Privacy.

Who is responsible

ChizoLab, the trade name of Filip Cierkosz, Amsterdam, the Netherlands (KVK 98524828), is responsible for the personal data described here. For any question or request about it, write to us through the contact form (topic: Other).

When you write to us

The contact form asks for your name, your email address, a topic and your message. We use them to answer you and to follow up on what you asked. Where your message is about working with us, that is a step you ask us to take before an agreement (GDPR, article 6(1)(b)); otherwise we rely on our legitimate interest in answering it (article 6(1)(f)).

Your message goes from your browser to our contact service on Amazon Web Services in Frankfurt, which checks it and forwards it by email (Amazon SES, Frankfurt) to our mailbox, hosted by Google Workspace. Your address is set as the reply address, so our answer reaches you directly. Where Google transfers data to the United States, it relies on the EU–U.S. Data Privacy Framework, and on standard contractual clauses where needed.

The contact service stores nothing: it uses your IP address in memory only, to limit repeated sends. Its logs, kept for 30 days, record the time and the outcome of each request (sent, refused or failed), never your details or your message.

We keep your message only as long as the conversation and any work that follows from it need it, or as long as the law requires (Dutch tax records: seven years).

Keeping the form free of abuse

When you reach the form, it loads Cloudflare Turnstile, which tells people from automated scripts, usually without asking anything of you. To do so it processes signals such as your IP address, your browser's user agent and its TLS fingerprint, and when you send, our service passes your IP address to Cloudflare to confirm the check. Turnstile does not read what you type into the form.

We rely on our legitimate interest in protecting the form (article 6(1)(f)). Cloudflare, Inc. (United States) processes these signals for us, and on its own behalf to improve its bot detection, and describes the processing as strictly necessary for security. Transfers to the United States rely on its certification under the EU–U.S. Data Privacy Framework. See Cloudflare's Turnstile privacy addendum.

Counting visits

We use Plausible Analytics to see how the site is used, in total: the pages viewed and how far and how long they are read, where visitors come from, their country, region and city, their browser, operating system and type of device, clicks on links to other sites, and, when a message is sent, the topic chosen, never its content.

Plausible uses no cookies and stores nothing on your device. To count unique visitors it combines your IP address and user agent with a random value that is deleted every 24 hours, and keeps only the result, so it cannot recognize you on another day or on another website; raw IP addresses are never stored. The data is processed by Plausible Insights OÜ (Estonia) on servers in Germany and does not leave the EU. We rely on our legitimate interest in understanding how the site is used (article 6(1)(f)). See Plausible's data policy.

Hosting

The site is served by Amazon Web Services from our own domain, fonts included. We keep no access logs for the site, and the contact service's firewall counts requests per IP address only to limit repeated sends, without logging them. Links to LinkedIn, Instagram and GitHub lead to sites with their own privacy policies; nothing loads from them until you follow one.

Your rights

You can ask us for a copy of your personal data, to correct or delete it, to restrict or object to its use, or to receive it in a portable format. Ask through the contact form; we answer within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Changes

When what we collect changes, this page changes with it; the date at the top says when it last did.