Privacy Policy

What I collect

When you submit the contact form or project brief, I receive the information you type (name, email, project details) plus technical metadata (IP address, timestamp, user agent) for spam protection. Plausible Analytics records anonymized page views without cookies or personal identifiers.

Why I collect it

To reply to your message, deliver the work we agreed on, prevent spam and abuse, and understand which pages are useful. I never sell your data. I never share it with third parties for marketing.

Third-party services

Contact form submissions and data-deletion requests are delivered via Mailcow (self-hosted email on mail.cleida.com.co, co-located with the cleida.com.co mail cluster). Project briefs also create a task in ClickUp (project management, US-hosted). Both processors are bound by data-processing agreements. Plausible Analytics is cookieless and self-hosted in the EU. Google Analytics 4 is opt-in and only loads after you accept the cookie banner — IP is anonymised before storage.

How long I keep it

Form submissions stay in my inbox until the project is finished and invoiced, then archived for tax records. You can ask me to delete them earlier.

Your rights

Under Colombia's Ley 1581/2012, Brazil's LGPD, and the EU's GDPR, you can request access, correction, deletion, or portability of your data at any time. Email info@andresmorales.com.co and I will respond within 15 business days.

Changes to this policy

If I update this page I will change the date above. Material changes will be announced on the home page.

Questions

Email info@andresmorales.com.co. I am the data controller.

Your rights under GDPR (EEA / UK)

If you are in the European Economic Area or the UK, the General Data Protection Regulation gives you the following rights. I honor them regardless of where you live.

• Right of access — request a copy of the personal data I hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure ('right to be forgotten') — delete your data, subject to legal exceptions.
• Right to restriction — limit how I process your data while a dispute is resolved.
• Right to data portability — receive your data in a machine-readable format.
• Right to object — object to processing based on legitimate interest or for direct marketing.
• Right related to automated decision-making — I do not make decisions about you by automated means.
• Right to withdraw consent — at any time, without affecting prior lawful processing.
• Right to lodge a complaint with a supervisory authority in your country.

Your rights under CCPA / CPRA (California)

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act give you the following rights.

• Right to know what personal information is collected, used, shared, or disclosed.
• Right to delete personal information I hold about you.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. I do not sell or share personal information for cross-context behavioral advertising.
• Right to limit use of sensitive personal information to that necessary to provide the service.
• Right to non-discrimination for exercising any of the above rights.

Do Not Sell or Share My Personal Information

Lawful basis for processing (GDPR Article 6)

Under GDPR I must declare the legal basis for each processing activity. The summary:

• Consent — analytics cookies and any non-essential tracking. You can withdraw at any time.
• Contract — processing needed to deliver the services you engaged.
• Legal obligation — retaining tax records (invoices) for the Colombian statutory period.
• Legitimate interest — spam and abuse prevention, basic site analytics (with consent). I balance these against your rights and provide an opt-out.
• Vital interests — not applicable to this site.

International data transfers

Some of my processors (ClickUp, Google Analytics) are based outside your country. Outbound email is delivered via Mailcow (self-hosted on mail.cleida.com.co — no third-party SaaS). Where GDPR applies, international transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission. Where Colombia's SIC or Brazil's ANPD apply, transfers rely on equivalent contractual safeguards.

Processors and locations: Mailcow (self-hosted, mail.cleida.com.co — for outbound email), Google Analytics / GCP (Ireland / US, EU-US Data Privacy Framework, only loaded after cookie consent), ClickUp (US with SCCs), Hetzner (Germany, EU for backups).

Children's privacy

This site is not directed at children under 16 (or 13 under COPPA, where applicable). I do not knowingly collect personal data from children. If you believe a child has submitted data through the contact form or brief, email info@andresmorales.com.co and I will delete it within 7 business days.