Revised 31 October 2026
This notice explains how Baran Ahmedov, based in Bulgaria, handles information when you visit baranhq.com, use the contact form or email me. For questions or privacy requests, contact [email protected].
Information processed when you visit
The website and database hosting provider, and the service that routes and protects website traffic, process technical request information needed to deliver and secure pages. This can include your IP address, requested page, time, browser details, referrer and response status. The hosting provider's server logs are also analysed by its traffic-statistics software to produce reports. Exact fields, log-retention periods, backup periods and access arrangements depend on the hosting account settings; they are not controlled by this site's privacy choices.
Cloudflare Web Analytics is an optional performance-analytics service. If you separately opt in through Privacy choices, this site loads its beacon for page-performance measurements. For details about Cloudflare's processing, see [Cloudflare's Privacy Policy](https://www.cloudflare.com/privacypolicy/). The site's first-party click and active-time records are stored in the hosting database and are not sent to this analytics service by this integration. Privacy choices control the optional performance beacon only; they do not disable website delivery, traffic routing, security processing or hosting logs.
Optional analytics choices
If you enable Usage statistics, the site stores a random browser identifier, visit times, public page paths, predefined button or link labels and click counts, plus estimated active time. A visit is considered inactive after 30 minutes. Active time is an estimate based on a visible, focused page with recent activity. The feature does not record form contents, query strings, mouse movements, screen recordings, precise location or browser fingerprints. Records are stored in the site's hosting database and viewed by the site operator; the hosting provider may process them as needed to operate the service. They are kept for up to one year so the site owner can compare activity over time.
Include my IP address is a separate, optional choice and is off unless selected. If you select it together with Usage statistics, the application may associate your full IP address with a visit. This is personal data and does not reliably identify a specific person. The application deletes full IP addresses after 7 days. Refusing this choice does not stop delivery, security or hosting services from processing connection IPs for their separate purposes.
The site operator may designate a network address as internal traffic to keep visits from that address out of the site's application analytics. For this exclusion, the trusted incoming address is checked transiently against a keyed hash; the raw address is not saved in the exclusion list. Matching retained visits and their events are deleted when an address is added. Future application analytics from that address are skipped. The hash and a label remain until the exclusion is removed. This can affect everyone using the same shared network. Visits whose IP address has already expired cannot be identified and removed retroactively.
Cloudflare Web Analytics requires its own opt-in and can be changed separately from first-party Usage statistics and IP choices. AWStats is used to prepare traffic reports from the hosting provider's server logs; this processing is separate from the consent panel. You can refuse optional analytics without losing access to the site.
Contact form and email
If you send the contact form, I receive the email address you provide, your message and any optional name. The message is stored in the hosting database so I can respond and keep a correspondence history for relevant follow-up. It is not sent to the analytics system, used for marketing or used to create an account. Messages are not automatically expired: I review them periodically and delete them when they are no longer reasonably needed for correspondence and follow-up. You may also ask me to delete a message. For spam prevention, the application temporarily stores a keyed, non-reversible hash derived from the connection IP for up to one hour. The message itself is not stored with your IP address.
If you email [email protected], I process your email address, message, attachments and other information you choose to send so I can respond and retain relevant correspondence. Email providers used to send and receive the message also process it. Please do not send sensitive information unless needed for your enquiry.
Cookies and browser storage
The application uses a necessary first-party, HttpOnly session cookie to remember your privacy choices. A saved choice may last up to six months. Website delivery and security providers may use necessary cookies or similar technologies when their services require them. The optional performance-analytics beacon is loaded only after its separate opt-in has been saved. This site does not use advertising cookies or cross-site advertising tracking.
When you open a project from the homepage, the browser temporarily stores the homepage scroll position in session storage so Go back can return you to the same place. It is removed from the browser when restored.
