Privacy policy

Who processes your data

What data, and why

• Contact form: your name, your email, the project type, your message and, if you provide them, your phone number, your company, your budget and your timeline. They reach me by email and are used to reply to your request. They are kept for as long as needed to deal with it and, if a contract follows, for the legal retention period. Your name, your company, your email and your message are also used for the checks described in the next point; the server log, however, keeps none of it. The project type and budget are also counted in the visit statistics, without your name, your email or your message.
• Call request: your name, your phone number or your email (at least one of the two), when you would like to be called back and, if you provide it, the subject of the call. They reach me by email and are used to get back to you to arrange the call; if you provide your email, an acknowledgement is sent to you, with none of what you entered. They are kept for as long as needed to deal with your request. Your name, your phone number, your email and your subject are also used for the checks described in the next point; the server log, however, keeps none of it. The time you choose is also counted in the visit statistics, without your name, your phone number, your email or your subject.
• Form checks: these apply to the contact form and to the call request. To limit submissions to 5 per hour and per IP address, for each form, the server notes your IP address (in IPv6, only its first half, which identifies your network) and the time of each submission, and erases each note one hour after the submission: your IP address disappears one hour after your last submission. To send only one acknowledgement per email address within 24 hours, across both forms together, it notes your email and the time of the acknowledgement, and erases them 24 hours after the acknowledgement. To avoid sending the same request twice within 10 minutes, it notes your email and your message (for a call request: your name, your phone number, your email, the time and the subject), and erases them 10 minutes after the submission. Before forwarding your request, it asks the DNS whether the domain of your address (the part after “@”), if you provided it, can receive emails: only the domain is queried, and the answer is kept for 10 minutes. Your message, or the subject of your call request, is also automatically checked, along with your name, for signs of an unwanted message (links to four sites or more, a link in the name, words typical of spam): a message flagged this way still reaches me, but without an acknowledgement. To recognise a submission too fast for a human, your browser sends the time spent on the page before submitting, which it measures itself; this is not kept. These notes are used only for these checks: they stay in the server’s memory and are written neither to a database nor to a file.
• Server log: the server writes a line to its log when a submission fails to send (the email forwarding your request, the acknowledgement, your audit or its copy, the newsletter confirmation or welcome email, your sign-up with Infomaniak), with the error code from the service concerned, when an email isn’t sent because a limit has been reached or the message looks unwanted, when a submission is rejected by the anti-robot protection, and when a newsletter confirmation link is refused (expired or altered). The website doesn’t record any form field there, nor your email address. This log is used solely to spot and fix faults.
• Visit statistics: pages viewed, country, device type and browser, measured with no cookies and no personal identifier. A few actions are counted the same way: a click on a “Request a call” button, on a button or link of the free audit, on the phone number or the email address (with the location on the page), a call request sent (with the time chosen, without your name, your phone number, your email or your subject), a form submitted (with the project type and budget chosen, without your name, your email or your message), the start of an audit, an area passed, its end (with the areas chosen and passed, without your answers) and the audit sent by email, a Guide post shared (with the network chosen, or the link copied), a language change (with the language left and the language chosen) or a theme change (with the theme chosen).
• Display preference: the light or dark theme you choose is kept in your browser (localStorage). When you change it, that change is counted in the visit statistics, with the theme chosen.
• Reading position: when you leave a page, where you had got to is kept in the open tab (sessionStorage), with the page address, to bring you back to it if you reload the page or return to it. It disappears with the tab.
• Guide newsletter: you sign up to the Guide at the bottom of a post, in the footer, or with the audit’s checkbox, and you receive the Guide every Tuesday and the newsletter, the essentials of the month, once a month. Signing up happens in two steps. First, the website sends you a confirmation email, through Infomaniak’s email server, in Switzerland: its link carries your email, where you signed up and the time of the request, encrypted (they cannot be read in the address), and it expires after 72 hours. Until you click it, nothing is registered. On clicking, your email is registered with Infomaniak, our processor in Switzerland, with where you signed up and the date of your confirmation, as proof of your consent; a welcome email follows. Every issue has its own unsubscribe link: one click is enough, and you receive nothing further. After you unsubscribe, Infomaniak keeps your address marked “unsubscribed”, so as not to write to you again; write to me to have it erased completely. Issues have no tracking pixel, and Infomaniak counts neither opens nor clicks; their links carry campaign tags (utm_source, utm_medium, utm_campaign), counted in the visit statistics, with no cookie. To limit requests to 5 per hour and per IP address, the server notes your IP address (in IPv6, only its first half) and the time of the request in its memory, as for the contact form, and erases them an hour later. To avoid sending more than 2 confirmation emails or more than one welcome email to the same address within 24 hours, it notes your email and the time of sending, and erases them 24 hours later; to avoid resending the same request within 10 minutes, it notes your email, and erases it 10 minutes later. Before sending, it checks that the domain of your address can receive emails, as for the contact form. As for the contact form, your browser sends the time spent on the page before submitting, to recognise a robot; this is not kept. To avoid registering the same link twice, the server keeps the identifier of links already confirmed for 72 hours, with nothing personal; to limit the lines that refused links write to the log, it notes your IP address and the time of a refused link, and erases them an hour later.
• Sharing a Guide post: the share buttons are simple links to WhatsApp, LinkedIn, Facebook, X or your email client: no script from these services is loaded on the website. What happens next is up to the service you choose.
• Free express audit: the result is calculated in your browser or, without JavaScript, on the website’s server, which keeps none of it. If you request your audit by email, your email, your answers and your website address, if you provide it, are used to send it to you and to prepare for a possible call; Flavio Di Tria receives a copy, the only one to include your website address. Sending goes through Infomaniak’s email server, in Switzerland. Nothing is stored in a database: the emails stay in Flavio Di Tria’s inbox. To limit requests to 5 per hour and per IP address, and to avoid processing the same request twice within 10 minutes, the server notes your IP address, your email and your answers in its memory, as for the contact form, and erases them an hour or 10 minutes later. To avoid sending more than 3 audits to the same address within 24 hours, it notes your email and the time of sending, and erases them 24 hours later. Before sending, it also checks that the domain of your address can receive emails, as for the contact form. As for the contact form, your browser sends the time spent on the page before submitting, to recognise a robot; this is not kept. If you tick the Guide’s checkbox, the newsletter confirmation email is also sent: see “Guide newsletter”. The start of an audit, an area passed, its end and the email being sent are also counted in the visit statistics, without your answers.

Service providers

Cookies

This website does not set any tracking cookies.

Your rights

You can ask to access, correct or erase your data, or object to its processing, by writing to hello@dontpaniclabs.ch. You can also contact the Federal Data Protection and Information Commissioner (FDPIC).

Security

The website is served over HTTPS and hosted in Switzerland. Access to processing tools is protected and restricted.