What data I take from you, where it sits and how you delete it.

When you fill in the contact form, the following fields reach me. Only the email address is required — the rest you fill in if you want, and they help me answer to the point.

When you request a PDF guide, only the email address and the name of the requested guide are saved. The article on the page is read freely, without leaving anything — the gate is on the PDF only.

When you book the 20-minute consultation, booking runs through Cal.com or Calendly, an external service. The scheduling widget loads only after you press “Pick a time”; until then no request goes out to them. In the calendar you fill in your name, email address or phone number, and the answer to the question in the booking form. The purpose is just one: to fix the time and let me know what you want to talk about. The calendar provider acts as a third-party provider processing this data on my behalf; its own rules apply in addition (section 09).

In my forms I don't ask for and don't store a phone number, national ID number, card details or other sensitive data. Nowhere on the site, outside the booking calendar above, is there a field where you could type them.

The form data has one real purpose: so I can continue the conversation you started. In practice that means an email from me, or a WhatsApp message if you left your number in the body of the message.

If you requested a guide, you get the guide. One single email, on request — I don't sign you up to any list and no sales sequence follows it.

The legal basis is simple to state: for contact messages it's legitimate interest in replying to someone who wrote to me; for guides it's your consent , given the moment you pressed the button; for client invoices it's the legal obligation to keep them.

If you press “Accept”, Google Analytics 4 loads, a service of Google Ireland Limited, and measures how the site is used: which pages are opened, where you come from (the country, not your address) and what kind of device you use. It sets two cookies, _ga and _ga_Y4P8WFJB4P, valid for up to two years. I don't turn on Google signals and I don't use the data for advertising or remarketing.

The measurement data is kept for fourteen months, then deleted. It can also reach Google outside the European Economic Area, under the EU–US Data Privacy Framework.

If you press “Decline”, or press nothing, nothing loads from Google and no cookie is set. You can change your choice at any time from the “Cookie settings” link in the footer of every page. If you withdraw consent, the Google cookies are deleted immediately.

Your choice is remembered in localStorage, that is, in your browser, not in a cookie. A second thing is written locally and isn't a cookie: when you come to the site from a post of mine, the link may contain a short code, for example ?p=k7m2xq4r. I remember it so that, if you reach the form after three clicks, I know which post you came from.

The code is saved in sessionStorage, that is, in the browser tab's memory, and deletes itself when you close the window. It goes nowhere until the moment you send the form, it doesn't follow you across other sites and it can't identify you: it's a code for the post, not for you. It needs no consent banner, because it doesn't track anyone.

Separately from Google, the site has a counter of its own that counts visits in total. When you open a page, your browser sends the server only the address of the page and the category of where you came from (for example “Google”, “Instagram” or “direct”), and the server adds one to a number in a table kept per day. It sets no cookie and keeps no IP address, no browser details, no full referring address and no identifier, and it cannot tell how many different visitors there are, only how many pages were opened. The IP address is used only in memory, for at most a minute, to stop abuse, and is never written anywhere. Because it identifies no one, the counter also runs if you declined cookies.

When you send the form, two things happen. The data is written into a PostgreSQL database running on the system's own server, and a notification email goes out to me so I know someone wrote. The conversation after that is carried on from my ordinary inbox.

Both are accessed by one single person: me. There is no team, no partner agency and no external CRM your data syncs into.

The providers I rely on that touch your data are the two above, server hosting and the email provider, plus Google, but only if you accepted measurement, and Cal.com or Calendly, but only if you book the 20-minute consultation (section 01). Google Ireland Limited receives measurement data only if you accepted (section 03), and it may also reach outside the European Economic Area, under the EU–US Data Privacy Framework. Otherwise, I don't transfer data outside the European Economic Area for any purpose other than running the two services above.

The competent authority in Romania is the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal).

The site contains links to other places — Instagram, YouTube, LinkedIn, WhatsApp. I'm not responsible for what they do with your data, because I have no control over them.

One thing is worth saying explicitly: links are just links. I haven't embedded on any page like widgets, buttons or players that would load code from another site and see you while you're here. The only third-party code is the Google Analytics tag, which loads only if you pressed “Accept”, and the Cal.com or Calendly widget for booking the consultation, which loads only after you press “Pick a time”.

If something important changes — a new provider touching the data, a new purpose, a longer period — I announce it on the site's front page and, if you had left me your address, by email as well.

Small corrections, of wording or phrasing, come without an announcement. They show anyway from the date at the start of the document.