1. Controller and contact
The data controller is Alin Stroie, Dublin, Ireland. For privacy questions or to exercise your rights, email [email protected]. Please do not send passwords, identity documents, API keys, private keys, health data or other sensitive information.
This is a personal professional portfolio. It does not sell personal data and does not use personal data for third-party advertising.
2. Data, purposes and legal bases
Necessary site delivery and security
The hosting, WordPress, Nginx and Cloudflare layers process technical request data such as IP address, time, requested URL and browser headers to deliver and secure the site. The application uses a short-lived HMAC-derived rate-limit key instead of storing raw IP addresses in its analytics tables. Legal basis: legitimate interests under Article 6(1)(f) GDPR—secure operation, abuse prevention and service reliability.
CV/private-passport requests
Full name, company and work email are used to assess and answer a request. The values are encrypted at rest; a keyed email hash supports lookup and duplicate control. Approval state, timestamps, token metadata and audit events protect the one-time access process. Legal basis: legitimate interests under Article 6(1)(f); Article 6(1)(b) may also apply where processing is objectively necessary for steps requested by the individual before a possible contract.
Private-passport messages
A requester may send a 10–2,000-character message. It is emailed to the controller through Brevo, with the requester's email used as Reply-To. The message is not stored in the plugin database; an event records that a message was sent. Legal basis: legitimate interests in responding to requested professional contact.
Optional analytics
Only after consent, a random session identifier, page/section, coarse country, device category, browser family, source, timestamps, page views and approximate active duration may be processed. For an approved private-passport browser, activity may be associated with that CV request. No raw IP, full user-agent string or browser fingerprint is stored in analytics tables. Legal basis: consent under Article 6(1)(a) GDPR and Irish ePrivacy rules.
Optional game progress
Only after consent, Packet Quest stores answered/correct totals and question identifiers in this browser under packetQuest1986ProgressV1. It is not sent directly to the server. Without consent, the game still works but progress lasts only in memory for the open page.
Optional YouTube media
Only after external-media consent and a Play action, a privacy-enhanced youtube-nocookie.com frame loads. Google/YouTube then receives technical connection data such as IP address and browser headers. You may instead follow a normal YouTube link.
Public AI guides
The selected guide, your current question (maximum 500 characters) and up to six recent safe user prompts are sent through a local bridge to isolated, temporary Hermes profiles using OpenAI. An IP-derived salted hash is held briefly in memory for rate limiting; the temporary Hermes session is deleted after the reply. Do not enter confidential, sensitive or unnecessary personal data. Legal basis: legitimate interests in providing the requested interactive portfolio guide. The site remains usable without chat.
Consent record and necessary access cookie
Your privacy choices and their version/time are stored locally as alin_privacy_consent_v1 so the site can remember them. Approved private access uses the Secure, HttpOnly, SameSite=Lax cookie __Host-alin_employer_access until the 24-hour link expires. These are necessary to remember your choice and provide the access you requested.
3. Recipients and international transfers
- Hosting/WordPress/Nginx: site delivery, encrypted request records and security logs on the controller's VPS.
- Cloudflare: DNS, edge security, country header and protected staging access.
- Brevo: transactional email delivery for requests, decisions and private messages. Open/click tracking is not required for this workflow.
- OpenAI: model processing for questions voluntarily submitted to the public AI guides through isolated Hermes profiles.
- Google/YouTube: only after external-media consent and Play, or when you independently visit a YouTube link.
- Telegram: the owner may receive a generic “new request” alert without the visitor's name, company, email, token or message.
Some providers may process data outside the European Economic Area. Where this occurs, the controller relies on the provider's applicable data-processing terms and lawful transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, as appropriate. Provider subprocessors and locations can change; current provider documentation should be consulted for details.
4. Retention
| Data | Retention |
|---|---|
| Anonymous live analytics and deduplication rows | Up to 48 hours. |
| Aggregated analytics | Up to 24 months. |
| Pending, rejected, expired or revoked CV-request identity | Anonymised after no more than 180 days. |
| Consumed CV-request identity and associated identified activity | Anonymised after no more than 365 days. |
| Private access link/cookie | Link expires after 24 hours; one CV download. Expired token metadata is removed after a short operational window. |
| Nginx access/security logs | Daily rotation with 14 retained rotations (normally about 14 days). |
| Consent choice | Up to 180 days, then a new choice is requested. |
| Game progress | Until reset, withdrawal, browser clearing or consent expiry. |
| AI rate-limit entry and temporary Hermes session | Rate-limit entry about 60 seconds; temporary Hermes session deleted after the reply. Provider-side processing follows the applicable provider terms/configuration. |
| Transactional email/message copies | Only as long as needed to handle and document the professional request, subject to routine mailbox/provider retention and periodic deletion. |
Backups may retain protected copies for a limited disaster-recovery cycle before automatic replacement. Data may be kept longer only where required to establish, exercise or defend legal claims or meet a legal obligation.
