How your data is handled

This website, www.sephberedo.com, is run by Seph Beredo, a freelancer based in the Philippines. I decide how and why the personal data described here is used, which makes me the personal information controller under the Philippine Data Privacy Act of 2012.

For anything about your data, email [email protected]. I read every message myself.

The enquiry form. When you send an enquiry I receive:

• your name, email address and website address
• your business name, if you give it
• your message about what you cannot currently prove
• which starting point you chose (the diagnostic or the build) and, if you pick one, where you are based
• a random reference number for the enquiry, so it can be matched to my records

I use these to reply to you, to understand your project and to prepare a quote. The legal basis is your request: you asked me to contact you about work, and these are the steps before any contract.

Where you came from. If the link you followed to this site carried campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content) or an advertising click identifier (gclid, gbraid, wbraid, fbclid, msclkid), the site notes them, along with the first page you landed on and the website that sent you (its domain only, never the full address). These are kept in your browser tab only, in session storage, and are deleted when you close the tab. If you send an enquiry, they are sent with it. I use them to learn which channels bring enquiries. No cookie is set for this.

Small settings in your browser. The site also keeps three small settings in your tab's session storage, so it behaves the same if you reload: whether the opening animation has already played, whether you paused the animations, and which starting point you clicked. They never leave your browser and are deleted when you close the tab. Your cookie choice is the one thing kept longer, in local storage, for 6 months. None of this storage is a cookie, none of it identifies you, and none of it is used for analytics.

Spam protection. The form uses Cloudflare Turnstile to tell people from bots. It loads only when you start using the form. Cloudflare processes technical information such as your IP address and browser and device signals to run the check, as described in the Cloudflare Turnstile privacy addendum. The form also has a hidden field that people never see; it is only there to catch automated submissions.

Hosting. The site is hosted by Netlify. Like every web host, Netlify records technical request data (IP address, browser type, the page requested and the time) to deliver and protect the site. See the Netlify privacy policy.

Two analytics tools run on this site, and only after you accept them in the consent banner. If you decline, or ignore the banner, neither loads.

• Google Analytics 4, loaded through Google Tag Manager. It counts visits and records which pages and buttons are used. Google processes the data; see how Google uses data from sites that use its services. Analytics data is kept for 14 months.
• Microsoft Clarity. It records how pages are scrolled and clicked, as heatmaps and session replays. Every form field is masked, so what you type is never recorded. Microsoft processes the data; see the Microsoft Privacy Statement and Clarity data retention.

When you send an enquiry, the analytics tools receive an event that says an enquiry was sent, with the starting point you chose, your country if you gave it, whether you gave a business name, the campaign tags and click identifiers described above, and the random reference number. They never receive your name, email address, website, business name or message.

With your consent, Google Analytics sets _ga and _ga_ followed by an id (kept up to 2 years), and Clarity sets _clck (1 year) and _clsk (1 day) on this site, plus CLID and MUID on Microsoft's own domains. Your choice itself is kept in your browser's local storage for 6 months so the banner does not return on every visit; it is not a cookie. Change it any time with Cookie settings at the bottom of every page. I do not use Google Ads or Meta (Facebook and Instagram) tracking on this site.

I do not sell your data, rent it, or share it for anyone else's advertising. The only other parties that handle it are the service providers that run parts of this site and my business, each only for that purpose:

• Netlify, hosting (United States)
• Cloudflare, spam protection (United States)
• Resend, sends each enquiry to my inbox (United States)
• Zapier, files each enquiry into my lead tracker (United States)
• Google Sheets, my lead tracker (Google)
• Google Analytics, only with your consent (United States)
• Microsoft Clarity, only with your consent (United States)
• Hostinger, my business email inbox, where enquiries arrive (Lithuania)

Some of these providers store data outside the Philippines, mainly in the United States. I use providers that protect personal data under written terms, and I would also disclose data if the law required it.

• Enquiries that do not become a project: deleted 24 months after our last contact.
• Enquiries that become a project: kept for the project, then for as long as tax and accounting law requires me to keep business records.
• Campaign tags and click identifiers in your browser: until you close the tab.
• Analytics data: 14 months in Google Analytics; Clarity data for the periods Microsoft sets, linked above.
• Hosting and spam protection records: for the periods Netlify and Cloudflare set, linked above.

The site is served over HTTPS only. The form checks every submission on the server, rejects anything that does not look like a real enquiry, and never stores what you type in your browser. Enquiries are only accessible to me. No system is perfectly secure, but if a breach ever put your data at risk I would tell you and the National Privacy Commission as the law requires.

Under the Philippine Data Privacy Act of 2012 you have the right to be informed, to access your data, to object, to have it corrected, erased or blocked, to receive it in a portable format, to claim damages, and to complain to the National Privacy Commission.

Wherever you are, you can ask me to show you what I hold about you, correct it, delete it, or stop using it. Email [email protected]. I may ask you to confirm the request comes from you, and I will answer within 30 days. There is no charge.

If you are not happy with my answer, you can complain to:

• in the Philippines, the National Privacy Commission
• in Australia, the Office of the Australian Information Commissioner
• in the United States, the privacy regulator or attorney general of your state

This site is for businesses and is not aimed at anyone under 18. I do not make automated decisions about you or build profiles from your data. If this policy changes, the date at the top of this page changes with it, and anything that changes how your existing data is used will be emailed to you first.