Privacy Policy

The data controller responsible for your personal data is Alan Saldivar, operating through the website alansaldivar.dev. For any inquiries regarding data processing, you may contact us at hi@alansaldivar.dev or through the contact page on this Site.

We collect information that you provide directly, as well as certain data collected automatically when you use the Site.

Information you provide directly

• Contact form: name, email address, company name, service of interest, and your message.
• AI chat assistant: conversation content and, if you choose to submit the lead form, your name, email, company, project type, timeline, budget, and project requirements.
• Resume requests: email address, name, and message. Resume download attempts are logged with obfuscated IP, user agent, locale, and source for security monitoring.
• Client portal: email address, name, company, and optional avatar. Portal access is by invitation only.
• Quote interactions: acceptance or rejection of quotes sent to you.

Information collected automatically

• IP address hash: We store a one-way SHA-256 hash of your IP address for rate limiting and abuse prevention. The original IP address is not stored.
• User agent and locale: collected for security monitoring and to serve content in your preferred language.
• Cookie consent preferences: your choices regarding cookie categories (necessary, functional, analytics).
• Analytics data: when you consent to analytics cookies, anonymous and aggregated usage data is collected via Vercel Analytics and Vercel Speed Insights. No personally identifiable information is included.

Payment information

Payment transactions are processed entirely by Stripe. We do not store your credit card numbers or full payment details on our servers. We retain Stripe customer IDs, payment IDs, amounts, and transaction status for record-keeping.

We use the information we collect for the following purposes:

• To respond to your inquiries, process contact form submissions, and fulfill service requests.
• To send transactional emails including lead confirmations, resume download links, portal magic links, client invitations, and quote notifications via our email provider.
• To power the AI chat assistant, which uses your conversation to provide relevant responses about our services.
• To analyze site traffic and performance through anonymous, aggregated analytics (only with your consent).
• To protect against fraud, abuse, and unauthorized access through bot verification, rate limiting, and IP hashing.
• To comply with applicable legal obligations and enforce our terms of service.
• To manage client relationships, projects, deliverables, and billing through the client portal.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:

• Consent: For analytics cookies, functional cookies (AI chat), and sending marketing communications. You can withdraw consent at any time through cookie settings or by contacting us.
• Contractual necessity: To process data required to provide requested services, manage client projects, process payments, and fulfill quotes or agreements.
• Legitimate interest: For security measures (IP hashing, rate limiting, bot protection), improving our services, and responding to inquiries. Our legitimate interests do not override your fundamental rights.
• Legal obligation: To comply with applicable laws, regulations, tax requirements, and legal processes.

This Site uses cookies to function properly and, with your consent, to analyze usage. You can manage your preferences at any time.

• Necessary cookies: PORTFOLIO_LOCALE (language preference, 1 year), PORTFOLIO_CONSENT (cookie consent choices, 1 year), NextAuth session cookies (authentication), and Cloudflare Turnstile cookies (bot verification). These cannot be disabled.
• Functional cookies: Enable enhanced features such as the AI chat assistant. These are only active when you grant functional cookie consent.
• Analytics cookies: Vercel Analytics and Vercel Speed Insights collect anonymous, aggregated data about site usage and performance. These are only active when you grant analytics cookie consent.

You can update your cookie preferences at any time using the "Cookie Settings" link in the site footer or through your browser settings.

We share data with the following service providers who process information on our behalf. Each operates under their own privacy policies and data processing agreements:

• Vercel: Website hosting, serverless functions, Vercel Postgres database, Vercel Analytics, and Vercel Speed Insights. Data is processed in the United States.
• Stripe: Payment processing for invoices and checkout. Stripe processes payment information under PCI DSS compliance. We share lead IDs, quote IDs, and payment metadata with Stripe.
• Resend: Transactional email delivery for lead notifications, resume download links, portal magic links, client invitations, reminders, and security alerts. Email addresses, names, and message content are shared.
• Cloudflare: Turnstile bot protection on forms. IP addresses and verification tokens are processed by Cloudflare to prevent abuse.
• Google (Gemini AI): Powers the AI chat assistant. Conversation content is sent to Google's Gemini API for generating responses. Messages are streamed and not persistently stored by Google under the AI SDK usage terms.

These providers act as data processors under applicable data protection law. We maintain data processing agreements with each provider where required. [REVIEW WITH COUNSEL: Confirm DPA status with each provider]

We retain personal data only as long as necessary for the purposes described in this policy:

• Lead and contact data: Retained for up to 24 months after last interaction, or until you request deletion.
• Chat messages: Conversation history associated with leads is retained alongside lead data. AI conversations that do not result in a lead submission are not stored.
• Client data: Retained for the duration of the business relationship and for up to 5 years after for legal and accounting purposes. [REVIEW WITH COUNSEL: Confirm retention period]
• Payment records: Retained for 7 years as required by tax and accounting regulations. [REVIEW WITH COUNSEL: Confirm jurisdiction-specific requirements]
• Analytics data: Retained according to Vercel's data processing policies. Analytics data is anonymous and not linked to individual users.
• Cookie consent preferences: Stored for 1 year from the date of your last preference update.

You may request deletion of your personal data at any time by contacting us. We will respond within 30 days and delete or anonymize data unless retention is required by law.

Our service providers are primarily based in the United States. If you are accessing the Site from the EEA, UK, Switzerland, or other regions with data transfer restrictions, please be aware that your data may be transferred to and processed in the United States.

We rely on the following safeguards for international transfers: Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions where applicable, and the data protection frameworks maintained by our service providers. [REVIEW WITH COUNSEL: Verify transfer mechanisms with each provider]

By using this Site and providing your information, you acknowledge that your data may be processed in the United States, where data protection laws may differ from those in your jurisdiction.

Rights under GDPR (EEA, UK, Switzerland)

If you are in the European Economic Area, United Kingdom, or Switzerland, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data, subject to legal retention requirements.
• Right to restriction: Request that we limit processing of your data in certain circumstances.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interest, including for direct marketing.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent. This does not affect the lawfulness of prior processing.
• Right to lodge a complaint: You have the right to file a complaint with your local data protection supervisory authority.

Rights under CCPA (California residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected.
• Right to delete: Request deletion of personal information we have collected from you.
• Right to opt-out of sale: We do not sell your personal information to third parties. No opt-out action is required.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise any of these rights, contact us at hi@alansaldivar.dev. We will respond within 30 days (or the applicable statutory period). We may need to verify your identity before processing your request.

We implement appropriate technical and organizational measures to protect your personal information:

• IP hashing: IP addresses are processed through SHA-256 one-way hashing before storage, preventing reconstruction of original addresses.
• Password security: Administrative passwords are hashed using bcrypt with salt rounds.
• Session management: Authentication uses secure JWT tokens with an 8-hour maximum session duration.
• Rate limiting: API endpoints are protected with rate limiting (e.g., 30 requests per 15 minutes for AI chat) to prevent abuse.
• Bot protection: Cloudflare Turnstile is used on forms to prevent automated submissions.
• Encryption in transit: All data is transmitted over HTTPS/TLS encryption.
• Access control: Administrative access is restricted to authorized personnel with role-based permissions.

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but commit to promptly addressing any data breach in accordance with applicable notification requirements.

This Site is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided personal information through the Site, please contact us at hi@alansaldivar.dev and we will promptly delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top and bottom of this page. We encourage you to review this policy periodically. Your continued use of the Site after changes constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: hi@alansaldivar.dev
• Website: alansaldivar.dev/contact

We aim to respond to all privacy-related inquiries within 30 days.