5. Your choices and rights
You can reject all optional categories without losing the main portfolio. “Manage privacy” in the footer lets you grant or withdraw consent at any time. Withdrawal does not affect processing already lawfully completed. A recognised Global Privacy Control or Do Not Track signal keeps analytics disabled.
Subject to GDPR conditions and exceptions, you may request access, correction, deletion, restriction, portability and objection. Where consent is the basis, you may withdraw it. Email [email protected]; enough information may be requested to verify that the request concerns you, but never send a password or private key.
You may complain to Ireland's Data Protection Commission. There is no solely automated decision-making producing legal or similarly significant effects. CV approval is reviewed by Alin.
6. Required and optional information
Name, company and a valid work email are required only if you choose to request private passport/CV access; without them the request cannot be assessed or answered. Chat questions, optional analytics, saved game progress and YouTube media are voluntary. You can browse the portfolio without providing CV-request details.
Security controls include encryption of request identity at rest, hashed access tokens, short expiry, one authorised CV download, secure cookies, rate limits, origin checks and restrictive headers. No internet service can promise absolute security.
Notă de informare privind confidențialitatea
ULTIMA ACTUALIZARE: 27 OCTOMBRIE 2026 · VERSIUNEA 2026-10-27
1. Operator și contact
Operatorul datelor este Alin Stroie, Dublin, Irlanda. Pentru întrebări sau exercitarea drepturilor: [email protected]. Nu trimite parole, documente de identitate, chei API/SSH, date medicale sau alte date sensibile.
2. Ce date sunt folosite și de ce
- Livrare și securitate: infrastructura poate prelucra IP-ul, ora, URL-ul și antete tehnice pentru funcționare, protecție și limitarea abuzului; temeiul este interesul legitim, art. 6(1)(f).
- Cerere CV/pașaport privat: nume, companie și email profesional, criptate în baza de date, plus stare, date și jurnal de securitate. Temei: interes legitim; art. 6(1)(b) poate fi relevant când persoana solicită demersuri necesare înaintea unui posibil contract.
- Analytics opțional: numai cu consimțământ, art. 6(1)(a): ID aleator de sesiune, pagină/secțiune, țară aproximativă, categorie dispozitiv, familie browser, sursă, vizualizări și durată aproximativă. Pentru accesul privat aprobat, activitatea poate fi asociată cererii.
- Joc și YouTube: progresul persistent al jocului și încărcarea playerului YouTube sunt dezactivate până la consimțământul corespunzător.
- Chat AI: întrebarea, ghidul ales și cel mult șase întrebări recente sigure sunt trimise printr-un bridge local către profiluri Hermes temporare care folosesc OpenAI. Nu introduce date confidențiale sau sensibile.
3. Destinatari și transferuri internaționale
Furnizorii relevanți sunt infrastructura VPS/WordPress/Nginx, Cloudflare, Brevo, OpenAI și, numai după alegerea ta, Google/YouTube. Telegram primește doar o alertă generică despre o cerere nouă, fără identitatea vizitatorului. Transferurile în afara SEE se bazează, după caz, pe decizii de adecvare, Clauze Contractuale Standard și termenii de prelucrare ai furnizorului.
4. Păstrare
Sesiunile analytics live: maximum 48 de ore; agregatele: maximum 24 de luni; cererile în așteptare/respinse/expirate/revocate: anonimizare în maximum 180 de zile; cererile consumate: anonimizare în maximum 365 de zile; linkul privat: 24 de ore și o descărcare; jurnalele Nginx: în mod normal aproximativ 14 zile; alegerea de confidențialitate: 180 de zile; progresul jocului: până la resetare, retragere, ștergerea browserului sau expirarea alegerii.
5. Drepturi și alegeri
Poți refuza toate opțiunile facultative și poți modifica oricând alegerea din „Manage privacy”. În condițiile GDPR, poți cere acces, rectificare, ștergere, restricționare, portabilitate sau te poți opune; poți retrage consimțământul. Poți depune plângere la Data Protection Commission din Irlanda. Nu există decizii exclusiv automate cu efect juridic sau similar semnificativ; aprobarea CV este analizată de Alin.
6. Date obligatorii și facultative
Numele, compania și emailul profesional sunt obligatorii numai dacă alegi să ceri acces privat; fără ele cererea nu poate fi analizată. Analytics, salvarea jocului, YouTube și chatul sunt facultative. Site-ul principal poate fi folosit fără o cerere CV.
7. Changes / Modificări
The date and version at the top identify this notice. Material changes will trigger a new privacy choice where required. / Data și versiunea de sus identifică informarea. Modificările importante vor solicita o nouă alegere atunci când este necesar.