What this site keeps, and why.

Last updated: 5 October 2026

Who is responsible

This site is run by Klara Condac, trading as Klara Condac Consulting, an independent consultant based in Lisbon, Portugal. I am the controller of the personal data described here. For anything on this page, write to consulting@klaracondac.com. You will get a reply from me, not a ticket system.

The short version

• The site sets no cookies and uses no third-party analytics, advertising or tracking scripts.
• Visits are counted on my own server, without storing your IP address and without any identifier that follows you from one day to the next.
• If you talk to the assistant, the conversation is saved so I can read it, and it is processed by an AI model to write the replies.
• If you give me your name and email, I use them to reply to you about your enquiry. Nothing else.
• You can ask to see, correct or delete anything held about you, at any time.

When you read the site

Every page request passes through a small program I run on Cloudflare, which logs the visit to a database only I can see. For each page it records:

• the page and the date and time,
• the page you came from, if your browser sends it,
• your country, worked out by Cloudflare from your IP address,
• the kind of device (desktop, mobile or tablet), and, for automated visitors, the name the crawler gives itself,
• a short code made by scrambling your IP address and browser details with a secret that changes every day. It lets me count how many different people visited on a given day. Because the secret changes daily, the code cannot be used to recognise you on another day, and your IP address itself is never stored.

A few lines of script on each page also send, once, how long you spent on the page and how far you scrolled. On the demos page it notes which demo you opened, and anywhere on the site it notes when the "Book a call" link is clicked and where that link was. These carry the same daily code and nothing more.

I use this to understand which pages are useful and to tell real readers from automated traffic. Detailed visit records are deleted after about 13 months (400 days). Daily totals with nothing personal in them are kept.

Your browser also keeps the current assistant conversation in session storage, so it survives moving between pages. It never leaves your device by this route, and your browser clears it when you close the tab.

When you talk to the assistant

The chat assistant on this site is an AI. When you send it a message:

• The conversation so far is sent to my server and on to OpenRouter, which passes it to the AI model provider that writes the reply. They process it to produce the answer.
• The whole conversation is saved to my Airtable account, along with the page you started on, your country, your device type, when it started, and technical figures such as the length of the reply and what it cost to produce. If you rate a reply with a thumbs up or down, and add a reason, that is saved too.
• Your IP address is used briefly to stop the assistant being flooded with requests. That record is wiped every day at midnight UTC and is never written to Airtable.

I read these conversations to answer enquiries, to see what visitors are looking for, and to fix the assistant when it gets something wrong. Please do not share anything sensitive in the chat, such as health details, passwords or other people's personal information. It does not need any of it.

When you leave your details

If you want me to follow up, the assistant asks for your name, email, and optionally your organisation. Those details, and the conversation they came from, are sent to me by email through Formspree, a form-delivery service, and the conversation record in Airtable is marked with your name, email and a short summary of what you need.

The contact form on the contact page works the same way: your first name, last name, email and message are delivered to me through Formspree. If you email me directly, your message sits in my mailbox like any other email.

I use these details only to reply to you and to discuss the work you asked about. You will not be added to a mailing list.

When you book a call

The "Book a call" links take you to Cal.com, a separate scheduling service. Whatever you enter there is collected by Cal.com under its own privacy policy, and shared with me so the call can happen.

Other services this site depends on

Some services see basic technical information, such as your IP address, simply because your browser connects to them:

• Cloudflare hosts the site and protects it from attacks. It processes every request on my behalf.
• Google Fonts supplies the typefaces. Your browser fetches them from Google, which receives your IP address in doing so.
• jsDelivr supplies the code and map data for the map on the clients page, and receives your IP address when that page loads.
• OpenRouter and the AI model provider it routes to, Airtable and Formspree, as described above, only when you use the assistant or a form.

Links to LinkedIn, Upwork and client websites lead to sites with their own privacy policies. Nothing from those sites is loaded until you click.

Several of these providers are based in the United States. Where your data leaves the European Economic Area, it is covered by the safeguards those providers offer under EU data protection law, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Why I am allowed to use it

Under the GDPR, each use above needs a legal basis:

• Counting visits, keeping the site secure, and saving assistant conversations: my legitimate interest in running a working, safe site and in improving how it answers visitors. I keep these as light as possible, as described above.
• Replying to an enquiry: taking steps you asked for before a possible contract, and my legitimate interest in answering people who contact me.
• Records of paid work: legal obligations such as Portuguese tax and accounting rules, once we actually work together.

How long it is kept

• Visit records: about 13 months (400 days), then deleted automatically.
• Assistant conversations and enquiries: as long as they are useful for answering you and following up, and no longer than 24 months after our last contact, unless we start working together.
• Client records: for as long as the law requires once there is a contract and invoices.

Your rights

You can ask me to:

• tell you what I hold about you and give you a copy,
• correct anything that is wrong,
• delete it,
• stop or limit using it, including objecting to uses based on legitimate interest,
• give it to you in a format you can take elsewhere.

Write to consulting@klaracondac.com. I will reply within one month. Because visit records hold no name, email or stable identifier, I usually cannot pick out yours, but for a conversation with the assistant it helps if you tell me roughly when it happened and what it was about.

If you are not happy with how I have handled your data, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority where you live.

Children

This site is for businesses and the people who work in them. It is not meant for children, and I do not knowingly collect anything from anyone under 16.

Changes to this policy

If what the site collects changes, this page changes with it, and the date at the top moves. Anything that would use your data in a new way will be stated here before it starts.