Privacy Policy

Last updated: 6 August 2026

This site is my personal portfolio. The only personal data it collects is what you choose to type into the contact form, and I use it for exactly one thing: replying to you.

In short:

I never sell, rent or trade your data. Not to anyone, ever.
I don't use it for marketing, newsletters or advertising.
There is no tracking and no analytics on this site.
The site sets no cookies and stores nothing in your browser.
Your message is used only to answer your enquiry about my work or services.
You can ask me to delete everything at any time, and I will.

1. Who is responsible for your data

The data controller is Jorge Troya, an individual freelance developer based in Barcelona, Spain.

For anything relating to privacy or your data, contact me at [email protected].

2. What data I collect

Data you give me

When you submit the contact form, I receive:

Your name — so I know who I'm replying to.
Your email address — so I can reply.
Your message — whatever you chose to write.

That's the entire form. There are no hidden fields.

Data collected automatically

Your IP address, in two places: standard server logs kept by my host, and the anti-spam check described below. I don't use it to identify or profile you.

There is no analytics, no tracking pixel, no advertising network and no behavioural profiling on this site. I do not know who visits it.

3. Why I use it, and my legal basis

To reply to your enquiry: Legal basis: Article 6(1)(b) GDPR — steps taken at your request before entering into a contract. You contacted me about my work or services, and I need your details to respond.
To keep the form free of spam and abuse: Legal basis: Article 6(1)(f) GDPR — my legitimate interest in a contact form that isn't overwhelmed by automated submissions. This is why the verification check appears before you can send.

I will not use your data for any other purpose. If I ever needed to, I would ask you first.

4. What I will never do

Sell, rent, trade or otherwise monetise your personal data.
Add you to a mailing list or send you marketing you didn't ask for.
Share your details with advertisers or data brokers.
Use automated decision-making or profiling that produces legal effects for you.

5. Who else processes it

I don't run my own servers. These providers process data on my behalf, under contract, and only to deliver the service described:

Provider	What it does	What it sees	Where
Netlify	Hosting and the serverless function that receives the form	IP address and standard server request logs	United States / global CDN
Formspree	Processes contact form submissions, stores them and emails them to me	Name, email address, message	United States
Cloudflare Turnstile	Anti-spam check on the contact form	IP address and browser signals, used to tell humans from bots	United States / global
Google Fonts	Serves the typefaces the site uses	IP address, sent when your browser fetches the font files	United States

International transfers. These providers are based in the United States, so your data may be transferred outside the European Economic Area. They rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission as the safeguard for those transfers.

6. How long I keep it

I keep contact enquiries only as long as they're useful: while we're in conversation, and afterwards for as long as there's a live prospect of working together. Enquiries that go nowhere get deleted once it's clear nothing will come of them.

Messages are also stored by Formspree, subject to their own retention. Server logs containing IP addresses are kept short-term by my host for security and diagnostics.

If you ask me to delete your data sooner, I will do it and confirm.

7. Cookies

This site sets no cookies and writes nothing to your browser's local or session storage. That's why you don't see a cookie banner — there is nothing to consent to. The anti-spam check may set a short-lived cookie of its own if Cloudflare needs to distinguish you from a bot; it exists only for that check and is not used to track you across sites.

8. Your rights

Under the GDPR you have the right to:

Access. Ask what personal data I hold about you and get a copy.
Rectification. Have inaccurate data corrected.
Erasure. Ask me to delete your data — often called the right to be forgotten.
Restriction. Ask me to limit how I use your data while a concern is resolved.
Portability. Receive your data in a portable, machine-readable format.
Objection. Object to processing based on legitimate interests, including at any time.
Withdraw consent. Where processing relies on consent, withdraw it at any time.

To exercise any of these, email [email protected]. I'll respond within one month, and it costs you nothing. I may need to confirm your identity first, to make sure I'm not handing your data to someone else.

If you think I've handled your data badly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), or to the supervisory authority in your own country. I'd appreciate the chance to put it right first.

9. Security

The whole site is served over HTTPS. The contact form is protected by a verification check that is validated server-side, so the credentials behind it are never exposed to your browser. Submissions are passed straight to the providers above and are not stored on any server of my own.

No system is perfectly secure, and I won't pretend otherwise — but I don't hold a database of your data to lose.

10. Children

This site is aimed at people looking to hire a developer. It is not directed at children, and I don't knowingly collect data from anyone under 16. If you believe a child has sent me data, email me and I'll delete it.

11. Changes to this policy

If I change how data is handled, I'll update this page and the date at the top. There is no version history — if that matters to you, keep your own copy.

12. Contact

Jorge Troya
Barcelona, Spain
[email protected]