Who is responsible for your data
The data controller is Nelson Jeronimo, an independent product designer based in Quarteira, Algarve, Portugal. For anything about personal data: nvjeronimo@gmail.com.
What data I collect
Project form: name, email, company, phone and current website (these three optional), project type, approximate budget, the message you write and a record that you accepted this policy.
Emails you send me directly, with whatever you choose to include.
WhatsApp messages: your number, profile name and the content of the messages you send me.
Server logs: like any web server, the hosting provider logs the IP address, date and time, the page requested and the browser, so the site works and stays secure.
Usage statistics, only if you accept cookies: pages viewed, where the visit came from, device, browser and approximate location, via Google Analytics (see the Cookie Policy).
Anonymous form counts: I count how many times each step of the form is reached and how many briefs are sent, as daily totals only. It uses no cookies and keeps nothing about who fills it in.
Form draft: what you type is kept in your own browser until you send it or choose “Start again”, so you do not lose it if you leave the page. It never leaves your device.
Domain ideas: if you say you do not have a website yet, the suggested domain names (and only those names) are looked up in the public domain registration services to see whether they look free.
Request management and newsletter (when available on the site): the requests sent through the form (name, email, company, project type, budget and language) are also recorded in Brevo (Sendinblue SAS, France), the tool I use to follow up on requests. Being in that record does not subscribe you to anything. You only receive news, campaigns and new services if you subscribe to the newsletter (in the footer or through the option in the form) and confirm in the email you are sent. Every email carries an unsubscribe link, and you can ask me at any time to delete your data.
AI assistant (when available on the site): the question you type and the earlier answers of that conversation are sent to Anthropic (the provider of the AI model, based in the USA), only to generate the answer. On this site, each question and the start of the answer are kept for 90 days, without your IP address, name or email, so I can see what people look for and improve the answers; an anonymous identifier that changes every day is kept too, and it cannot tell who you are or follow you from one day to the next. Do not enter personal data in the assistant. If you go from the assistant to the contact form, the conversation goes with the brief (you can remove it before sending) and is handled like the rest of the form.
Spam protection: when you submit the form, your IP address is used temporarily and in hashed form (a digest, not the plain IP) for about 10 minutes to limit repeated submissions.
I do not ask for or want sensitive data (health, origin, beliefs, etc.). Please do not include it in your message.
Why I use the data and on what basis
Replying to your request and preparing a proposal: steps taken at your request before a contract (Article 6(1)(b) GDPR).
Delivering the project if we go ahead: performance of a contract (same point b) and legal obligations such as tax (point c).
Keeping the site secure and preventing abuse: legitimate interest (point f).
Site usage statistics: your consent (point a), which you can withdraw at any time.
I do not use your data for marketing without your consent, I do not profile you and I never sell data.
Who I share it with
Only with the providers that make this work: the hosting provider (site, email and sending the form), Google (Gmail, where I receive and keep emails, and Google Analytics if you accept cookies) and WhatsApp/Meta, if you choose to message me on WhatsApp.
These providers may process data outside the European Economic Area. Where they do, the transfer relies on GDPR safeguards such as the European Commission standard contractual clauses or the EU-US Data Privacy Framework.
I may have to share data with authorities where the law requires it.
How long I keep the data
Requests that do not become a project: up to 2 years after our last contact, then deleted.
Clients: for the duration of the project and afterwards only what is needed to meet legal obligations (for example, invoicing records for the statutory period).
Server logs: for the short period set by the hosting provider.
Google Analytics statistics: up to 14 months.
Your rights
You can ask for access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interest.
Just write to nvjeronimo@gmail.com. I reply within one month at the latest.
If you think your data has not been handled properly, you can complain to the Portuguese data protection authority (CNPD) at www.cnpd.pt.
Security
The site is served over HTTPS only, has no public database or login area, and access to hosting and email is protected. No system is infallible, but I treat your data with the care I would want for mine.
Changes to this policy
If this policy changes, I will update this page and the date at the top.
