Privacy

Who is responsible

KairosApex is Thiago Santos Joaquim, working in his own name, based in Portugal. He is the data controller for everything described here, and he is also the person who answers the email: contact@kairosapex.com.

What is collected, and when

The contact form. Your name, your email address, the company if you named one, the project type you picked, and your message. It is sent to a mailbox and it stays there. There is no CRM, no database and no mailing list behind this site — nothing you type is stored by the site itself.

Analytics, only if you accept. Which pages are viewed, where the visit came from, an approximate location worked out from your address — the country and the city, never a street — and the kind of device and browser. It runs on our own server rather than a vendor's, sets no cookies, and stores nothing in your browser.

To tell one visit apart from another without keeping anything about you, the server builds an identifier by hashing your address, your browser string and this site together with a secret that changes every night. Your address itself is never stored, and because the secret changes, yesterday's identifier cannot be matched to today's. Nothing follows you across days, and nothing follows you to another site.

Server logs. Like every web server, ours records the requests it serves: the address they came from, the time, the page, the browser string. They exist to keep the site running and to notice abuse.

Rate limiting. So the contact form cannot be used to send mail in bulk, the address that submitted it is held in the server's memory for an hour. It is never written to disk.

Why

The contact form, to answer you. That is why you wrote, and answering is a step towards a possible contract.

Analytics, because you said yes. Until you do, it does not run at all.

Logs, out of a legitimate interest in keeping a site available and secure.

How long it is kept

Contact messages stay in the mailbox for as long as the conversation is useful, and at most 24 months. Ask for yours to be deleted sooner and it will be.

Analytics data holds no name, no address and no account, and the identifier described above dissolves every night. What is left is counts.

Server logs are kept for a few days.

Who else sees it

Nobody. No ad network, no analytics vendor, no CRM and no sales tool is involved in this site. Nothing is sold and nothing is shared.

Two suppliers necessarily handle data for any of it to work: Hostinger, which hosts the mailbox your message arrives in, and Hetzner, whose servers in Nuremberg, Germany run the site and the analytics. Both are in the European Union.

Your rights

Under the GDPR you can ask for a copy of whatever is held about you, ask for it to be corrected or deleted, ask for it in a portable form, or object to it being processed at all. Write to contact@kairosapex.com and a person answers, within a working day.

If that answer does not satisfy you, you can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (cnpd.pt).

Changes

If this policy changes, the date at the top changes with it. There is no version of this site that quietly starts collecting more without saying so here first.