The short version
- No analytics, no tracking pixels, no advertising cookies, no profiling.
- The form on the work with me page reaches this server when you send it: your answers are stored in this project's own database and emailed to me so I can reply. Until you press send, nothing leaves your browser.
- One cookie, and it holds the language you are reading in.
- Fonts are served from this server, so opening a page sends no request to Google.
- The video panel loads nothing from YouTube until you press play.
Controller
The controller under the GDPR is:
- Company
- Omega Do. IT Solutions e.U.
- Address
- Hermann Glück Weg 6/4/Ground Floor/Top 1C, 1120 Vienna, Austria
- hi@momikaeli.com
- Phone
- +43 66 56 56 30000
Server log files
Every request to this site is written into the web server's log by the hosting infrastructure. A log line holds the IP address, the date and time, the address requested, the status code, the number of bytes sent, and the browser's user agent and referrer.
That is a technical property of running a server, and it is what makes it possible to find a broken page or an intrusion attempt. The logs are not joined to anything else, no profile is built from them, and nobody is analysed with them.
Legal basis: Art 6(1)(f) GDPR, the legitimate interest in operating this site and keeping it secure.
- Retention
- Access logs are deleted after 30 days.
Cookies and browser storage
Two things are stored in a visitor's browser, and a third only after a login to the admin panel. None of them is used to recognise you.
- NEXT_LOCALE (cookie)
- Holds the language code (en, fa or de) so the site opens in the language you last read. It carries no expiry date, so it goes away when the browser session ends, and it is sent only to this site.
- theme (local storage)
- Holds light or dark. It stays inside your browser and is never sent to the server.
- payload-token (cookie)
- Set only after a successful login to the admin panel. A visitor never receives it.
Why there is no cookie banner
None of the entries above needs consent. All of them are strictly necessary for a function you asked for, which is the exception the Austrian Telecommunications Act makes for storage on your device. A banner asking permission for a language code would be theatre.
The day anything is added that does need consent, it will be asked for properly, and this page will say so before it happens.
The form on the work with me page
Until you press send, what you type into the qualification form stays in your browser, and it is checked there. Pressing send transmits the following to this server: your role, the company or project, your email address, the pain point, how you are handling it today, what the delay costs you, the outcome you want, whether you can decide to act, how urgent it is, the language you prefer for the call, a budget range if you enter one, and your confirmation that you understand the call is paid.
That is stored as one row in this project's own PostgreSQL database, on the same infrastructure the site runs on, and a copy of it is emailed to hi@momikaeli.com so the request can be seen and answered. Only the site administrator can read those rows.
Alongside what you wrote, three facts about the submission itself are kept: which language you were reading the site in, what the form concluded from your description (clear or ambiguous), and whether the notification email went out.
No IP address, user agent, referrer or any other identifier is stored in that row. To keep automated bulk submissions out, the sender's IP address is held in the server's memory only, hashed with a random key, for at most fifteen minutes. It is written to no table and it is gone when the service restarts.
Legal basis: Art 6(1)(b) GDPR, steps prior to a contract taken at your own request.
You can ask for your request to be deleted at any time; an email to hi@momikaeli.com is enough.
- Retention
- A request is deleted 12 months after the last contact about it. If a contract comes out of it, the seven year accounting retention period under §132 of the Federal Fiscal Code takes over for the documents concerned.
If you write to hi@momikaeli.com, your address, your name if you give one, and whatever you write are processed in order to answer you. Mail for this domain is received on the same server that runs this site.
Legal basis: Art 6(1)(b) GDPR when the exchange concerns a contract or a step before one, otherwise Art 6(1)(f), the legitimate interest in answering people who write.
Correspondence is kept while the matter is open. Where a message becomes part of a business transaction, the seven year accounting retention period under §132 of the Federal Fiscal Code applies to the documents concerned.
The usage counter on the tools pages
Following a link out to one of the tools, or clicking the consultation link next to it, adds one to a counter. It is worth writing down exactly what that counter is, because it is unusual.
One row exists per tool, per action, per calendar day, and it holds a number. There is no visitor row. The table has no field for an IP address, a user agent, a cookie or any identifier, and the endpoint reads nothing from the request except the two words in its body. Two people clicking on the same day become one number, and there is no way back from that number to either of them.
Since nothing personal is stored, this counter falls outside the GDPR entirely.
Video
The video panel on the home page shows a still image served from this server and a play button that belongs to this site. While the page loads, nothing at all is requested from YouTube or Google.
Press play and the player is loaded from youtube-nocookie.com. From that moment Google receives your IP address and processes data under its own privacy policy, as a controller in its own right. This happens only because you clicked. Legal basis: Art 6(1)(a) GDPR, the consent you give by pressing play.
- Google privacy policy
- policies.google.com/privacy
Fonts
Every font is downloaded when the site is built and served from this server. Opening a page sends no request to Google Fonts, to Fontshare or to any other font host, so no font provider ever sees your IP address.
Processors
Two companies process data on my instructions.
- Hetzner Online GmbH
- Hosting for the application and the database, in Germany. Everything this site runs on sits inside the EU.
- Twilio (SendGrid)
- Transactional email. Two messages travel this way: the password reset for the administrator account, and the notice that a request came in through the work with me form. The second one carries the text of that request and the sender's email address.
Transfer outside the EU
SendGrid belongs to Twilio, a company in the United States, so a transfer to a third country is involved. It rests on the data processing agreement with Twilio and the European Commission's standard contractual clauses. What travels this way is the administrator's own email address and, if you send the form on the work with me page, the text of your request and your email address. Ordinary browsing sends nothing down this path.
What is not here
Some of what matters most on this site is what is absent from it:
- No analytics tool of any kind is installed, neither Google Analytics nor a self hosted alternative.
- No advertising, no retargeting, no social plugins. The links to LinkedIn, X and Instagram in the footer are ordinary links that load nothing until you click them.
- No newsletter, no visitor accounts, no comment function.
- No automated decision making and no profiling.
Your rights
Under the GDPR you can ask for:
- access to the data held about you (Art 15)
- correction of anything that is wrong (Art 16)
- erasure (Art 17)
- restriction of processing (Art 18)
- a copy in a portable format (Art 20)
- objection to processing based on legitimate interest (Art 21)
How to exercise them
One email to hi@momikaeli.com is enough. There is no form and no fee, and an answer comes within a month. Given how little is processed here, most of these requests have a very short answer.
Complaint to the supervisory authority
If you believe the processing here breaks the law, you can complain to the authority:
- Authority
- Österreichische Datenschutzbehörde
- Address
- Barichgasse 40-42, 1030 Vienna, Austria
- Website
- www.dsb.gv.at
Changes to this page
This page describes the site as it is built today. Anything planned but not yet live is left out rather than described as though it existed.
If any of what is listed above as absent ever arrives, this page changes before it does.