Privacy Policy

This Privacy Policy explains how personal data is collected and used on https://delavera.dev (the "Website"), operated by Delavera.inc ("Delavera", "I", "me").

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, I am the data controller for the personal data described below.

• Controller: Delavera.inc
• Address: Şekerhane Sk, 18, 07400 Alanya/Antalya
• Email: hello@delavera.dev

If you have any question about this policy or about how your data is handled, write to hello@delavera.dev. I answer privacy requests personally.

I keep data collection to the minimum needed to answer you and to keep the Website running.

Data you give me voluntarily through the contact form:

• Name
• Email address
• Company name (optional)
• Telegram username (optional)
• Budget range (optional)
• The content of your message

Data collected automatically when you visit the Website:

• IP address and approximate country, processed by the hosting infrastructure
• Browser type, device type and operating system
• Date and time of the request and the pages requested
• Security and anti-abuse signals (for example, rate-limiting counters)

I do not ask for and do not want special categories of data (health, political opinions, biometric data and similar). Please do not include such information in your message.

• To reply to your enquiry and discuss a possible project — legal basis: steps taken at your request prior to entering into a contract, Art. 6(1)(b) GDPR, together with your consent given in the form, Art. 6(1)(a) GDPR.
• To operate, secure and troubleshoot the Website, including protection against spam and abuse — legal basis: legitimate interests, Art. 6(1)(f) GDPR.
• To load optional analytics cookies — legal basis: your consent, Art. 6(1)(a) GDPR. Nothing optional is loaded before you accept the cookie banner.
• To comply with legal obligations such as accounting and tax rules, where a project actually starts — legal basis: Art. 6(1)(c) GDPR.

Your data is never sold, rented, or used to build advertising profiles, and you will not receive marketing emails unless you explicitly ask for them.

The Website uses the following browser storage, and nothing else:

• Strictly necessary storage: a single entry in your browser’s local storage that remembers your answer to the cookie banner, so you are not asked on every page. It contains only your choice, the policy version and the date. No consent is required for this.
• Optional analytics cookies (Google Analytics 4): set only after you press "Accept". These are the _ga and _ga_* cookies, which hold a randomly generated identifier and expire after at most two years. If you press "Decline", the Google Analytics script is never downloaded and no such cookie is created.

Separately, Cloudflare Web Analytics measures page performance and visit counts. It sets no cookies, stores no identifier in your browser and does not track you across websites, so it runs without consent on the basis of legitimate interests (Art. 6(1)(f) GDPR). Visitors from the European Union are excluded from this measurement entirely.

You can change your decision at any time via the "Cookie settings" link in the footer, or by clearing your browser storage for this site. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before the withdrawal.

I do not sell or share your data for anyone else’s purposes. A small number of service providers process data on my behalf as processors under Art. 28 GDPR:

• Cloudflare, Inc. — hosting of the Website and of the function that receives the form, plus network security and anti-abuse protection. Cloudflare processes your IP address and request metadata.
• Telegram Messenger Inc. — delivery of your form submission to my private Telegram chat, and any conversation you choose to start with me on Telegram.
• Google Ireland Limited (Google Analytics 4) — audience measurement, but only if you accepted analytics cookies. IP addresses are shortened before storage, and advertising features, ad personalisation and data sharing with other Google products are switched off.

Data may also be disclosed where I am legally obliged to do so, for example in response to a lawful request from a public authority.

The providers listed above operate globally, so your data may be processed outside the European Economic Area, including in the United States. For Google Analytics this is the case whenever you accept analytics cookies; declining keeps your visit entirely outside Google’s systems.

Such transfers are covered by appropriate safeguards under Chapter V GDPR — in particular the European Commission’s Standard Contractual Clauses, supplemented by the technical measures described below. You can request a copy of the relevant safeguards by writing to hello@delavera.dev.

• Enquiries that do not lead to a project: kept for up to 12 months, then deleted, so I can recognise returning conversations.
• Enquiries that lead to a project: kept for the duration of the project and afterwards for as long as statutory accounting and limitation periods require (typically 6 to 10 years, depending on jurisdiction).
• Technical and security logs: kept for a short period, normally no longer than 30 days.
• Your cookie-banner choice: stored in your browser until you clear it or until the policy version changes.

You can ask for earlier deletion at any time — see your rights below.

Under the GDPR you have the right to:

• Access the personal data I hold about you (Art. 15)
• Have inaccurate data corrected (Art. 16)
• Have your data erased (Art. 17)
• Restrict processing in certain situations (Art. 18)
• Receive your data in a portable, machine-readable format (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time, with effect for the future (Art. 7(3))
• Lodge a complaint with a supervisory authority in your country of residence, work or of the alleged infringement (Art. 77)

To exercise any of these rights, write to hello@delavera.dev. I will respond within one month, as required by Art. 12(3) GDPR. There is no charge for a reasonable request.

No automated decision-making or profiling in the sense of Art. 22 GDPR takes place on this Website.

• All traffic to and from the Website is encrypted with TLS.
• Form submissions are delivered through a server-side function; API credentials are stored as encrypted secrets and are never present in the browser.
• Access to submitted enquiries is limited to me personally.
• Rate limiting and anti-spam checks are applied to the form to prevent abuse.

No system is perfectly secure, but if a personal data breach is likely to result in a risk to your rights, I will notify the competent supervisory authority within 72 hours and inform you where required by Art. 34 GDPR.

The Website offers services to businesses and is not directed at children. I do not knowingly collect personal data from anyone under 16. If you believe a child has sent me personal data, write to hello@delavera.dev and it will be deleted.

This policy may be updated when the Website changes or when new service providers are introduced. The date at the top of the page always shows the current version. If a change materially affects how your data is used, the cookie banner will ask for your consent again.