Legal
Privacy Policy
Effective Date: September 20, 2026
1. Data Controller
Rodrigo Normando Horácio da SilvaEssen, Deutschland
E-Mail: rodrigo.normando.silva@gmail.com
2. Principles and Purpose
These engineering portfolio applications collect zero analytics data, use no advertising, deploy no tracking pixels, and build no cross-device profiles. We process only data strictly necessary to execute requested demonstrations, enforce abuse prevention (rate limiting), and ensure system availability.
3. Infrastructure & Technical Logs
The applications are hosted on servers provided by Hetzner Online GmbH in Germany managed via Coolify and Traefik. When requesting a page, the infrastructure processes network connection data (specifically IP addresses) to deliver content and mitigate cyber threats.
Application logs are designed to contain only technical telemetry (latency, status codes, request identifiers). User inputs, prompts, and document payloads are not intentionally logged. Services enforcing persistent rate limiting convert incoming IP addresses into HMAC-keyed pseudonyms; these keys expire within 24 hours.
Legal basis: GDPR Art. 6(1)(f) (legitimate interest in maintaining secure, resilient, and abuse-free service availability).
4. Data Processing Across Roadmap Applications
| Application | Processing & Services | Retention Window |
|---|---|---|
| Portfolio | Language and theme preferences stored locally in the browser. | Until deleted in the browser. |
| Smart Inspector | Uploaded images are stripped of EXIF metadata and forwarded to Azure OpenAI for vision analysis. Images are not retained. | Pseudonymized rate limit key: 24 hours. |
| Support Bot | Message payload is processed via Azure AI Language and Azure Agent/OpenAI. No chat logs stored on server. | Pseudonymized rate limit key: 24 hours. |
| Prompt Forge | Prompt briefing and target audience evaluated via Azure Content Safety and Azure OpenAI streaming. History volatile in memory. | Pseudonymized rate limit key: 24 hours. |
| Pocket RAG | Original documents, extracted chunks, and embeddings are stored temporarily on the server; embeddings, queries, and required context are sent to Azure OpenAI. | Automatic deletion after 30 minutes; early deletion available. |
| Agentic Workflow | Prompt and agentic execution steps processed in server volatile memory with Human-in-the-Loop confirmations. | Session: 30 minutes inactivity; Rate limit key: 24 hours. |
| Agent Workspace | HMAC-signed owner cookie isolates browser conversations. Conversations stored in volatile storage / Cosmos DB. | Cookie: 30 days; Conversations: until deleted by user. |
Processing required to fulfill user-initiated interactions relies on GDPR Art. 6(1)(b); defensive rate limiting relies on GDPR Art. 6(1)(f).
5. Service Providers & International Transfers
Data processors include Hetzner Online GmbH (server hosting) and Microsoft Azure cloud services (Azure OpenAI, Azure AI Language, Azure Content Safety, Azure AI Foundry). Data processed through Azure is governed by Microsoft's Data Protection Addendum (DPA) and Standard Contractual Clauses (SCCs).
6. Cookies & Browser Storage
Only strictly necessary client-side storage is utilized: locale and theme preferences in localStorage, and cryptographically signed session cookies to isolate workspaces. No third-party, advertising, or telemetry cookies are used.
7. Your Rights
Under GDPR and applicable data protection regulations, you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You also have the right to lodge a complaint with a competent supervisory authority.