Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

2. Data We Collect

We collect personal data only when you actively provide it:

• Contact & project requests – name, email address, and the message you submit.
• Discovery-call bookings – name, email address, preferred date and time.
• Payments – handled entirely by Polar.sh. We receive only a confirmation and your email address; we never see or store payment card data.
• Account data – if you create an account, your email address and encrypted password are stored by Supabase.
• Technical data – server logs may contain your IP address, browser type, and the pages you visit for security and debugging purposes. Logs are not linked to your personal identity and are deleted regularly.

3. Legal Basis (GDPR / Swiss DSG)

• Contract performance (Art. 6(1)(b) GDPR) – processing your booking or project request so we can deliver the service.
• Legitimate interests (Art. 6(1)(f) GDPR) – server logging for security and fraud prevention.
• Consent (Art. 6(1)(a) GDPR) – where you have explicitly opted in (e.g., subscribing to updates).

4. How We Use Your Data

• Responding to your enquiries and delivering services you requested.
• Sending booking confirmations and service updates via email.
• Sending invoices and payment links.
• Improving the reliability and security of this website.

We do not sell, rent, or trade your personal data with third parties for marketing purposes.

5. Third-Party Processors

We use the following sub-processors, each bound by their own privacy commitments:

• Supabase (database & authentication) – EU-based infrastructure.
• Polar.sh – payment processing.
• Resend – transactional email delivery.
• Google Workspace – calendar event creation for booked calls.
• Vercel – website hosting and edge network.

6. Data Retention

We retain personal data only as long as necessary for the purposes described above or as required by applicable law (typically up to 10 years for accounting records under Swiss law). Contact enquiries without an ongoing business relationship are deleted after 2 years.

7. Your Rights

Under GDPR and the Swiss DSG you have the right to:

• Access – request a copy of the data we hold about you.
• Rectification – ask us to correct inaccurate data.
• Erasure – request deletion of your personal data (subject to legal obligations).
• Restriction – ask us to limit how we process your data.
• Portability – receive your data in a structured, machine-readable format.
• Objection – object to processing based on legitimate interests.

To exercise any of these rights, email kamsiyochukwuugoji@gmail.com. We will respond within 30 days.

8. Cookies & Tracking

This website uses only strictly necessary cookies for authentication (session tokens). We do not use advertising or analytics cookies. No third-party tracking scripts are loaded.

9. Security

We implement industry-standard technical and organisational measures to protect your data, including TLS encryption in transit, hashed passwords, row-level security on our database, and strict access controls.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Last updated" date above. Continued use of the website after changes constitutes acceptance of the updated policy.