What this site does with your data.

Before you answer the banner.

Nothing is loaded from anyone else and nothing is stored on your device. No third-party scripts, no third-party fonts, no iframes, no tracking pixels — and not even the Google tag itself. It is not sitting in the page waiting to be switched on; it does not exist until you click Accept, at which point this site's own code creates it.

The typefaces and icons are served from this domain, not from Google Fonts or a CDN. That is checked on every build by two separate gates, so it is a property of the site rather than a promise on a page.

If you accept.

Google Analytics 4 loads and sets two cookies, _ga and one beginning _ga_, which together let it tell a returning browser from a new one. They last 180 days, a figure set in this site's own code rather than left at Google's two-year default — which is why this page can name a number you can check.

Google receives your IP address, which it truncates, plus the page, the time, your approximate region, and your browser and device type. Advertising storage and ad personalisation are switched off permanently and never asked about, because this site runs no advertising.

Google acts as the processor here. The contract is with Google LLC in Mountain View, California, and the data goes to the United States. Legal basis: your consent, Art. 6(1)(a) GDPR. Google LLC is certified under the EU–US Data Privacy Framework, so the transfer rests on the European Commission's adequacy decision under Art. 45 GDPR. Google's own account of how it handles this is on its privacy page.

If you decline, or ignore it.

Nothing loads and nothing is sent. One entry goes into your browser's local storage, called mayi-consent, recording the answer so you are not asked again on every page. That single entry is written whichever way you answer, and it is the only thing this site ever puts in your browser without asking — because remembering a no is what makes the no worth anything.

Ignoring the banner records nothing at all: press Escape or scroll past, and it will ask again next time. Analytics choice in the footer of every page reopens it, so changing your mind costs the same one click as giving permission did.

Server logs.

Separately from all of that, and whether or not you accept, the web server records a page request the way every web server does: your IP address, the time, the page, the address of the page that linked you here, and your browser's user-agent string. It is used to keep the site running and to see whether something is broken.

Logs rotate daily and are deleted after 14 days. They are not linked to anything else and are not shared. Legal basis: Art. 6(1)(f) GDPR, the interest being an operable, debuggable website.

The contact form.

If you send the form, one field travels: your email address. Two hidden fields go with it — a fixed subject line so the mail threads correctly, and an empty anti-spam honeypot — and neither carries anything about you. There is no name field, no message box and no hidden field recording the page you were on. It is used to answer you and for nothing else. No newsletter, no list, and nobody gets it to sell you something.

The message is passed by FormSubmit.co, a form-delivery service, and arrives in a Gmail inbox. FormSubmit adds metadata of its own on their server — the kind of thing any mail relay records — which is not controlled from here, so the field list above describes what this site sends, not everything that reaches the inbox. Both are operated outside Switzerland and the European Union, so sending the form means your message leaves that area. If you would rather it did not, write to maxguemto@gmail.com directly or book a call — neither goes through the form service.

Enquiries stay in that mailbox while the conversation is live and for as long as the context is useful afterwards. Ask for one to be deleted and it will be. Legal basis: Art. 6(1)(b) GDPR where it leads to working together, Art. 6(1)(f) otherwise.

Links that leave this site.

Every "book a call" button is a plain link to Cal.com, and the footer icons are plain links to LinkedIn, Instagram and GitHub. None of them is embedded — there is no Cal.com script, no social widget and no iframe anywhere on this site — so none of those companies learns anything about you unless you click through. From that point their terms apply rather than these.

This is the distinction worth holding on to: a reader who never clicks and never submits the form reaches no third party at all. Everything else on this page is about what happens when you choose to.

Where it is hosted.

On a server at Infomaniak Network SA in Geneva, Switzerland. The site's files and its logs sit there and nowhere else. Switzerland has an adequacy decision from the European Commission, so this is not a third-country transfer.

Your rights.

You can ask what is held about you, ask for it corrected or deleted, ask for the use of it to stop, and ask for a copy (Art. 15–21 GDPR). One email is enough and there is no form to fill in. You can also complain to a data protection authority.

Consent, where it is the basis, can be withdrawn at any time with effect for the future — that is the Analytics choice control in the footer, and it is deliberately the same one click that granting it was (Art. 7(3) GDPR).

Who to ask.

Maximilian Guemto, Guntersblum, Germany. maxguemto@gmail.com. Every message is read by one person, so there is nobody to be escalated past. The full business details are in the legal notice.