Privacy policy

Who is responsible

I’m Alexandru Gurau, a product designer based in Romania, and I run this site myself. I’m the controller of the personal data described here: I decide why and how it is processed. You can reach me at hello@alexandrugurau.com.

I haven’t appointed a data protection officer: the law doesn’t require one for a site like this.

What this policy covers

This policy covers alexandrugurau.com: its public pages, emails you send me at the address it shows, and the private admin area where I edit the site. It follows the EU General Data Protection Regulation (GDPR) and Romanian data protection law.

When you follow a link to another site, such as GitHub, Nottral or Nodbit, that site’s own privacy policy applies. Nothing is sent to it until you click. Then your browser connects to it as to any site you visit, and tells it at most that you came from alexandrugurau.com, not which page you were on.

When you visit the site

A website can only send you a page when your browser asks for it, and every request carries some information. My hosting provider, Vercel, receives it and keeps it in request logs:

Purpose: to deliver the pages to you and to keep the site secure and working, for example to block attacks or find the cause of an error.

Legal basis: my legitimate interest in running a secure, available website (GDPR Article 6(1)(f)). Your browser can’t load the site without sending this request. No law or contract requires you to give me anything else to read it.

Retention: the request logs available in my Vercel account are kept for one day at most. Vercel also keeps operational and security logs of its own, as a controller in its own right, for as long as it needs them; Vercel’s privacy notice explains how.

I don’t use these logs to identify visitors or to build profiles. I only look at them when something breaks or looks like an attack.

Fonts and images are served from this site’s own address, so loading a page doesn’t make your browser contact Google, Cloudinary or anyone else. There are no embedded videos, maps or social media widgets.

When you email me

If you write to hello@alexandrugurau.com, I receive your email address, your name if you include it, your message and any attachments, and the details every email carries, such as the time it was sent.

Purpose: to read your message, reply, continue the conversation, and have its context if we talk again later.

Legal basis: my legitimate interest in answering people who write to me, for example about a job (GDPR Article 6(1)(f)). If you ask me to take steps towards a contract between you personally and me, the basis is that request (Article 6(1)(b)).

Writing to me is up to you, and you decide what to include. Please leave out anything the conversation doesn’t need, such as identity documents or health information.

Retention: I keep a conversation for up to two years after its last message, then delete it. If it leads to working together, I keep what that work needs while it lasts, and afterwards only what the law requires me to keep, such as tax and accounting records, for as long as it requires.

My mailbox is hosted by Proton AG in Switzerland (see Service providers).

The private admin area

The site has a private area where I edit the case studies. Only I can sign in. It isn’t linked from the site, but its sign-in page can be reached by anyone, so this section applies to anyone who tries to sign in.

Purpose: to block password guessing. When someone submits the sign-in form, the site stores the IP address the attempt came from, a count of recent attempts and when the count started. After 5 failed attempts within 15 minutes, that address is locked out for 15 minutes. The email address and password typed in are not stored.

Legal basis: my legitimate interest in keeping unauthorised people out of the site (GDPR Article 6(1)(f); Recital 49 names network and information security as such an interest).

Retention: each record is deleted automatically about 30 minutes after the last attempt from that address (the database can take up to a minute longer), or straight away after a successful sign-in. It is stored in the site’s database at MongoDB Atlas.

When I sign in, the site sets two cookies for me (see Cookies and browser storage) and keeps a record of my session in the database for up to 7 days. These concern only me.

Cookies and browser storage

The public site sets no cookies, and neither does my hosting provider. Apart from your browser’s ordinary cache of the pages, fonts and images, a visit stores nothing on your device.

One exception, which you control: if you press the light and dark mode toggle, your browser saves your choice in its local storage, so the site remembers it on your next visit.

Name

“theme”

Value

“light”, “dark” or “system” (follow your device’s setting)

Saved

Only when you press the toggle. Until then the site follows your device’s setting and stores nothing.

Sent to

Nowhere. It stays in your browser and is never sent to a server.

Kept

Until you remove it, by clearing this site’s data in your browser’s settings.

