Privacy policy

Who is responsible

This site, gabs.app, is my personal website. I, Gabriel Espinheira, am responsible for the personal data it handles (the “controller” under the GDPR). I am a private individual based in Lisbon, Portugal.

Contact for anything in this policy: gabriiel66@gmail.com.

What I collect, and why

When you send the contact form

• What: the topic you pick, your name, your email address, your company or website if you give one, and your message.
• Also sent with it: where your visit started. That is the referring page, any campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the first page you landed on.
• Why: to read your message and reply to it, and to know which links bring people to the site.
• Legal basis: taking steps you asked for before a possible contract (Article 6(1)(b) GDPR). Also my legitimate interest in answering messages and knowing where they come from (Article 6(1)(f)).
• Where it goes: the site's server sends the form to SharpOS, the platform run by my company SharpHaw, where it is stored in my own account. Because the server sends it, your IP address is not passed to SharpOS.
• How long: I keep a message while the conversation it started is relevant, and delete it sooner if you ask.

When you email me

Email to gabriiel66@gmail.com is handled by Google (Gmail). I use it to reply, on the same legal basis as the contact form, and keep it on the same terms.

When you accept analytics

Only if you click Accept in the cookie banner, the site loads two analytics services, PostHog and Google Analytics, to see how the site is used.

• What:
  • the pages you view and how long you stay;
  • clicks on links and buttons, and how far you scroll;
  • heatmaps of where people click (PostHog only);
  • session recordings of your visit, with everything you type into fields hidden (PostHog only);
  • your browser, device type and screen size, and the referring page;
  • an approximate location (country and city) worked out from your IP address.
• Identifier: each service stores a random identifier on your device so your visits can be grouped. I don't use it to identify you by name.
• Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with “Cookie settings” at the bottom of every page; analytics stops and the PostHog and Google Analytics cookies are removed.
• Where it goes: PostHog's EU cloud. Requests travel through this site's own address before they reach PostHog. Google Analytics is provided by Google Ireland Limited and receives data straight from your browser; Google may process it in the United States. The site tells Google not to use it for advertising or ad personalisation.
• How long: PostHog deletes events and recordings when my plan's retention period ends. Google Analytics deletes event data when the retention period set for this site ends. I can delete your data sooner if you ask.

Meta ads, when you accept

The same Accept also loads the Meta Pixel, from Meta Platforms Ireland Limited, the company behind Facebook and Instagram.

• What:
  • the pages you view, and the referring page;
  • when you send the contact form or click an email, phone, WhatsApp, map or LinkedIn link (not what you write or who you contact);
  • your IP address, browser and device;
  • if you arrived from a Facebook or Instagram ad, the click on that ad.
• Identifier: the Meta Pixel stores a random identifier on your device, and the ad click you arrived from if there was one. If you are logged in to Facebook or Instagram in the same browser, Meta can link these visits to your account.
• Why: to measure whether ads on Facebook and Instagram bring visitors and messages, and to show ads to people who have visited the site.
• Legal basis: your consent (Article 6(1)(a) GDPR), withdrawn the same way; the Meta Pixel stops and its cookies and stored data are removed.
• Who is responsible: Meta and I are jointly responsible for collecting this data on the site and sending it to Meta. After that, Meta decides how it uses the data, under its own privacy policy (www.facebook.com/privacy/policy (opens in a new tab)), which also explains how to exercise your rights with Meta. Our arrangement is Meta's Controller Addendum (www.facebook.com/legal/controller_addendum (opens in a new tab)).
• Where it goes: straight from your browser to Meta. Meta may process it in the United States.
• How long: the Meta cookies on your device last 90 days. Meta keeps what it receives for as long as its own privacy policy sets out.

If you decline, or haven't chosen yet, none of these three services is loaded and none of the data above leaves your browser.

When you visit any page

Vercel, which hosts this site, processes your IP address, browser details and the pages requested in order to deliver them and protect the site from abuse. This is my legitimate interest in running a working, secure website (Article 6(1)(f) GDPR). Vercel keeps these request logs for a short period.

On every page, Vercel Web Analytics and Vercel Speed Insights also count visits and measure how fast pages load. They set no cookies and store nothing on your device. Each records the page, including any campaign tags in its link, the referring page, your browser, operating system, device type and country, and Speed Insights adds loading-speed measurements and your network speed. Web Analytics tells repeat visits apart with a hash of your request that is discarded after 24 hours, and neither can tie a visit to you or your IP address. I see only totals. The legal basis is the same legitimate interest: knowing which pages are read and whether they load quickly.

Who processes your data for me

Meta Platforms Ireland Limited also receives data, only with your consent, as a joint controller rather than a processor (see “Meta ads” above).

I don't sell your data and I don't make automated decisions about you. The only use of your data for advertising is the Meta Pixel, and only if you accept.

Transfers outside the EU

Some of these providers are based in the United States or use providers there. Where data leaves the European Economic Area, the transfer relies on safeguards the GDPR allows. Examples are the European Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework.

Your rights

You can ask me to:

• tell you what personal data I hold about you and send you a copy;
• correct it;
• delete it;
• restrict or object to how I use it;
• send it to you, or another service, in a portable format.

Where processing relies on your consent, you can withdraw it at any time; this doesn't affect what happened before. Write to gabriiel66@gmail.com and I'll answer within one month.

If you think I've handled your data wrongly, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt (opens in a new tab)), or the authority where you live.

Changes

When this policy changes, I update the date at the top. If the change affects what you agreed to in the cookie banner, it asks for your choice again.