Your data, in plain English.

Who I am

This site is run by eloi — a solo freelance designer + full-stack developer. If you need to reach the site owner about your data, use the chat bubble at the bottom-right of any page.

What I collect + why

• When you use the chat widget or booking form: your name, your email, the messages you send, and (optionally) scoping info like project needs, timeline, and budget. I use this to reply to you and understand your project. Legal basis: legitimate interest in responding to your inquiry.
• A random visitor ID cookie (eloi_vid): lets you reopen the same chat thread across sessions and devices. It doesn't contain your name or email. Legal basis: strictly necessary.
• Preference cookies (eloi_market_pref, eloi_privacy_v1, inbox_muted): remember your currency preference, cookie-banner choice, and inbox mute state. Legal basis: necessary for the feature you asked for.
• Server logs (temporary): IP address + user agent + request path, retained ~30 days for abuse prevention and debugging. Legal basis: legitimate interest.
• I don't collect: analytics tracking cookies, marketing pixels, ad IDs, cross-site trackers, or anything a big analytics tool would set.

Who processes your data (subprocessors)

These are the services I use to run the site. Each has their own privacy policy.

• Vercel — hosting + edge network. USA + regional edges. privacy policy
• Supabase — database for your chat messages + preferences. USA. privacy policy
• Resend — sends the email confirmations + owner-reply notifications. USA. privacy policy
• Cal.com — booking calendar. USA. Only involved if you book a call. privacy policy
• Clerk — auth for the private owner inbox. Doesn't touch visitor data. privacy policy
• Cloudflare — DNS + CDN for eloi.works. privacy policy

For the formal GDPR Article 28 disclosure (with region + purpose + DPA links per subprocessor), see the dedicated Sub-processors page. If you're an EU visitor and need a signed Data Processing Agreement (DPA), ping me in the chat and I'll countersign one.

How long I keep things

• Chat conversations: kept until you request deletion, or 3 years after your last message (whichever comes first)
• Booked calls: kept in Google Calendar as long as they're relevant
• Server logs: ~30 days rolling
• Cookies: browser-side, expire per the cookie's stated duration

Your rights (GDPR + general)

You have the right to:

• Access — ask what data I hold about you (I'll send a JSON dump within 30 days)
• Correct — ask me to fix data that's wrong
• Delete — ask me to remove your data (I'll purge within 30 days unless legally required to keep it)
• Export — receive your data in a portable format (JSON)
• Object — tell me to stop processing your data for a specific purpose
• Complain — file a complaint with your local data protection authority

To exercise any of these, message me in the chat with the subject “privacy request” and I'll respond within 30 days.

Security

Cookies are httpOnly + Secure + SameSite=Lax where applicable. Data in transit uses TLS 1.2+. Passwords (owner auth only) are hashed via industry-standard algorithms. The site is scanned pre-launch against OWASP Top 10 and audited quarterly.

Changes to this policy

If I change how I handle your data, I'll update this page and bump the “last updated” date. Major changes will also be flagged in the chat for anyone with an active conversation.

Contact

Ping me in the chat bubble at the bottom-right of any page. Response within a business day.