EU and Romanian law treat local storage like cookies: a site may store something on your device without asking first only when it is strictly necessary for a service you explicitly asked for (ePrivacy Directive 2002/58/EC, Article 5(3); Law 506/2004, Article 4). Remembering the theme you chose is exactly that: a setting you ask for, used only to show the site the way you chose, never to recognise or track you. That is why there is no cookie banner: there is nothing to ask your consent for.

The admin area uses two cookies, set only after I sign in: admin_access (15 minutes) and admin_refresh (7 days). They keep me signed in, which is all they are for, so they are strictly necessary, and they are only sent to the admin area. Scripts can’t read them and other sites can’t make your browser send them (HttpOnly, Secure, SameSite=Strict). Visitors never receive them.

Service providers

A few companies handle data for this site. Each receives only what its job needs.

Apart from these, I pass personal data on only if you ask me to, or when the law requires it, for example to answer a valid order from a court or an authority.

What I don’t do

Transfers outside the EU

Vercel Inc. and MongoDB, Inc. are US companies, so data they handle may be processed in, or accessed from, the United States. These transfers rely on the EU–US Data Privacy Framework: in Implementing Decision (EU) 2023/1795, the European Commission decided that companies certified under it protect personal data adequately. Vercel Inc. and MongoDB, Inc. were both listed as active participants on 19 October 2026.

You can check a company’s current status on the Data Privacy Framework list. For MongoDB there is a second safeguard: the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914), part of MongoDB’s data processing agreement, which anyone can read.

Proton stores email in Switzerland, Germany or Norway. Germany and Norway are in the European Economic Area, and Switzerland has an EU adequacy decision of its own (Decision 2000/518/EC).

How long data is kept

Request logs

One day at most in my Vercel account; Vercel’s own logs as its privacy notice describes

Emails

Up to two years after the last message, unless we work together

Sign-in attempts

About 30 minutes after the last attempt

My admin sessions

Up to 7 days

Requests to use your rights

A short record of the request and my answer, for 3 years after I answer

Theme choice

In your browser, until you clear it

Your rights

To use any of them, email hello@alexandrugurau.com. It’s free. I’ll reply within one month; if a request is complex I may need up to two more months, and I’ll tell you within the first month if so. If I can’t be sure a request comes from you, I may ask for a detail that confirms it, and nothing more.

To find you in the request logs I would need your IP address and the time of your visit, and those logs leave my account within a day.

I keep a short record of each request and my answer (who asked, for what, when) for 3 years, the general limitation period under Romanian law, so that I can show how I handled it. The basis is my legitimate interest in demonstrating that I comply with the GDPR and in defending legal claims (Article 6(1)(f)).

Nothing described here relies on your consent, so there is no consent to withdraw.

Your right to object

The request logs, most emails, the sign-in protection and the record of rights requests rely on my legitimate interests. You can object to that processing at any time, on grounds relating to your particular situation. I will then stop, unless I have compelling legitimate grounds that override your interests, rights and freedoms, or I need the data to establish, exercise or defend legal claims (GDPR Article 21).

To object, email hello@alexandrugurau.com.

Complaints

If you think I handle your data unlawfully, you can complain to a data protection authority: the Romanian one, which supervises me, or the one in the EU or EEA country where you live, work, or where the problem happened (GDPR Article 77). You’re welcome to contact me first, but you don’t have to.

Authority

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), the National Supervisory Authority for Personal Data Processing

Address

28-30 G-ral Gheorghe Magheru Bld., District 1, post code 010336, Bucharest, Romania

Phone

+40 318 059 211, +40 318 059 212

Email

anspdcp@dataprotection.ro

Complaints

How to file a complaint (online, by post or in person; in Romanian or English)

The other authorities’ contact details are on the European Data Protection Board’s members page.

How the data is protected

If a breach ever puts your data at risk, I’ll report it to the supervisory authority as the law requires, and tell you directly if the risk to you is high.

Changes to this policy

I update this page when what the site does with personal data changes, and change the date at the top. If I add something that handles personal data in a new way, such as a contact form, I’ll update this policy before it goes live.