Privacy Policy

Sharon Sciammas is the data controller for personal data processed through this website. You can contact me at sharon.spirit@gmail.com for privacy questions, requests, or corrections. This policy is written for a small personal portfolio website and is not a substitute for legal advice.

The site collects only the information needed to operate the website, respond to messages, protect forms and demos from abuse, send newsletter updates, and understand basic site performance.

You can browse most pages without giving me personal data. Email is required for newsletter signup, contact replies, and email-gated demos. A name is optional unless a specific form marks it as required. Declining non-essential cookies does not block access to the website, but some forms or demos may not work without required fields, verification, or anti-spam checks.

The site uses personal data for the following purposes and legal bases:

• Newsletter updates: consent. You can unsubscribe or ask for deletion at any time.
• Contact replies and administrative follow-up: legitimate interest in responding to your request. If the message leads to a working relationship, related records may also be needed for pre-contract or contract steps.
• Analytics, tag management, chat widgets, and non-essential cookies: consent.
• Hosting, rate limiting, spam prevention, Turnstile checks, and abuse prevention: legitimate interest in keeping the website secure and available.
• Legal, accounting, or compliance records if they become relevant: legal obligation or legitimate interest.

I use third-party services to run the site. Depending on how you use the website, personal data may be processed by these providers:

• Vercel for hosting, deployment, logs, analytics, KV, and Blob storage.
• Resend for contact form and verification emails.
• MailerLite for newsletter subscriptions and optional contact inquiry grouping used for contact administration, not newsletter subscription.
• Cloudflare Turnstile for anti-spam and bot protection.
• Google Analytics and Google Tag Manager for consent-based analytics.
• Tawk.to for chat support if the chat widget is enabled after cookie consent.
• Google Calendar when you choose to use an external scheduling link.
• AI and lab providers used by specific demos, such as Google Gemini, OpenRouter, DeepSeek, Vercel AI SDK providers, fal.ai, Firecrawl, Tavily, GitHub, npm, Wikimedia / Wikipedia, CoinGecko, and similar public-data APIs.

These providers may act as processors, independent controllers, or both depending on the service and context. Their own privacy terms apply when you interact with their external services directly.

Essential storage supports basic site behavior, including remembering whether you accepted or declined analytics cookies. Analytics cookies, Google Tag Manager, Vercel Analytics, and Tawk.to load only after you consent through the cookie banner. You can decline non-essential cookies and continue using the site.

Analytics data is used in aggregate to understand traffic, page performance, and content usefulness. It is not used to sell personal data.

Some lab pages are interactive demos that may process prompts, messages, URLs, product descriptions, generated images, dashboard requests, or support questions through third party AI, retrieval, image, email, storage, and public-data services.

Do not submit confidential, sensitive, regulated, or personal data that you do not want processed by third-party services. AI outputs may be incomplete or inaccurate, and demos are provided for exploration rather than advice or production decision-making.

Generated images, demo outputs, or uploaded/generated assets may be stored through public or shareable provider URLs when a demo needs to display results.

Some providers process data outside the Netherlands or the European Economic Area, including in the United States. Transfer safeguards may include European Commission adequacy decisions, Standard Contractual Clauses, provider data processing agreements, or equivalent safeguards described in the relevant provider terms. You can email me to request more information about the safeguards used for a specific provider.

Data is kept only as long as needed for the purpose it was collected, unless a longer period is required or justified by law.

• Newsletter records are kept until you unsubscribe or ask for deletion.
• Contact messages are kept while needed to respond, maintain context, or handle follow-up, usually up to 24 months after the last exchange unless needed longer for legal, accounting, or relationship context.
• Verification codes, rate-limit records, and anti-spam signals are kept for short operational periods, typically minutes to days unless abuse investigation requires longer retention.
• Hosting, analytics, and chat records follow provider settings and are reviewed periodically; analytics retention is intended for trend review, not individual tracking.
• Demo outputs or generated assets may be retained while needed to display results, debug abuse, or maintain the demo experience, then removed or allowed to expire when no longer useful.

If GDPR or similar privacy law applies to you, you may have rights to access, correct, delete, restrict, object to processing, receive a copy of your data, withdraw consent, or complain to a supervisory authority.

You can send requests to sharon.spirit@gmail.com. If you are in the Netherlands, you can also contact the Autoriteit Persoonsgegevens.

For privacy requests or questions, email sharon.spirit@gmail.com. You can also review the Terms of Service.