Who is responsible
I am the data controller for this site. That means me personally, not a company:
- Sebastian Gabriel Patrascu
- Algarve, Portugal
- sebigabip@gmail.com
I don't have a Data Protection Officer — a one-person portfolio isn't required to appoint one. Email is the way to reach me about anything on this page.
What I collect, and why
When you just read the site
I want to know which pages people actually read and where they get stuck. Two tools do that, and they behave differently depending on whether you accepted cookies:
- Google Analytics 4 counts visits and page views. It isn't loaded at all unless you accept analytics cookies. If you decline, or haven't answered yet, no request is ever made to Google Analytics and it receives nothing about you — not even your IP address.
- Microsoft Clarity records how people move through pages (scrolling, clicks, mouse movement) and builds heatmaps. This one does run whether or not you accept, but in two very different modes. See the next section — I'd rather be blunt about it than bury it.
Clarity without your consent. If you decline, Clarity sets no cookies and gives you a fresh, random ID on every single page view. So the data can't be joined up: page two isn't linked to page one, today isn't linked to next week, and there's nothing to build a profile from. It does still send Microsoft the page address, your IP address, your browser and device details, and what you did on that one page.
I rely on legitimate interest (Article 6(1)(f) GDPR) for that, on the basis that unlinkable single-page records are a low-impact way to see how the site is being used. If you'd rather not be included at all, you have an absolute right to object — see your rights below.
If you do accept, Clarity switches to full mode: it sets cookies, links your page views into one session, and I can watch a replay of that session.
When you send me a message
The contact form collects your name, email address and your message. It's delivered to my inbox by StaticForms, which processes it on my behalf. I use it to reply to you. Nothing more — you won't get a newsletter, and I won't pass your details on.
The form is protected by Google reCAPTCHA v2, which looks at how you interact with the page to decide whether you're a bot. It loads when the contact section scrolls into view, before you've submitted anything, and it works this way whether or not you accepted cookies — without it the form gets buried in spam. Google's privacy policy and terms apply to that.
Things I never collect
- No accounts, so no passwords.
- No payments, so no card details.
- No advertising, no ad profiling, and nothing is ever sold or shared for ads.
- Nothing in a special category — health, beliefs, and so on.
Legal bases, one row at a time
GDPR requires a specific lawful basis for each thing I do, not one blanket answer:
| What | Basis |
|---|---|
| Google Analytics, and Clarity in full mode (cookies, sessions linked together) | Consent — Art. 6(1)(a). Nothing runs until you click accept, and you can take it back at any time. |
| Clarity in restricted mode (no cookies, one unlinkable record per page view) | Legitimate interest — Art. 6(1)(f). Understanding how the site is used, balanced against the fact that nothing identifies or follows you. |
| reCAPTCHA on the contact form | Legitimate interest — Art. 6(1)(f). Keeping the form usable rather than spam-flooded. |
| Replying to a message you sent me | Legitimate interest — Art. 6(1)(f). You contacted me and presumably want an answer. |
| Remembering your cookie choice | Legitimate interest — Art. 6(1)(f), and strictly necessary under the ePrivacy rules. Not remembering it would mean asking you on every page. |
Who else sees it
I don't sell data and I don't share it with anyone for their own purposes. These are the services involved in running the site, and what each one gets:
| Service | What it receives | Where |
|---|---|---|
| Google (Analytics) | Page views, approximate location, device and browser — only with your consent | Ireland / United States |
| Microsoft (Clarity) | Page address, IP, device and browser, on-page interactions | United States |
| Google (reCAPTCHA) | Interaction signals from the contact page | United States |
| StaticForms | Your name, email and message, on submit | United States |
| Vercel (hosting) | Standard server request data, including your IP, in order to serve the page | United States / global edge network |
Several of these are outside the EEA. Those transfers rest on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, which are the mechanisms each provider publishes for the purpose. I have no separate agreement with any of them beyond their standard terms.
How long it's kept
- Google Analytics
- Retention is set to the shortest option Google offers for event data, currently 14 months.
- Microsoft Clarity
- Recordings and heatmaps are deleted by Microsoft after roughly 30 days.
- Contact form messages
- They sit in my email. I delete threads once the conversation has clearly finished, and you can ask me to delete yours sooner.
- Your cookie choice
- Stored in your own browser for 180 days, then it expires and you're asked again. It never reaches a server.
Your rights
Under GDPR you can ask me to:
- Access — tell you what I hold about you.
- Rectify — correct it if it's wrong.
- Erase — delete it.
- Restrict — stop using it while something is being sorted out.
- Object — refuse processing based on legitimate interest. That's the one that covers restricted-mode Clarity and reCAPTCHA.
- Port — hand it over in a machine-readable form.
- Withdraw consent — at any time, with no penalty. Use the button at the bottom of this page, or the “Cookie settings” link in the site footer.
Email sebigabip@gmail.com and I'll get back to you within a month, which is the deadline the regulation sets. Realistically it'll be faster.
Objecting to Clarity specifically
Turning the Analytics toggle off already stops the cookies and the session linking. To be excluded from Clarity entirely, including the restricted mode, use Microsoft's own opt-out: clarity.microsoft.com/optout. It works across every site that uses Clarity, not just mine. Emailing me works too — I'll handle it.
If you're not happy with how I've handled it
You can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at cnpd.pt, or to the authority where you live. You don't have to raise it with me first, though I'd appreciate the chance.
Other things worth saying
Fonts. The site loads the Inter typeface from Google Fonts, which means Google's servers see your IP address on every page load. No cookies are involved. I'd like to self-host this eventually.
Automated decisions. There's no profiling and nothing automated makes a decision about you. reCAPTCHA scores traffic for spam, but a low score doesn't lock you out of anything except the form, and you can always just email me.
Children. The site isn't aimed at children and I don't knowingly collect their data.
Changes. If I add a tool or change what's collected, I'll update the date at the top and ask for consent again where that's required. Small wording fixes won't trigger a fresh prompt.
For the exact cookie-by-cookie breakdown, see the cookie policy.