Privacy Policy

At a glance

This site collects the information you submit in the contact form — name, email, message — and nothing else. I don't run analytics that profile you.

What I collect

• Contact form: the name, email address, and message you submit. These are only used to reply to you.
• Aggregate, anonymous page metrics via Vercel Analytics. The script does not set cookies and does not build an individual profile of you.

Where it goes

Your contact-form submission is sent through Resend, a US-based email delivery service, to my personal inbox. Nothing is written to a database. Resend privacy policy.

How long I keep it

Contact-form emails are retained for as long as our conversation is active and up to 24 months after the last reply, after which I delete them. You can ask for earlier deletion at any time. Vercel Analytics retains aggregate data per its own retention policy.

Lawful basis

For the contact form: legitimate interest (GDPR Art. 6(1)(f)) — specifically, replying to inbound inquiries you initiated. For aggregate analytics: also legitimate interest, kept minimal and cookieless. If you'd rather not have your message processed, don't submit the form — there's no other collection point on this site.

International transfers

The third-party services listed below process data in the United States. For visitors in the EU, UK, or other regions with adequacy-equivalent privacy laws, transfers rely on the EU–US Data Privacy Framework where the vendor participates, and on Standard Contractual Clauses otherwise. Each vendor's current transfer-mechanism status is documented in their own privacy policy, linked under “Third parties” below.

Your rights (EU/UK)

If you are in the EU, UK, or another jurisdiction with equivalent privacy laws, you have the right to request access to the information I hold about you, to ask for corrections or deletion, to request portability, to object to processing, and to withdraw consent. I aim to respond within 30 days. To exercise any of these rights, use the contact form or email me directly at you@zachlamb.io.

If you believe I have mishandled your data, you have the right to lodge a complaint with your local supervisory authority. UK visitors can contact the ICO; EU visitors can find their national DPA via the EDPB members list.

Children

This site is not directed at children under 16, and I do not knowingly collect information from them. If you believe a child has submitted information through the contact form, email you@zachlamb.io and I'll delete it.

California (CCPA)

I am not a “business” as defined by the California Consumer Privacy Act (CCPA). I do not sell or share personal information for cross-context behavioral advertising. If that ever changes, this notice will be updated and a “Do Not Sell or Share” link will appear in the footer.

Cookies

I set a single functional cookie — NEXT_LOCALE — to remember your language preference. I do not set tracking, advertising, or third-party analytics cookies.

Third parties

This site relies on the following services that may process your information on my behalf:

• Vercel — hosts the site and provides privacy-preserving aggregate analytics. Aggregate metrics only; the script does not set cookies and does not build an individual profile of you.
• Resend — delivers the email generated when you submit the contact form. Resend processes your name, email address, and message strictly to deliver that one email to my inbox.
• Sentry — collects application errors so I can fix them. Captured events include the URL, browser/OS user agent, viewport size, and a session replay only when an error fires (text content is masked, media is blocked). No cookies, no analytics tracking. Sentry is only active when DSN environment variables are set; you can request that I disable it for your sessions.

Each has its own privacy policy, linked above. I don't share your information with anyone else.

Privacy questions

For any privacy-related question, the fastest path is email: you@zachlamb.io.