me until you send the form.
For analytics the site records metadata about the chat, never the text: when you open, close, expand, or reset it, how many messages you send, the length of messages and replies in characters, response times and failures, links you click in replies, and a random conversation ID that changes with every new chat. The site’s server also records one event per message with the request status, response time, and message length. If you accepted analytics, these events are linked to your analytics ID and session. Otherwise they are anonymous.
Legal basis: my legitimate interest in answering your questions and in operating and securing the chat (Art. 6(1)(f) GDPR).
Contact form
When you send the contact form, your name, email address, and message go to Web3Forms, which emails them to me at hello@krolmic.dev. My mailbox is hosted by Google Workspace. Web3Forms keeps submissions on its servers for at most 3 years and may pass your IP address and email address to the spam filters CleanTalk and Akismet.
The contact page loads the Web3Forms script, which loads hCaptcha from Intuition Machines, Inc. to keep the form free of spam. To tell people from bots, hCaptcha analyses technical data such as your IP address, browser and device details, and how you interact with the page (mouse movements, scrolling, key presses).
I use your details only to reply to your message and, if we work together, to handle the project. I delete messages 12 months after our last exchange, unless they lead to a contract. Then I keep them for as long as the law requires me to keep business records.
Legal basis: steps you ask me to take before a possible contract (Art. 6(1)(b) GDPR). For the spam protection, my legitimate interest in keeping the form free of spam (Art. 6(1)(f) GDPR).
Cookies and storage
The site stores the items below in your browser. Essential items are
needed for features you use and are set without asking. Analytics
items only exist after you accept analytics and are deleted when you
decline. In the names, <key> stands for the site’s
public PostHog project key.
| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
theme Local storage | Provider: krolmic.dev | Purpose: Remembers whether you chose the light or dark theme. | Category: Essential | Duration: Until you clear your browser storage |
krolmic_ Local storage | Provider: krolmic.dev | Purpose: Stores your analytics choice (accepted or declined), the version of the request you answered, and when you answered. | Category: Essential | Duration: Until you clear your browser storage or I ask again |
krolmic_ Local storage | Provider: krolmic.dev | Purpose: Excludes my own visits from analytics. Only set in my browser through a private switch, never for visitors. | Category: Essential | Duration: Until removed |
ph_ Cookie | Provider: PostHog (krolmic.dev) | Purpose: Random visitor ID, session ID, and analytics settings, so visits can be linked. | Category: Analytics | Duration: 1 year |
ph_ Local storage | Provider: PostHog (krolmic.dev) | Purpose: Copy of the cookie above, used by the PostHog script. | Category: Analytics | Duration: Until you decline or clear your browser storage |
_ Local storage | Provider: PostHog (krolmic.dev) | Purpose: Records that you allowed analytics. | Category: Analytics | Duration: Until you decline or clear your browser storage |
ph_ ph_ ph_ ph_ Session storage | Provider: PostHog (krolmic.dev) | Purpose: Keeps the analytics session and the session recording of the current browser tab together. | Category: Analytics | Duration: Until you close the tab |
_ Cookie | Provider: hCaptcha (hcaptcha.com) | Purpose: Bot detection for the spam protection on the contact form. Only set on the contact page. | Category: Essential | Duration: 30 minutes |
hCaptcha may set further cookies on its own domain, for example when you solve a challenge or use its accessibility option. They are listed in hCaptcha’s privacy policy.
Recipients and processors
These companies process personal data on my behalf. I don’t share your data with anyone else unless the law requires it.
| Recipient and purpose | Location | Agreement | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. Hosting, delivery, security, and server logs | Location: USA, worldwide network | Agreement: Data processing addendum, part of Cloudflare’s terms | Transfer safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses |
| PostHog, Inc. Analytics and session recordings | Location: Data stored in the EU (Frankfurt, Germany); US company | Agreement: Data processing agreement | Transfer safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses |
| Anthropic Ireland, Limited Replies of the chat assistant | Location: Data stored in the USA | Agreement: Data processing addendum, part of Anthropic’s commercial terms | Transfer safeguard: Standard Contractual Clauses |
| Web3Creative (Web3Forms) Delivery of the contact form | Location: India, with servers at AWS and Hetzner | Agreement: Data processing agreement, part of Web3Forms’ terms | Transfer safeguard: Standard Contractual Clauses |
| Intuition Machines, Inc. (hCaptcha) Spam protection on the contact form, integrated by Web3Forms | Location: USA | Agreement: hCaptcha’s terms and data processing agreement | Transfer safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses |
| Google (Google Workspace) Mailbox for hello@krolmic.dev | Location: Data centres worldwide | Agreement: Cloud data processing addendum | Transfer safeguard: EU-US Data Privacy Framework and Standard Contractual Clauses |
Your rights
Under the GDPR you have the right to:
- access the personal data I hold about you
- have incorrect data corrected
- have your data erased
- restrict how your data is processed
- object to processing based on legitimate interest, such as the cookie-free statistics and the chat assistant
- receive your data in a portable format
- withdraw your consent at any time, without affecting processing before the withdrawal
To use any of these rights, email
hello@krolmic.dev. I answer
within one month. Analytics data contains no name or email address,
so to find data from accepted analytics I may need the random ID from
the ph_<key>_posthog cookie. Cookie-free
statistics can’t be linked to you at all.
You also have the right to complain to a data protection authority, in particular the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the authority in the country where you live or work.
External links
The site links to other services: the Apple App Store and Google Play, my profiles on LinkedIn, GitHub, YouTube, and Medium, and share links for LinkedIn, X, and Bluesky. Nothing is loaded from these services until you follow a link. Once you do, that provider’s privacy policy applies.
Changes to this policy
I update this policy when the way the site handles data changes. The date at the top shows the latest update. If a change needs your consent again, the banner asks you again.