Privacy Policy

In short: I do not trade your data. Analytics are privacy-first. Tracking pixels load only after your consent. Everything I store is needed to run the site or to respond to you.

1. Who processes the data

The data controller is Andrew Maryasov, AI consultant, contact: hello@amaryasov.expert. The site amaryasov.expert is hosted on Cloudflare Workers (EU region).

2. What data I collect

2.1 Automatically (without any action from you)

• IP address — used for the technical operation of the site, temporarily stored in Cloudflare logs. Not stored in my database.
• User-Agent, Referer — to understand the type of device and the traffic source.
• Umami metrics — server-side, no cookies, with IP anonymization. Until you submit a request, I don't know who you are; the request then carries the pages of this site you viewed in the last 30 days and where you came from (see the Cookie Policy).
• UTM tags — if you followed a link with UTM tags (for example, from YouTube or a newsletter), I store the traffic source together with your request: utm_source, utm_medium, utm_campaign, utm_content, utm_term. This shows me which channels bring enquiries.

2.2 Tracking pixels (only with your consent)

By default, pixels do not load. They activate after acceptance in the cookie banner:

• Google Tag Manager + Google Analytics 4 — behavior statistics.
• Meta (Facebook) Pixel — for retargeting on Facebook/Instagram if you came from an ad.
• LinkedIn Insight Tag — for retargeting on LinkedIn.

For details, see the Cookie Policy.

2.3 Data you provide knowingly

• Contact form (`/contact/`): name, email, optionally — message, budget, role. I send it to myself on Telegram + store it in Cloudflare D1.
• Blog subscription: email only. Stored in Cloudflare D1.

3. Legal grounds for processing (GDPR Art. 6)

• Consent (Art. 6(1)(a)) — for tracking pixels and marketing emails.
• Contract (Art. 6(1)(b)) — for the discovery call and project communication.
• Legitimate interest (Art. 6(1)(f)) — privacy-first analytics (Umami), spam protection.

4. How long I keep it

5. Who I share data with

• Cloudflare (US/EU) — hosting + DDoS protection. Data Processing Agreement in force.
• Google (with consent) — GA4 / GTM. Standard Contractual Clauses.
• Meta / LinkedIn (with consent) — retargeting.
• Telegram — messages from the contact form (private chat).

I do not sell your data to third parties. I do not hand it to government authorities without a court order.

6. Your rights (GDPR Art. 15–22)

• Right of access — get a copy of your data.
• Right to rectification — update inaccurate data.
• Right to erasure (right to be forgotten).
• Right to restrict processing.
• Right to portability — get your data in a machine-readable format.
• Right to object — in particular to direct marketing.
• Right to withdraw consent at any time.

To exercise these, write to hello@amaryasov.expert. I respond within 7–14 days (the GDPR standard is 30).

7. Security

• HTTPS-only (TLS 1.3, HSTS).
• Cloudflare WAF + bot mitigation.
• D1 database — encrypted at rest.
• Backend access — only via wrangler with 2FA.

8. Cookies

Details are in a separate Cookie Policy. In short: no tracking cookies without your consent. Strictly necessary ones (CSRF, form session) work without consent, but they do not identify you.

9. Children

The site is not intended for persons under 16. I do not knowingly collect data about children.

10. Changes to the Policy

If anything changes, I will update this page and put a new date at the top. If the changes are material (new data recipients, new purposes), I will notify email subscribers and show a banner on the site for 30 days.

11. Complaints

If you believe I have violated your rights, contact the regulator:

• 🇺🇦 Ukrainian Parliament Commissioner for Human Rights — ombudsman.gov.ua
• 🇪🇺 Any Data Protection Authority in your EU country.

This document is written as plainly as possible, but it is legally correct. If anything is unclear, write to me and I will explain it without legalese.