Privacy Policy
In short: I do not trade your data. Analytics are privacy-first. Tracking pixels load only after your consent. Everything I store is needed to run the site or to respond to you.
1. Who processes the data
The data controller is Andrew Maryasov, AI consultant, contact: hello@amaryasov.expert. The site amaryasov.expert is hosted on Cloudflare Workers (EU region).
2. What data I collect
2.1 Automatically (without any action from you)
- IP address — used for the technical operation of the site, temporarily stored in Cloudflare logs. Not stored in my database.
- User-Agent, Referer — to understand the type of device and the traffic source.
- Anonymous Umami metrics — server-side, no cookies, with IP anonymization. Requires no consent (privacy-first analytics).
2.2 Tracking pixels (only with your consent)
By default, pixels do not load. They activate after acceptance in the cookie banner:
- Google Tag Manager + Google Analytics 4 — behavior statistics.
- Meta (Facebook) Pixel — for retargeting on Facebook/Instagram if you came from an ad.
- LinkedIn Insight Tag — for retargeting on LinkedIn.
For details, see the Cookie Policy.
2.3 Data you provide knowingly
- Contact form (`/contact/`): name, email, optionally — message, budget, role. I send it to myself on Telegram + store it in Cloudflare D1.
- Blog subscription: email only. Stored in Cloudflare D1.
3. Legal grounds for processing (GDPR Art. 6)
- Consent (Art. 6(1)(a)) — for tracking pixels and marketing emails.
- Contract (Art. 6(1)(b)) — for the discovery call and project communication.
- Legitimate interest (Art. 6(1)(f)) — privacy-first analytics (Umami), spam protection.
4. How long I keep it
| Data type | Period |
|---|---|
| Cloudflare logs | 30 days (Cloudflare standard) |
| Umami metrics | 365 days, aggregated |
| Contact forms (D1) | 2 years or until a deletion request |
| Email subscription | Until unsubscribe (1 click) |
| GA4 / FB / LinkedIn cookies | Per platform settings (usually 13 months) |
5. Who I share data with
- Cloudflare (US/EU) — hosting + DDoS protection. Data Processing Agreement in force.
- Google (with consent) — GA4 / GTM. Standard Contractual Clauses.
- Meta / LinkedIn (with consent) — retargeting.
- Telegram — messages from the contact form (private chat).
I do not sell your data to third parties. I do not hand it to government authorities without a court order.
6. Your rights (GDPR Art. 15–22)
- Right of access — get a copy of your data.
- Right to rectification — update inaccurate data.
- Right to erasure (right to be forgotten).
- Right to restrict processing.
- Right to portability — get your data in a machine-readable format.
- Right to object — in particular to direct marketing.
- Right to withdraw consent at any time.
To exercise these, write to hello@amaryasov.expert. I respond within 7–14 days (the GDPR standard is 30).
7. Security
- HTTPS-only (TLS 1.3, HSTS).
- Cloudflare WAF + bot mitigation.
- D1 database — encrypted at rest.
- Backend access — only via wrangler with 2FA.
8. Cookies
Details are in a separate Cookie Policy. In short: no tracking cookies without your consent. Strictly necessary ones (CSRF, form session) work without consent, but they do not identify you.
9. Children
The site is not intended for persons under 16. I do not knowingly collect data about children.
10. Changes to the Policy
If anything changes, I will update this page and put a new date at the top. If the changes are material (new data recipients, new purposes), I will notify email subscribers and show a banner on the site for 30 days.
11. Complaints
If you believe I have violated your rights, contact the regulator:
- 🇺🇦 Ukrainian Parliament Commissioner for Human Rights — ombudsman.gov.ua
- 🇪🇺 Any Data Protection Authority in your EU country.
This document is written as plainly as possible, but it is legally correct. If anything is unclear, write to me and I will explain it without legalese.