Privacy Notice

Who is responsible

The controller for the processing described here, in the sense of Art. 4(7) GDPR, is:

Name

SAI MVK Maddi

Email

sai@saimaddi.dev

I am based in Germany, so the GDPR governs this processing regardless of which country you are visiting from.

What this site does not do

So that it does not have to be inferred from the rest of this page, stated plainly. This site has no analytics of any kind, no tag manager, no advertising or tracking pixels, no social media embeds, no A/B testing, no session recording, no fingerprinting and no profiling or automated decision-making in the sense of Art. 22 GDPR.

It sets no cookies. There is no cookie banner because there is nothing to ask you about — see “Storage in your browser” below.

Hosting and server logs

The site is hosted on Firebase Hosting, operated by Google, acting as a processor under Art. 28 GDPR.

Like any web server, it records a log entry when your browser requests a page. Such an entry typically contains your IP address, the date and time, the page or file requested, the HTTP status, and the user agent and referrer your browser sends. I do not use these logs to build profiles and do not combine them with any other data.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is operating the site securely and reliably, and being able to investigate faults and abuse. These logs stay with the hosting provider: they are not exported into any system I control, I cannot read individual entries, and Google deletes them on its own schedule.

Storage in your browser

Two values are stored on your device. Neither is a cookie, neither is sent to any server, and neither identifies you.

portfolio-theme

localStorage. Remembers whether you chose the light or dark theme, so the site does not flip back every time you open it. Stays until you clear your browser storage.

portfolio-intro-seen

sessionStorage. Records that you have already seen the opening animation, so it does not replay on every page view. Discarded when you close the tab.

Both exist only to deliver the site as you asked for it, so they fall under the exception in § 25(2) no. 2 TDDDG and do not require consent. That is why you are not being shown a cookie banner: a banner for a theme preference would be asking you to consent to something that needs no consent.

You can remove both at any time with the button below, or by clearing site data for this domain in your browser settings. The site will simply forget your theme choice and play the intro again.

Fonts and other assets

Every font, image, icon and script this page needs is served from this domain. Nothing is fetched from a content delivery network, a font service or any other third party.

This matters specifically for fonts. Embedding fonts from a third-party service causes your browser to contact that service and disclose your IP address before you have interacted with the page at all. The four typefaces used here are licensed under the SIL Open Font License 1.1 and are served as files from this origin, so no such request happens.

Links to other sites

The site links out to LinkedIn, to a Google Calendar booking page, and to two sites of my own, gdpr.saimaddi.dev and agentsafeguard.saimaddi.dev. These are ordinary links: nothing is requested from them and no data reaches them unless you click, at which point you leave this site.

gdpr.saimaddi.dev and agentsafeguard.saimaddi.dev are separate sites that I also run. Each sets no cookies, loads nothing from third parties and has its own privacy notice. The others are operated by their providers, whose own privacy policies apply once you arrive.

I have no control over what the third-party providers do with your data and am not responsible for their content or their processing.

If you email me

If you contact me by email, I receive whatever you put in the message, including your address and any signature. Mail for this domain is routed by Cloudflare Email Routing, which acts as a processor in delivering it.

Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in answering enquiries addressed to me, or Art. 6(1)(b) GDPR where your message concerns entering into a contract or an employment relationship. I keep correspondence for as long as needed to deal with it and to meet any retention obligations that apply, then delete it.

Transfers outside the EEA

The providers named above — Google for hosting and Cloudflare for email routing — are companies with United States parent entities and operate global infrastructure, so processing may involve a transfer to a third country within the meaning of Chapter V GDPR.

Both offer EU Standard Contractual Clauses under Art. 46(2)(c) GDPR as a safeguard for such transfers, and both are certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023.

Your rights

Where the GDPR applies to processing described here, you have the right to:

Art. 15

ask whether I hold personal data about you and obtain a copy

Art. 16

have inaccurate data corrected

Art. 17

have data erased

Art. 18

have processing restricted

Art. 20

receive data you provided in a portable format

Art. 21

object at any time, on grounds relating to your particular situation, to processing based on legitimate interest — which here means the server logs

There is no consent to withdraw, because nothing here relies on consent.

To exercise any of these, email the address above. If you believe the processing breaches data protection law, you also have the right under Art. 77 GDPR to complain to a supervisory authority — in the EEA, the one for your country of residence, place of work, or the place of the alleged infringement.

List of European data protection authorities

Changes to this notice

If the site changes in a way that affects any of the above, this page is updated and the date at the top changes with it. There is no mailing list, so there is no notification to send.