Privacy notice

1. Data controller

Hencz Norbert, a private individual. Postal address: 2800 Tatabánya, Béla Király krt. 49, Hungary. Email: [email protected]. Please use this email address for privacy questions or requests.

2. Data processed

When you submit the form, I process the name, email address, project type, project description and preferred contact method you provide. Company name, budget and target deadline are optional. The system also records the form language, submission time and the time consent was given.

To prevent abuse and repeated spam submissions, the server processes the request IP address and uses its SHA-256 hash for rate limiting. The raw IP address is not stored in the contact record. Old hashes are deleted when a later form submission is processed and they are more than two days old.

For administrator sign-in, Supabase Auth processes the account email address, the TOTP factor setup data and technical authentication data. During setup, the administrator scans the QR code or enters the secret setup key in an authenticator app; at sign-in, they enter the 6-digit code generated by that app.

3. Purposes and legal bases

Form data is used to review and answer your enquiry, continue any discussion you request and, when email is configured, automatically send the information entered in the form back to the submitted email address to confirm receipt. The legal basis is your consent under Article 6(1)(a) GDPR, given through the form checkbox. You may withdraw consent by email; withdrawal does not affect processing carried out before it.

Processing the hashed IP address to limit submissions is based on the legitimate interest in protecting the service and preventing spam under Article 6(1)(f) GDPR.

4. Retention

If an enquiry does not lead to a contract, I retain its form data for no longer than 12 months after the last substantive contact and then delete it. You may request earlier deletion unless data must be retained to establish, exercise or defend legal claims.

If a separate contract is made, data needed for the contract or a legal obligation is retained for the applicable period. Enquiry records are currently deleted manually by an administrator; automatic scheduled deletion is not configured.

5. Recipients and service providers

The website and server-side functions are hosted by Vercel Inc. The Supabase project that stores contact data is located in West EU (Ireland), AWS eu-west-1. Supabase Auth also handles administrator sign-in and TOTP authenticator factor data. During setup, the administrator scans the QR code or enters the secret setup key in an authenticator app; at sign-in, they enter the 6-digit code generated by that app. This region identifies the primary location of project data; it does not mean that all account, support, logging or security data is processed only there.

If the server-side email settings are active, Resend sends the full enquiry to the controller at [email protected] and [email protected], and sends an automatic confirmation to the submitted email address. The confirmation includes the information entered in the form and confirms receipt of the enquiry. Google’s Gmail service and the email provider associated with the submitted address may also process the messages as needed for delivery and storage. Retention in recipient mailboxes is governed by those providers’ terms and settings. Resend is involved only when the required server-side configuration is active. The actual region for Vercel server functions is controlled in the Vercel project settings and is not specified in this repository; it must be checked in the Vercel dashboard.

These providers act as processors to the extent required to operate the website. The source code does not include Google Analytics or Meta Pixel. If analytics or another tracker is enabled in the Vercel dashboard, this notice and any required consent flow must be updated accordingly.

6. Transfers and security

The primary storage location for Supabase project data is Ireland. Some technical, delivery or support operations by Vercel, Resend, Google or the email provider associated with the submitted address may take place outside the European Economic Area. In those cases, the providers’ privacy terms and applicable transfer safeguards apply. The actual Vercel function region and whether email notifications are enabled must be checked before launch.

Database access is protected by permissions, and administrative access requires authentication. The website uses HTTPS. Service providers maintain their own security and logging systems; technical log retention depends on the provider plan and settings.

7. Cookies and local storage

The website uses a hn-locale cookie to remember the selected language. It stores the light or dark theme choice in browser localStorage. The repository does not set advertising or analytics cookies.

8. Your rights

You may request information and access, rectification, erasure or restriction of processing; object to processing based on legitimate interests; and withdraw consent at any time. Send requests to the controller’s email address. I will respond without undue delay and generally within one month.

You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11; postal address: 1363 Budapest, Pf. 9; website: naih.hu. You may also seek a judicial remedy.

9. Automated decisions

No decision with legal or similarly significant effects is made solely by automated processing, and no profiling is carried out in connection with enquiries.

10. Changes to this notice

This notice will be updated if the website’s data processing, providers or technical settings materially change. The date at the top shows when it was last updated.