Privacy

1When you request a site

The request form sends us:

• the address you want (like yourname),
• your email address,
• what the site is for and the description you write,
• the date and time of the request.

We use this only to review your request and to email you about it. We need it because you asked us for a site (GDPR article 6(1)(b)). Without an email address we can't handle your request, because we have no other way to answer you. It is stored on our own server in Belgium and is only read by the person who reviews requests. We don't share it with anyone, apart from Cloudflare and Google as described below.

So we see new requests quickly, a copy of each request is emailed to our Gmail inbox. That means Google also gets your email address and the rest of your request.

A person decides on every request. Nothing is decided about you automatically.

2The bot check

To stop bots from flooding us with fake requests, the form uses Cloudflare Turnstile. It only loads once you start filling in the form; just reading the page doesn't load it. It runs in a small frame from Cloudflare, which looks at things like your IP address and browser to tell people from bots. Cloudflare tells us only whether the check passed. See Cloudflare's Turnstile privacy addendum for what they do with it.

The check is strictly necessary to send the form safely, so it needs no separate consent. We use it because we have a legitimate interest in keeping the service free of spam and abuse (GDPR article 6(1)(f)).

3When you visit

• The site runs through Cloudflare, which delivers the pages and protects the server against attacks. Like any network, it handles your IP address to do that, and it may add its own security checks to the pages (legitimate interest in a safe service, GDPR article 6(1)(f)).
• Our own server keeps no visitor logs.
• To limit how many requests one network can send, your IP address is kept in memory for about an hour. It is never written to disk.
• The pages use your device's own fonts and load nothing from Google Fonts or any other outside server, so visiting doesn't send your IP address to Google.

4Cookies

We set no cookies and use no analytics, ads or tracking. Our pages don't use local storage either. That's why there is no cookie banner: there is nothing to accept or refuse.

The only thing that reads anything from your browser is the bot check above, and only after you start the form. If Cloudflare ever stores something for that check, it is a security measure that is strictly necessary to send your request.

5Email

We use Gmail for all email: our contact links open an email to [email protected]. This means:

• When you email us, Google handles your message and your email address.
• Every site request is also emailed to that inbox, so Google gets your email address and what you wrote in the form.
• When we email you (about your request or anything else), it comes from that Gmail account, so Google sees your email address and our messages too.

We use Gmail because it is a reliable way for a small project to send and receive mail. Google handles this mail under its own terms. See Google's privacy policy for what Google does with it.

6Who else gets your data

• Cloudflare (Cloudflare, Inc., USA): delivers the site and runs the bot check.
• Google (Google Ireland Ltd. and Google LLC, USA): our email.

Both companies may handle data outside the EU, mainly in the United States. Both take part in the EU-U.S. Data Privacy Framework, which the European Commission has decided gives adequate protection, and both also use the EU's standard contractual clauses. Nobody else gets your data, and we never sell it.

7How long we keep it

• Requests on our server are deleted automatically after 180 days, or sooner if you ask.
• Request emails in our inbox are kept until you ask us to delete them.
• If your site is approved, we keep your email address for as long as your site exists, so we can reach you about it.
• Emails you send us are kept only as long as we need them to help you.
• IP addresses are kept in memory for about an hour.

8Children

If you're under 13, a parent or teacher has to send the request for you, using their own email address. If we find out that a child under 13 sent a request on their own, we delete it.

9Your rights

You can ask us to:

• see the data we have about you, or get a copy you can take elsewhere,
• correct it,
• delete it,
• limit how we use it, or object to how we use it.

Email us and we'll answer within a month. It's free.

If you think we handle your data wrongly, you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, [email protected].

10Contact

is-on-the-web is run by Tudor Cojocaru Gofita in Belgium, who is responsible for your data (the data controller). For anything about your data, email [email protected]. See the legal notice for more.