Privacy policy
Data controller
Ricardo Torres, Esposende, Portugal. Contact: ricardotorres@ricardotorres.com.pt.
What data I collect
Through the contact form: name, email, phone (optional), project type and message. I also store an irreversible fingerprint (hash) of the IP address and the browser used, only to prevent abuse and spam. I also store where the visit came from (the referring site, without the full address, the first page visited and any campaign parameters), to understand which channels bring in enquiries.
What I use it for
Only to reply to your request and follow up on a possible proposal. I don't send advertising or share the data with third parties for marketing.
Where it is stored
In a MySQL database on a private server with restricted access. Emails are sent through my own SMTP server.
For how long
Up to 24 months after the last contact, or less if you ask for deletion. After that the data is deleted automatically; if you received a proposal, only the record of the proposal (number and amounts) remains, without your personal data. Unconfirmed newsletter sign-ups, and cancelled subscriptions, are deleted after 30 days.
Your rights
You can request access, correction or deletion of your data at any time via ricardotorres@ricardotorres.com.pt. You can also lodge a complaint with the Portuguese data protection authority (CNPD).
Newsletter
If you subscribe to new articles, I only store your email and language, confirmed by email (double opt-in). Every email has an unsubscribe link; once you unsubscribe, no more emails are sent.
Spam protection
The contact and newsletter forms, and the assistant, use Google reCAPTCHA v3 to tell people from automated programs. Google’s script only loads when you start filling in a form and looks at browser and interaction signals; Google processes this data under its Privacy Policy, possibly in the US under the EU-US Data Privacy Framework. This is based on the legitimate interest of protecting the site and your messages from abuse.
Cookies and statistics
This site uses no advertising cookies. Only if you accept the cookie notice do I use Google Analytics (Google Ireland Limited) to measure visits in aggregate: it stores the _ga and _ga_* cookies in your browser for up to 2 years, and the data is kept in Google Analytics for 14 months. Google may process data in the US under the EU-US Data Privacy Framework. You can change your choice at any time under “Cookie preferences” at the bottom of every page; withdrawing consent deletes the cookies. Without consent, nothing is loaded or sent to Google. To link the origin of a visit to a contact message, the site keeps it in the browser's session storage (sessionStorage), which is cleared when you close the tab and is only sent if you submit the form. If you accept, the site may also keep in your browser (localStorage) which version of a page you saw in an A/B test; it is deleted when you withdraw consent.