Privacy Policy

Last updated: 15 July 2026

This site (hyprism.dev) is operated by Werner Mathias Bundschuh, an Individual Entrepreneur registered in Georgia (IE Reg. No. B25175473 — see Legal Notice). This page describes what personal data is processed, why, and your rights.

This policy is written to comply with both the EU General Data Protection Regulation (GDPR) and the Georgian Personal Data Protection Law — both frameworks are functionally equivalent for the data processed by this site.

What data is collected

This site is deliberately minimal in its data collection. Here’s the complete list:

Server access logs (Cloudflare)

When you visit hyprism.dev, Cloudflare (the hosting provider) records standard HTTP access logs:

Your IP address (anonymized after 24h by Cloudflare’s default settings)
Your browser User-Agent string
The URL you visited
HTTP referer (the page that linked you here)
Timestamp

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — security, abuse-prevention, and operational reliability of the site.

Retention: Cloudflare retains anonymized logs for up to 7 days, then aggregates them.

Data processor: Cloudflare, Inc. (USA), under Standard Contractual Clauses + their Data Processing Agreement. See Cloudflare’s privacy policy.

Anonymous traffic analytics (Cloudflare Web Analytics)

This site uses Cloudflare Web Analytics — a cookie-free, privacy-respecting analytics tool.

What it tracks:

Page views (aggregated)
Visit duration (aggregated)
Referrer (which site linked to us)
Browser + OS (aggregated)
Country (no precise location)

What it does NOT track:

No cookies set
No fingerprinting
No individual user tracking
No data sold to third parties

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — understanding which docs are useful.

Data processor: Cloudflare, Inc.

Contact form submissions

If you use the contact form, the data you submit (name, email, topic, message) is handled entirely on infrastructure I control:

Cloudflare Worker — receives your submission and stores it in a Cloudflare D1 database (EU region)
Scaleway Transactional Email (France, EU) — delivers a notification email to my inbox
My Proton Mail inbox — where the message arrives for me to read and reply

What is collected:

Your name (as provided)
Your email address (as provided)
Topic and message content (as provided)
Submission timestamp
Your IP address / country (used for spam prevention)

To block spam, the form uses Cloudflare Turnstile — a cookie-free CAPTCHA alternative that analyses technical signals and does not track you across sites.

Legal basis: Consent (Art. 6(1)(a) GDPR) — implied by your choice to submit the form; spam prevention on the basis of legitimate interest (Art. 6(1)(f) GDPR).

Retention: Your message stays in my inbox and in the database until no longer needed, typically up to 6 months.

Data processors: Cloudflare, Inc. (form handling, database storage, spam protection), Scaleway SAS (email delivery, EU), and Proton AG (email inbox). Their privacy policies are linked at the end of this page.

What is NOT used on this site

❌ Google Analytics
❌ Google Fonts CDN (fonts are self-hosted)
❌ Facebook Pixel / Meta tracking
❌ YouTube embeds (no third-party cookies)
❌ Chat widgets (Intercom, Hubspot, etc.)
❌ Marketing automation pixels
❌ Any cookies that require consent

Because no consent-requiring cookies are set, no cookie banner is needed under EU/Georgian law.

You have the right to:

Access — request a copy of any personal data we have about you
Rectification — correct inaccurate data
Erasure — request deletion of your data (“right to be forgotten”)
Restriction — limit how your data is processed
Portability — receive your data in a structured, machine-readable format
Objection — object to processing based on legitimate interest
Withdraw consent — for any processing based on consent (e.g., contact-form submissions)
Lodge a complaint with your local data protection authority

To exercise any of these rights, email [email protected]. I will respond within 30 days.

Data protection supervisory authority for this site: Georgian Personal Data Protection Service. EU visitors may also lodge complaints with their national data protection authority.

As a controller established outside the EU that offers services to data subjects in the Union, a representative within the EU has been designated pursuant to Art. 27 GDPR. We have appointed Prighter Group with its local partners as our privacy representative and your point of contact for the European Union (EU). To exercise your data subject rights or contact us on any matter related to the processing of your personal data, visit app.prighter.com/portal/shopatch (reference: ID-19065088599).

Data processors used

The following third parties process data on my behalf, each under their own Data Processing Agreement (DPA / AVV):

Processor	Purpose	DPA / Policy
Cloudflare, Inc.	Site hosting, CDN, DNS, Web Analytics, contact-form handling (Worker + D1), spam protection (Turnstile)	Cloudflare Privacy Policy · DPA
Scaleway SAS	Contact-form email delivery (EU)	Scaleway Privacy
Proton AG	Email inbox for [email protected]	Proton Privacy Policy

International data transfers

Some processors (Cloudflare) are based outside the EU/EEA and/or Georgia. Where data is transferred internationally, it is protected by:

Standard Contractual Clauses (SCCs) where applicable
Adequacy decisions where applicable
The processor’s binding corporate rules

Scaleway (contact-form email) processes data within the EU (France). Proton AG is based in Switzerland, which has a Data Protection Adequacy decision under EU law.

Changes to this policy

I will update this policy if site practices change. Material changes will be announced on the home page. The “Last updated” date above will be revised.

Contact

For privacy questions or to exercise your rights:

Email: [email protected]