Legal
Privacy Policy
This portfolio is a small personal site, and it collects very little. This page explains exactly what happens to your data, in plain language, and how to contact me about it.
Last updated:1. Who is responsible for your data
The data controller — the person who decides why and how personal data is used here — is Kévin Sauvage, an individual based in Barcelona, Spain. This is a personal portfolio, not a company, and there is no Data Protection Officer because the site carries out no large-scale or systematic monitoring.
For any question or request about your data, email me.
kevinsauvage@outlook.com2. What data is collected
Reading the portfolio requires no account, no sign-up and no personal details. Data is only processed in the situations below.
I never ask for sensitive information, and there is no database of visitors or contact messages stored on this site.
If you use the contact form:
Your name.
Your email address, so I can reply.
The content of your message.
A reCAPTCHA score computed by Google to block automated spam.
If you accept analytics cookies:
Pages viewed and the order in which you view them.
How you reached the site (referrer or campaign parameters) and generic device, browser and screen information.
Interactions such as scroll depth and clicks on links, buttons and the testimonials carousel.
A randomly generated identifier Google Analytics 4 assigns to your browser.
Coarse location derived from your IP address — Google Analytics 4 does not store the IP address itself.
If something breaks while you are browsing:
Technical error details (message and stack trace), the page URL, and your browser’s user-agent string, sent to Sentry so I can fix the fault.
3. Why it is used, and on what legal basis
I never sell or rent your data, and I do not use it for advertising or profiling. Advertising storage exists in the cookie banner for completeness but stays off unless you deliberately turn it on.
Contact form — to read and answer your message. Legal basis: your consent (sending the form) and my legitimate interest in replying to people who write to me.
Analytics — to understand which projects and pages are useful so I can improve them. Legal basis: your consent, which you can withdraw at any time.
Error monitoring — to detect and fix technical faults and keep the site secure. Legal basis: my legitimate interest in a working, safe website.
Spam protection — reCAPTCHA scores form submissions to filter out bots. Legal basis: my legitimate interest in protecting the site from abuse.
5. Who else handles your data
As a solo project I rely on a few service providers. They act only on my instructions, are bound by their own data processing terms, and receive nothing beyond what their service needs.
Vercel — hosting and delivery of the site.
Google — Google Tag Manager, Google Analytics 4 and reCAPTCHA.
Sentry — error and performance monitoring.
EmailJS — delivery of contact-form messages to my inbox.
Microsoft — Outlook is where form messages and email land.
6. Transfers outside the EEA
Some of these providers are based in the United States, so data can leave the European Economic Area. Those transfers rely on the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
7. How long data is kept
I keep data only as long as it is useful, then delete it. You can always ask me to delete something sooner — see your rights below.
Contact messages — up to 24 months in my mailbox, then deleted.
Analytics — up to 14 months, the longest retention Google Analytics 4 allows.
Error reports — up to 90 days in Sentry.
Your cookie choice — up to 6 months, after which the banner asks again.
8. Your rights
If you are in the European Economic Area or the United Kingdom, the GDPR gives you the following rights over your personal data:
Access — get a copy of the personal data I hold about you.
Rectification — have inaccurate data corrected.
Erasure — have your data deleted (the “right to be forgotten”).
Restriction — ask me to stop using your data while a question is being resolved.
Objection — object to processing based on my legitimate interest.
Portability — receive the data you provided in a machine-readable format.
Withdraw consent — change or revoke your cookie choice at any time with the cookie settings button; this does not affect processing that happened before.
9. Exercising your rights
Email me to exercise any of these rights and I will answer within 30 days. If you are unhappy with my response you can lodge a complaint with your national supervisory authority — in Spain the AEPD (aepd.es), in France the CNIL (cnil.fr), or the equivalent body where you live.
kevinsauvage@outlook.com10. Security
The site is served over HTTPS and applies a strict Content Security Policy, and secrets such as API keys stay on the server. No system is perfect, so the safest protection is still to collect as little as possible: there is no database of visitors or contact messages on this site.
11. Children
This is a professional portfolio, not a service aimed at children, and I do not knowingly collect data from anyone under 16. If you believe a child has sent me personal data, email me and I will delete it.
12. Changes to this policy
When this policy changes, the “last updated” date at the top changes with it, and the site’s public repository history keeps a record of what was modified. Continuing to use the site after an update means you accept the revised policy.