Privacy policy

Maximiliano Farias, Buenos Aires, Argentina. Contact: maxifarias81@gmail.com. You can ask for my postal address for formal notices at that email.

I am an individual freelancer, not a company. I am the only person with access to the data described here.

The form on /services collects your name, email, company (optional), the package you chose, the type of app, its URL (optional), what you need tested and your deadline (optional).

Name, email, package, type of app and what you need tested are required: without them I can't reply or prepare a quote. The optional fields only help me understand the project.

I use this data only to reply to your request and prepare a quote, a step you ask for before any agreement (legal basis: pre-contractual steps at your request, GDPR art. 6.1.b; under Argentine law, data provided to set up a contractual relationship, Ley 25.326 art. 5).

Please don't include passwords, access credentials or personal data of other people in the form. If the project goes ahead, we'll agree on a safe way to share access.

• →The request reaches my inbox as an email sent through Resend and received in Gmail (Google).
• →If no work comes from it, I delete it 12 months after our last contact.
• →If we work together, I keep what is needed while the work lasts and afterwards only what Argentine tax and accounting rules require me to keep (invoices and related records).
• →You can ask me to delete it earlier at any time, except for what I'm legally required to keep.
• →The providers also keep technical logs for a limited time under their own policies (for example, Vercel access logs and Resend delivery logs).

To protect the form I rely on my legitimate interest in keeping it free of spam and abuse (GDPR art. 6.1.f).

• →To block repeated requests, I store an irreversible code (SHA-256 hash) generated from your email together with the package, for 30 days. The hash doesn't show your email, but it is still considered personal data.
• →To limit the number of requests, I store your IP address for 1 hour.
• →Both are stored in Upstash (database service, United States) and deleted automatically.

I want to know how many people visit the site and which pages they read (legitimate interest, GDPR art. 6.1.f). For that I use two tools, and neither stores anything in your browser:

• →Vercel Web Analytics: aggregated statistics (pages, where visitors come from, country, device). It does not use cookies and does not identify you.
• →My own visit counter: the pages you view, the website you came from, your device and browser type, and your approximate city and country (derived from your IP by Vercel). To group the pages of one visit, the server combines your IP and browser with a random key that changes every day and is deleted after 48 hours; your IP is never stored.
• →Visit records are deleted after 24 hours. Every 5 visits I receive an email summary (date, approximate location, origin, device and pages), which I keep for up to 90 days.
• →If your browser sends the Global Privacy Control or Do Not Track signal, the visit counter is turned off. You can also turn it off by opening any page with ?notrack=1 at the end of the address; your browser then remembers only that choice (?notrack=0 undoes it).
• →I don't ask for consent for these statistics because they don't store your IP or anything that identifies you by name, and the providers are contractually bound to protect them.

These providers process data to provide their service. Vercel, Resend and Upstash act on my behalf under their data processing agreements; Google provides my personal Gmail inbox under its own terms and privacy policy:

• →Vercel (United States): hosts the site, processes technical data such as IP addresses to serve and protect the pages, and provides Web Analytics.
• →Resend (United States): sends the request form and visit summaries to my inbox.
• →Upstash (United States): stores the anti-abuse and visit data described above.
• →Google (Gmail, United States): the inbox where I receive and answer requests. Google processes these emails under its own privacy policy.

These providers are in the United States, which Argentina doesn't consider a country with adequate data protection. That's why, before sending the form, I ask for your express consent to transfer your data there (Ley 25.326 art. 12 and Decreto 1558/01). Without that consent the form isn't sent.

For visitors in the European Union, transfers rely on the safeguards in each provider's (Vercel, Resend and Upstash) data processing agreement: the European Commission's standard contractual clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework.

• →The site only works over HTTPS and sends security headers that limit what the pages can load.
• →Access keys to the providers are only on the server, never in the page code.
• →I collect only what I need, and most data is deleted automatically.
• →No automated decisions or profiling: the only automatic steps are the anti-spam limits described above.

You can ask to access, correct, update or delete your data, object to its use or restrict it, receive it in a portable format, and withdraw your consent at any time (this doesn't affect what was done before). Write to maxifarias81@gmail.com. I may ask you to confirm your identity. It's free.

Deadlines: I answer access requests within 10 calendar days, and correction or deletion requests within 5 business days (Ley 25.326 arts. 14 and 16). For people in the European Union, the GDPR deadline of one month also applies.

The owner of personal data has the right to access it free of charge at intervals of no less than six months, unless a legitimate interest is proven, as established in article 14, paragraph 3 of Law No. 25,326.

The Agency for Access to Public Information (AAIP), as the Control Body of Law No. 25,326, has the power to handle complaints and claims filed by those whose rights are affected by non-compliance with personal data protection rules. If you are in the European Union, you can also contact your local data protection authority.

• →The site and its services are meant for professionals and companies, not for people under 18. If you're under 18, please don't send the form.
• →If I change how the site uses data, I'll update this page and its date. If the change affects requests you already sent, I'll let you know by email.