Who is responsible
Simon Rajala, acting as an individual, is responsible for personal-data processing on simonrajala.com. For questions about your personal data or to exercise your privacy rights, please use the contact form.
Website and contact form
Vercel hosts this website and processes technical request information to deliver and secure it. The contact form uses your name, email address and message to answer your enquiry. Resend delivers messages to the mailbox hosted by Hostinger Mail. Your address is used for replies. Sending a message does not subscribe you to marketing.
Cloudflare Turnstile processes browser and connection signals to prevent automated abuse. The server sends the challenge token and request IP address for verification. Cloudflare also processes signals as a controller to improve bot detection; see its Turnstile privacy notice.
Upstash Redis stores an IP-derived keyed identifier and attempt counter for a ten-minute rate-limit window. It does not store your name, email address or message in that counter. Provider security and delivery records are separate.
Website operation, security and ordinary correspondence rely on legitimate interests in running the site, preventing abuse and responding to people who contact me. Where an enquiry concerns potential work, processing may also be necessary for steps you request before a contract. Privacy-rights requests are handled to meet applicable data-protection obligations.
Optional analytics
With your consent, Google Analytics 4 measures how visitors find and use the website. It uses pseudonymous browser identifiers and records page visits, traffic sources, engagement, outbound-link destinations, article journeys and successful contact submissions. Contact-form names, email addresses and message contents are not sent to analytics. Page URLs can contain ordinary campaign or filter parameters.
No Google Analytics tag, analytics requests or analytics cookies load before acceptance. Accept analytics and Reject analytics are equally available. Use Privacy choices in the footer to change your choice or withdraw consent. Withdrawal stops future collection, removes accessible first-party analytics cookies and reloads without the Google tag. It does not erase data already collected. Browsing and the contact form work without analytics.
Your choice is valid for 180 days. Analytics cookies `_ga` and `_ga_SHC2BF7N8J` are configured for 180 days without automatic expiry extension; browser clearing or withdrawal may remove them sooner. Advertising permissions remain denied, and Google products & services data sharing is off.
Google Analytics is set to keep event data for 2 months and user data for 14 months. When analytics records new activity, the 14-month user-data period starts again. These limits do not apply to standard summary reports. Google explains these settings.
Correspondence and other storage
I retain relevant professional correspondence, including enquiries, client relationships, offers, contracts and casting communications, where there is an ongoing business purpose or an applicable legal obligation. I manage this correspondence manually and delete it when it is no longer needed for those purposes. I do not use automatic email deletion or apply a fixed retention period to all correspondence.
The light/dark preference is stored in browser local storage, including the homepage's initial preference. No automatic expiry is set. Turnstile can also use browser storage for security. You can clear local storage through your browser; clearing it may reset preferences and verification state.
External media and service providers
Swimmingpool's thumbnail is requested directly from YouTube before playback. Choosing Play loads YouTube's privacy-enhanced player and related Google services, which may use browser storage. Privacy-enhanced mode does not mean no personal data or storage is involved. Some article images load from NeuronCDN/OVH as pages load or you scroll. These requests disclose technical information such as your IP address to the relevant providers. Accepting or rejecting analytics does not control these media requests.
Providers process information under their applicable service, privacy and data-processing terms, including their security, delivery and deletion arrangements. Some processing occurs outside the EU/EEA, including in the United States. Where required, applicable provider terms provide transfer safeguards such as European Commission standard contractual clauses. Details are available in the terms for Google, Vercel, Resend, Hostinger, Upstash and Cloudflare, or through the contact form. The ten-minute application counter and browser-cookie lifetimes do not describe retention of every provider record.
Your rights
Subject to applicable conditions, you may request access, correction, deletion, restriction or portability of your personal data and object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. Use the contact form for requests. You may also complain to Integritetsskyddsmyndigheten (IMY).