Privacy Policy
A transparent statement regarding minimal data collection, security by design, and strict respect for your privacy.
Zero Advertising Cookies
No Facebook pixel, remarketing tags, or intrusive third-party behavioral trackers.
Strict TLS 1.3 Encryption
All communications between client and server APIs travel over secure HTTPS channels.
Active Anti-Spam Defense
Google reCAPTCHA Enterprise and IP rate limiting protect endpoints against abuse.
Never Sold or Monetized
Your personal contact information will never be sold, rented, or distributed to third parties.
1. Data Controller
The data controller responsible for the personal data processed through this website is:
This policy applies to all interactions across obeduri.com, its subroutes, APIs, and interactive features.
2. Data Collected & Collection Methods
This portfolio gathers only the information strictly necessary for professional communication, platform security, and aggregate attribution:
a) Direct Contact Form
When submitting a message through the contact form, we collect your name, email address, optional subject, and message body. This information is strictly validated using Zod schemas and forwarded via Brevo's (Sendinblue) transactional API directly to my inbox. It is never stored in marketing lists or newsletter databases without explicit consent.
b) Platform Attribution & Technical Telemetry
If you arrive via links tagged with platform parameters (e.g., LinkedIn, GitHub, X, or Upwork with ?platform= or ?utm_source=), our internal API (/api/track-platform) records the referring source in a PostgreSQL database hosted on Railway. Data logged includes: platform slug, referrer URL, path visited, browser user-agent, IP address, and approximate geolocation (country and city derived via edge headers from Vercel/Cloudflare). No cross-site individual tracking profiles are created.
c) Technical Consultations & Scheduling (Calendly & Google Meet)
When scheduling a technical consultation using the embedded Calendly widget or direct Google Calendar/Meet links, you voluntarily provide your name, email, and meeting notes directly to those respective services, governed by their independent privacy policies.
d) WhatsApp Direct Messaging
The floating WhatsApp action button redirects you directly to Meta's messaging application, which operates under native end-to-end encryption.
3. Local & Session Storage Usage
To provide a seamless browsing experience without relying on tracking cookies, this portfolio exclusively utilizes client-side Web Storage APIs:
Preserves your theme mode preference ('dark' or 'light') to prevent UI flicker across visits.
Remembers your preferred language selection ('es' or 'en') to display content consistently in your chosen tongue.
Retains your preferred view profile (Full, Technical, or Career mode) and ensures the initial welcome picker is not shown repeatedly.
An ephemeral in-memory session flag used to prevent duplicate attribution events when reloading or navigating during the same session.
Cryptographically signed technical cookies created solely when the site administrator logs in via Google OAuth. Regular visitors never receive these cookies.
4. Purpose & Legal Basis for Processing
Processing of the aforementioned information is grounded on lawful bases recognized by international data protection laws (GDPR / Law 172-13):
5. Third-Party Services & Infrastructure
This portfolio partners with industry-leading infrastructure providers to guarantee reliability and performance:
Brevo (Sendinblue SAS)
Transactional email routing provider delivering contact submissions securely to my inbox.
Google reCAPTCHA Enterprise (Google LLC)
Invisible behavioral risk engine protecting submission endpoints against botnets and automated attacks.
Railway Corp & PostgreSQL
Managed cloud PostgreSQL database storing aggregate visit attribution and site visibility preferences.
Vercel Inc.
Edge cloud hosting platform providing automatic SSL/TLS termination and high-speed asset distribution.
Calendly LLC
Calendar booking infrastructure utilized when you choose to schedule an advisory consultation.
6. Information Security Measures
Strict software engineering best practices are enforced: backend Zod schema validation, HTML entity escaping against Cross-Site Scripting (XSS), in-memory rate limiting restricting submissions to 5 requests per 10-minute window per IP, strict TLS/HTTPS in transit, and secure server-only environment variable segregation.
7. Data Retention Periods
Contact form submissions are stored only for as long as needed to address the inquiry and manage ongoing professional relationships. Aggregate attribution logs are maintained for statistical evaluation and purged on a scheduled basis.
8. Your Data Protection Rights
You hold the right to exercise your data subject rights at any time under GDPR and Dominican Law No. 172-13:
9. Updates to this Policy
This policy may undergo revisions to reflect technological additions or regulatory updates. Any changes will be posted on this page with an updated timestamp.