You can open Privacy choices in the footer or use the Privacy choices button on this page to review or withdraw consent. Turning off Usage statistics removes the application analytics records associated with the current browser preference. Turning off the separate IP choice removes associated IP addresses. Turning off performance analytics prevents its beacon from loading on subsequent page loads. A final request already in progress when you withdraw may still complete. Clearing browser cookies can prevent the site from linking a later rights request to earlier records; contact me if you need help locating them.
Purposes and lawful bases
I use contact details to respond to enquiries and maintain relevant correspondence; connection and security information to deliver, maintain and protect the site; and optional application and external performance analytics only when you consent, to understand site performance and usage. The application asks separately for usage statistics, linking full IP addresses, and the external performance beacon. The hosting provider's traffic-statistics software analyses server access logs for reporting. I do not sell personal information or use this site for advertising.
Consent is the legal ground for the optional application analytics and the external performance beacon. You can withdraw either consent at any time; withdrawal does not affect processing already carried out. For site delivery, security, spam prevention and responding to messages, the legal ground is the operator's legitimate interest in operating a secure portfolio and managing enquiries, balanced against visitors' rights. Applicable legal obligations may require specific processing. This notice explains processing; it does not ask you to accept the policy as a condition of browsing.
Retention
Application analytics visits, page views and clicks are automatically deleted after 365 days. Application-stored full IP addresses are deleted after 7 days. Keyed hashes used to suppress internal network addresses designated by the site operator remain until the operator removes the corresponding exclusion. Contact-form correspondence is kept while reasonably useful for the conversation and follow-up, and is deleted when no longer needed or when a valid deletion request is fulfilled. Temporary contact-abuse counters are deleted after one hour; login-abuse counters after 15 minutes. Scheduled cleanup runs on the hosting account; during quiet periods, application deletion may take up to an additional 24 hours. Hosting logs, host-generated traffic reports, external performance-analytics records, email-provider records and backups have retention schedules set by the relevant providers and hosting settings. Deleted information may remain in a backup until that backup expires.
Providers and international processing
Recipients may include the website and database hosting provider, Cloudflare when you opt in to Cloudflare Web Analytics and for website delivery or security, and the email provider used for correspondence. For information about Cloudflare's own processing, see [Cloudflare's Privacy Policy](https://www.cloudflare.com/privacypolicy/). AWStats is reporting software used by the hosting provider to analyse server logs, not a separate recipient through this site. These providers may process information in different countries depending on their services and account settings. Exact locations, retention periods and transfer safeguards depend on the active hosting configuration and provider arrangements. Access to the contact inbox and application database is limited to people who need it to operate the service. When you choose an external link, your browser connects to that destination directly. Its operator may receive technical request details such as your IP address, requested page, time, browser details and, depending on browser and link settings, the referring page. The destination's own privacy information applies to that visit; I do not control its processing.
Your rights
Where data protection law applies, you may request access, correction, deletion or restriction of your personal data; object to processing based on legitimate interests; and receive portable data where the law provides that right. You may withdraw consent at any time for processing based on consent. Contact [email protected]. I may ask for reasonable information to locate the data and verify your request. I respond without undue delay and ordinarily within one month; the law may allow an extension for complex requests, and I will explain it if applicable.
You may also complain to Bulgaria's Commission for Personal Data Protection at https://cpdp.bg/en/ or another competent data protection authority. You do not need to contact me before making a complaint.
Age and privacy
This is a personal portfolio website for a general audience. It does not ask visitors to provide their age or use age to personalise content or advertising. Under Bulgarian law, where an online service is offered directly to a person under 14 and processing relies on consent, that consent must be given or authorised by their parent or legal guardian. Contact-form messages are handled as described in the Contact form and email section of this notice.
Security and other information
Access to messages and application analytics is restricted to the site operator and hosting personnel who need access to maintain the service. HTTPS and secure hosting configuration are required in production. No internet service can be guaranteed completely secure. Application analytics are not used for decisions with legal or similarly significant effects. Website security services may challenge or block requests they consider suspicious.
Data controller: Baran Ahmedov
Contact: [email protected]