Privacy Policy

Short Version: I Collect Very Little

James Dennis, trading as jamesdennis.org, based in Italy, is the data controller for personal data handled through this site.

You can contact me at james@jamesdennis.org for any question about this policy or to exercise your rights.

This website does not use a contact form. The contact method is a plain email link. When you click it, your email client opens with my address; nothing is submitted to this site and nothing is stored on it.

Data is handled in exactly three situations:

• You email me directly. I receive your email address, the content of your message, and any attachments or signature details you choose to include. I keep this correspondence in my email account so I can reply and, if we work together, refer back to it.
• You visit the site. The site is hosted on Vercel and proxied through Cloudflare. Both process technical request data (IP address, user agent, requested URL, timestamp) for the purpose of delivering the site and protecting it from abuse. This is standard for any hosted website.
• You email me from a Resend-backed workflow. Resend is the email delivery service used for outbound transactional email (for example, if I reply to you or send an invoice). Resend processes the message metadata needed to deliver that email. It does not read, store, or process the contents of any message you send to me.

No analytics platform runs on this site. No advertising or marketing pixels. No tracking scripts. No cookies. No fingerprinting.

Under the GDPR, processing must have a lawful basis. Mine are:

• Legitimate interest — responding to enquiries you send me, and keeping a record of our correspondence for the duration of our relationship.
• Legitimate interest — allowing the site to be delivered safely and securely, which is why Cloudflare and Vercel log request metadata. The interest is in keeping the site online and protecting it from abuse.
• Legal obligation — if we enter into a contract, I am required to retain invoices and certain business records for the period required by Italian tax law.

I do not use your data for marketing, do not sell it, and do not share it with anyone except the processors named in section 4.

Your data is never sold or shared for advertising. It is disclosed to the following processors:

• Vercel Inc.— hosts the site. Vercel's own privacy policy governs the request logs it processes. Vercel is GDPR-compliant and operates under a data processing agreement.
• Cloudflare, Inc.— proxies the site for security and performance. Cloudflare's privacy policy governs its handling of request metadata.
• Resend, Inc. — delivers outbound email. It processes the metadata needed for delivery, not the contents of messages you send me.
• My own email provider — hosts my inbox where correspondence is stored, under their own terms.

I do not transfer personal data outside the EU except via the above processors, each of which has appropriate safeguards in place (EU Standard Contractual Clauses or equivalent).

• Enquiry emails that don't become projects — kept for up to 12 months, then deleted.
• Correspondence from active or past clients — kept for the duration of the working relationship plus the period required by Italian tax law for business records (currently 10 years for accounting documents).
• Vercel / Cloudflare request logs— retained according to each processor's own default retention periods (typically days to weeks).

Under the GDPR, you have the right to:

• Access — know what data I hold about you.
• Rectification — have inaccurate data corrected.
• Erasure— have your data deleted, subject to the retention I'm required to keep by law.
• Restriction — ask me to limit how your data is used.
• Portability — receive the data you provided in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — where processing is based on consent, which for this site applies to nothing.

To exercise any of these, email james@jamesdennis.org. I respond within 30 days.

You also have the right to complain to a supervisory authority. In Italy, that is the Garante per la protezione dei dati personali. If you live elsewhere in the EU, you may complain to your national authority.

The site runs on HTTPS, sits behind Cloudflare's security layer, and does not store user data on its own servers. My email account is protected by strong authentication. If I discover a security incident that affects your data, I will inform you within 72 hours where required by law.

For the responsible-disclosure route if you believe you have found a vulnerability, see my security policy.

If this policy changes, the new version will be published at this URL with an updated date. Material changes will be noted on the page itself.