Get a quote

Privacy Policy

This site is a personal portfolio. It collects as little as it can: no account, no newsletter, no third-party embeds, and nothing stored on your device for analytics unless you allow it.

Who Is Responsible

The controller for this site under the General Data Protection Regulation (GDPR) is Sultan Kautsar. For any question about your data, email [email protected].

Hosting

The site is served by Cloudflare Pages (Cloudflare, Inc.). To deliver pages and protect the site from abuse, Cloudflare processes technical data from every request, such as your IP address, browser, the page requested, and the time of the request.

This is necessary to run the site, so the legal basis is my legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). The fonts, images, and video on this site are hosted on the same domain; no request goes to a font or media service.

When you first visit, a banner asks what you allow. Your answer is saved in your browser’s local storage under the key consent, together with the time you chose. It never leaves your device, and it expires after 12 months, when the banner asks again. If you switch between light and dark mode with the button in the header, that preference is saved the same way under the key theme, and it also stays on your device.

Storing this choice is necessary to respect it, so it does not need consent itself. You can change or withdraw your choice at any time with Cookie settings in the footer of every page. Withdrawing analytics consent also deletes the Google Analytics cookies already set.

Google Analytics

I use Google Analytics 4 (Google Ireland Limited), loaded through Google Tag Manager, to see which pages are read, how visitors find the site, and which of a few key actions they take: clicking the main buttons, asking about a package on the Hire page, opening an email link, sending the contact form (only that it was sent, never what you wrote), running the Tracking Check (only how many issues and warnings it found, never the address you checked), and reading a case study to the end. The setup uses Google Consent Mode V2 in advanced mode:

  • Before you choose, or if you decline: Google Tag Manager still loads, and Google Analytics sends cookieless pings. These contain no cookies or identifiers, only that a page was viewed and basic technical details such as browser type. Google uses them to estimate visits in aggregate. The legal basis is my legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR).
  • If you allow analytics: Google Analytics sets the cookies _ga and _ga_*, which store a random ID for up to 2 years so repeat visits can be recognized. The legal basis is your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG).

Google Analytics 4 does not log or store IP addresses. Analytics data is kept for 14 months and then deleted automatically. If you want to know how the consent signals work in detail, I wrote about it in Consent Mode V2.

Advertising

This site does not currently run advertising tags. The Advertising option in the banner controls the Consent Mode signals ad_storage, ad_user_data, and ad_personalization, and it stays off unless you turn it on. If I add advertising measurement in the future, this page will be updated first.

Contacting Me

When you send the contact form, your name, email address, subject, and message go to a small function on Cloudflare, which delivers them to my inbox as an email through Cloudflare’s own email service. Nothing from the form is stored on the way, and nothing from the form is sent to Google Analytics. To stop the form being flooded, the function also keeps a one-way hash of your IP address for one hour, which only counts how many messages your connection has sent; the address itself is never stored. I use what you write only to reply to you, and delete it when the conversation no longer needs it. The legal basis is answering your request (Art. 6(1)(b) and (f) GDPR).

The Tracking Check

When you run the Tracking Check, the address you enter goes to a small function on Cloudflare, which downloads that one page, reads its HTML, and sends the result back to your browser. Neither the address nor the result is stored. The request to the checked site comes from Cloudflare, not from your device, and identifies itself as “studio.sultankautsar.com tracking check”. To stop the check being misused, the function keeps a one-way hash of your IP address for one hour, which only counts how many checks your connection has run; the IP address itself is never stored. The legal basis is providing the check you asked for (Art. 6(1)(b) and (f) GDPR).

Transfers Outside the EU

Cloudflare and Google may process data in the United States. Both companies are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognizes as providing an adequate level of protection (Art. 45 GDPR).

Your Rights

Under the GDPR you have the right to:

  • access the data held about you (Art. 15),
  • have it corrected (Art. 16) or deleted (Art. 17),
  • restrict its processing (Art. 18),
  • receive it in a portable format (Art. 20),
  • object to processing based on legitimate interest (Art. 21),
  • withdraw consent at any time, without affecting processing before the withdrawal (Art. 7(3)).

To use any of these rights, email [email protected]. You also have the right to complain to a data protection supervisory authority, in particular the one where you live or work (Art. 77 GDPR).

Next step

Have a project in mind? Let's talk.

Tell me what you have and what you need. I'll usually reply within one working day with how I'd approach it.