Last updated: May 17, 2026
1. Controller
Site operated by Cristian Alancay, licensed professional (CPIC, COPIME, CPSH). Contact email: Cristian@cristianalancay.com. Location: Buenos Aires, Argentina.
2. Data collected
The site collects data in 3 specific situations:
- Contact form: name, email, company (optional), project type, message.
- Newsletter subscription: email + preferred language.
- Usage analytics: anonymous visitor_id (UUID), session, page URL, referrer, UTM parameters. We do NOT store raw IPs — they're SHA-256 hashed.
3. Purpose
- Respond to business inquiries (contact form).
- Send newsletter emails to people who explicitly subscribed.
- Understand which content is consumed and improve the site (aggregate analytics, no individual profiling).
4. Storage + processors
Data is stored in Cloudflare D1 (database) and KV (ephemeral sessions). Sub-processors:
- Cloudflare — hosting + database (Workers + D1 + KV + R2).
- Resend — transactional email delivery (newsletter welcome, contact confirmation).
- Telegram — internal notifications to the controller.
- Calendly — call scheduling (when you click "Load calendar").
5. Your rights
Under GDPR (EU) and Argentine Law 25.326, you have the right to:
- Access — request a copy of your data.
- Rectification — correct errors.
- Erasure — request deletion.
- Portability — receive your data in a structured format.
- Objection — stop processing.
To exercise them, email Cristian@cristianalancay.com. Reply within 30 days.
6. Retention
- Leads: up to 24 months after last contact, then archived.
- Subscribers: until you unsubscribe (link in every email).
- Analytics: 12 months, then individual rows are deleted.
7. Cookies
Two first-party cookies (cax_vid, cax_sid) for internal analytics + 1 admin session cookie (only on /admin). If you're in the EU, a banner asks for consent before they're set.
8. Security
Strict HSTS + CSP headers, signed-JWT authentication, public endpoint rate-limiting, HMAC on webhooks, Cloudflare-encrypted secrets. DKIM + SPF + DMARC configured on the domain.
9. Changes to this policy
Updates appear on this same page with the date stamped at the top. We don't email about minor changes.
Something unclear? Write me.