Privacy Policy
This privacy notice describes how personal data is processed when you use this portfolio website. It is a technical transparency template and not legal advice.
Controller
Ömer Faruk CAPUR, Leipzig, Germany. Use the contact button on this page or the homepage contact section.
Data processed
Depending on how you use the site, the following categories may be processed: contact-form submissions (name, email, optional company, inquiry type, message, consent flag), technical request data for first-party analytics (path, locale, referrer/UTM, device/browser/OS, language, timezone, screen size, coarse geo headers from the edge provider, encrypted IP address at rest), server-side resume download requests, admin login and OTP attempt logs, SSR page-request security events, server logs needed to operate the site, and admin security logs for portfolio protection.
Purposes
Responding to inquiries, understanding aggregate traffic to improve the portfolio, delivering resume/media assets, and keeping the website available and secure.
Legal bases
Where applicable under GDPR: Art. 6(1)(b) for processing contact requests you initiate, Art. 6(1)(f) for security and lightweight first-party analytics, and Art. 6(1)(a) where consent is requested in the contact form.
Processors / services
Vercel (hosting/edge delivery), Supabase (database), Resend (transactional email for contact), GitHub (optional profile metrics via public API), RapidAPI/Medium (article sync into the site database via Admin only), and Komarev GitHub profile-views badge (third-party badge hit counter when fetched server-side).
Analytics
The site uses first-party analytics events stored in the operator’s database. Visitor IP addresses are encrypted at rest and shown only in the private admin area. Resume downloads are also logged server-side when the redirect endpoint is called, even if client-side analytics is blocked. Login and security events (OTP requests, blocked access attempts, HTML page requests) are stored separately for abuse detection. No advertising cookies and no third-party ad trackers are used for this purpose. City/country fields come from edge headers when available and can be coarse or unavailable on local development.
Retention
Contact leads, analytics events, and encrypted IP data are retained for security, communication, and portfolio improvement. There is no automatic expiry job — data remains stored until manually deleted (for example when responding to a GDPR erasure request).
Your rights
Depending on applicable law, you may have rights of access, rectification, erasure, restriction, objection, and data portability. Use the contact button on this site to exercise them. You may also lodge a complaint with a supervisory authority.
Cookies / storage
The public site may use browser localStorage for short-lived caches of GitHub feed data. Theme preference may be stored locally.