Privacy

The short version

• No analytics, no tracking, no ads, no third-party cookies.
• Fonts are served from this site, not from Google.
• Chat messages are sent to an AI provider to generate the answer and are not stored by this site.
• Contact-form messages arrive in my email inbox and are only used to reply to you.

Controller

Heidi Albarazi, Munich, Germany · heidialbarazi2306@gmail.com. Full details in the imprint.

Hosting and server logs

This site is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you visit, Vercel processes technical data such as your IP address, date and time, requested page, referrer and browser/user agent to deliver the site and protect it against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website). Vercel is certified under the EU-US Data Privacy Framework and bound by standard contractual clauses. Images from my content are served from Vercel Blob storage.

Cookies and local storage

This site sets no cookies for visitors. It stores one flag in your browser's session storage so the loading animation only plays once per visit; it is deleted when you close the tab. The admin area uses a strictly necessary login cookie that only concerns me.

AI chat

When you use the chat, your messages (and the recent conversation) are sent via the Vercel AI Gateway to the AI model provider (currently Anthropic, and OpenAI for converting your question into a search vector) to generate an answer. These providers process the text on my behalf and, according to their API terms, do not use it to train models. This site does not store your conversation; it disappears when you leave or reload the page. Please don't enter sensitive personal data. Legal basis: Art. 6(1)(f) GDPR (answering your questions about my work at your request).

Contact form

If you send a message, I receive your name, email address, subject and message by email. Sending is handled by Resend (Resend Inc., USA; EU-US DPF / standard contractual clauses). I use the data only to answer you and delete it when the conversation is finished, unless legal retention rules apply. Legal basis: Art. 6(1)(b) and (f) GDPR.

To block spam, the form uses Cloudflare Turnstile (Cloudflare Inc., USA; EU-US DPF). Turnstile evaluates technical signals from your browser (such as IP address and browser characteristics) to tell humans from bots; it does not use advertising cookies. Legal basis: Art. 6(1)(f) GDPR (protection against abuse).

Rate limiting

To prevent abuse of the chat, contact form and admin login, your IP address is stored as a counter in an Upstash Redis database in Frankfurt (Upstash Inc.) for at most one hour. Legal basis: Art. 6(1)(f) GDPR.

External links

Links to LinkedIn, GitHub, Devpost, Dribbble and Instagram are plain links. No data is sent to these services until you click them; after that, their own privacy policies apply.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR). Just email me. You can also lodge a complaint with a supervisory authority, for example the Bavarian Data Protection Authority (BayLDA, Promenade 18, 91522 Ansbach, lda.bayern.de).