Privacy policy
Last updated: 5 September 2026. This covers this website. Data held inside a client's own infrastructure is governed by that client's contract, where I act as processor and they remain the controller.
Who is responsible
Arasaka di Hvozdikov Yevheniy, Busto Arsizio (VA), Italy. P.IVA 03929200123, REA VA-389633. Write to yevheniy.hvozdikov@arasaka.software, or by certified mail to y.hvozdikov@postecert.it. There is no Data Protection Officer; I answer these myself.
Cookies
Browsing this site sets no cookies at all.
Opening a page with a form sets one, named .AspNetCore.Antiforgery.*. It exists only to stop a third-party site submitting the form on your behalf, it holds no identifier, and it disappears when you close the browser. It is strictly necessary under the ePrivacy rules, which is why this site has no cookie banner: there is nothing to consent to.
Analytics
I use Umami, self-hosted on my own server. No third party is involved and nothing is sent to Google.
It sets no cookies and stores no identifier in your browser. It records the page you viewed, the site that linked you, your rough screen size, your browser and operating system, and an approximate location — country, region and city — derived from your IP address. Your IP address is not stored — it is hashed with a daily-rotating salt to count a visit once, and cannot be reversed to identify you.
Legal basis: legitimate interest (Art. 6(1)(f)) in knowing which pages are read. The interest is narrow, no profile is built and nothing is shared. If your browser sends Do Not Track, the script does not run.
Retention: aggregate statistics are kept indefinitely; they contain no personal data.
If you write to me through a form
The contact form and the service builder store what you type — your name, email address, company if you give one, and your message — together with your IP address and the time you sent it. The IP address is kept because it is what stops the form being abused by automated submissions.
Legal basis: taking steps at your request before entering a contract (Art. 6(1)(b)), and legitimate interest (Art. 6(1)(f)) in keeping the form usable.
This is stored in a database on my own server in Italy. A copy of your message is emailed to me through Namecheap PrivateEmail, which acts as a processor for that delivery.
Retention: 24 months from your last contact, then deleted. Ask sooner and I delete it sooner.
The map on the contact page
The contact page embeds a map from OpenStreetMap. Loading it tells OpenStreetMap your IP address, as any request to any website does. I have no control over what they do with it and receive nothing back. If you would rather not, do not open that page.
Who else sees any of this
Nobody. The website, its database and its analytics all run on hardware I control in Italy. There is no advertising network, no tag manager, no third-party script, and nothing is sold or shared. The only processors are the mail provider named above and, if you open it, the map.
Your rights
Under the GDPR you may ask for a copy of what I hold about you, correct it, have it deleted, restrict or object to how it is used, and receive it in a portable format. Where I rely on legitimate interest you can object, and I will stop unless I have a compelling reason not to — for the form data, I will not.
Write to the address above. I answer within 30 days. If you are unhappy with the answer you can complain to the Garante per la protezione dei dati personali (garanteprivacy.it).
Changes
If this changes, the date at the top changes with it. The current and previous versions are in the site's public source history, so you can see exactly what changed and when.