Privacy

Who is responsible

KairosApex is Thiago Santos Joaquim, working in his own name, based in Portugal. He is the data controller for everything described here, and he is also the person who answers the email: contact@kairosapex.com.

What is collected, and when

The contact form. Your name, your email address, the company if you named one, the project type you picked, and your message. It is sent to a mailbox and it stays there. There is no database and no mailing list behind this site, and a contact message does not go into the CRM — nothing you type is stored by the site itself.

Analytics, only if you accept. Which pages are viewed, where the visit came from, an approximate location worked out from your address — the country and the city, never a street — and the kind of device and browser. It runs on our own server rather than a vendor's, sets no cookies, and stores nothing in your browser.

To tell one visit apart from another without keeping anything about you, the server builds an identifier by hashing your address, your browser string and this site together with a secret that changes every night. Your address itself is never stored, and because the secret changes, yesterday's identifier cannot be matched to today's. Nothing follows you across days, and nothing follows you to another site.

Server logs. Like every web server, ours records the requests it serves: the address they came from, the time, the page, the browser string. They exist to keep the site running and to notice abuse.

Rate limiting. So the contact form cannot be used to send mail in bulk, the address that submitted it is held in the server's memory for an hour. It is never written to disk.

The booking calendar. It is not loaded with the page. Only when you press “Open the calendar” does your browser fetch it from Cal.com, which then handles what you enter to book: your name, your email address, the time you pick and anything you add. Cal.com may set its own cookies for that window. A booking is also recorded in our own CRM (a self-hosted Twenty, on the same server): your name, your email address, the time and any note. If you never press the button, none of this happens.

Why

The contact form, to answer you. That is why you wrote, and answering is a step towards a possible contract.

Analytics, because you said yes. Until you do, it does not run at all.

Logs, out of a legitimate interest in keeping a site available and secure.

How long it is kept

Contact messages stay in the mailbox for as long as the conversation is useful, and at most 24 months. Ask for yours to be deleted sooner and it will be.

Bookings stay in the CRM for as long as the conversation is useful, and at most 24 months. Ask for yours to be deleted sooner and it will be.

Analytics data holds no name, no address and no account, and the identifier described above dissolves every night. What is left is counts.

Server logs are kept for a few days.

Who else sees it

Nobody besides the suppliers below. No ad network, no analytics vendor and no outside sales tool is involved in this site. Nothing is sold and nothing is shared.

Two suppliers necessarily handle data for any of it to work: Hostinger, which hosts the mailbox your message arrives in, and Hetzner, whose servers in Nuremberg, Germany run the site, the analytics and the CRM. Both are in the European Union.

A third, Cal.com, handles data only if you open the booking calendar: it runs the scheduling and keeps the booking you make there, under its own privacy policy.

Your rights

Under the GDPR you can ask for a copy of whatever is held about you, ask for it to be corrected or deleted, ask for it in a portable form, or object to it being processed at all. Write to contact@kairosapex.com and a person answers, within a working day.

If that answer does not satisfy you, you can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (cnpd.pt).

Changes

If this policy changes, the date at the top changes with it. There is no version of this site that quietly starts collecting more without saying so here first.