Privacy Policy

Last updated: Jul 4, 2026

1. Who We Are

This website (matthewoyan.com and associated subdomains) is operated by Matthew Oyan, based in the Philippines. For the purposes of the Philippines Data Privacy Act of 2012 (RA 10173), I am the data controller for personal data collected via this site. To the extent that other privacy laws — such as the EU General Data Protection Regulation (GDPR) or UK GDPR — apply to your use of this site, I act as the data controller under those laws as well.

2. What Data We Collect

When you use the contact form, I may collect:

• First and last name
• Email address
• Organization (optional)
• Phone number (optional)
• Topic and message content

In addition, some technical data is processed automatically:

• When you submit the form, the serverless function processes your IP address transiently to rate-limit submissions and prevent abuse. It is held briefly in server memory only and is not written to any database.
• When the hCaptcha widget loads (see Section 4), hCaptcha may process technical and interaction data such as your IP address and browser/device information.
• The hosting provider may keep standard, short-lived platform and server logs of requests.

No sensitive personal information (such as financial or medical data) is requested or required.

3. How Your Data Is Used

Your information is used solely to:

• Receive and respond to inquiries
• Maintain records of correspondence
• Improve the communication process

I do not and will not sell or share your personal data with third parties for marketing.

4. Where and How Your Data Is Processed

• Netlify (United States):hosts the website and runs the serverless function that processes contact form submissions. Submissions are processed in memory and relayed by email; they are not stored in Netlify Forms or in any database on Netlify. Netlify may keep standard, short-lived platform and function logs.
• hCaptcha / Intuition Machines:provides bot and spam protection for the contact form. The hCaptcha widget loads when you interact with or scroll near the form, so this processing can begin even if you never submit it. hCaptcha may process technical and interaction data, such as IP address, browser/device information, and CAPTCHA interaction data, in data centers in Europe and, where applicable, the United States or other locations where it or its service providers operate.
• Maileroo (Germany): relays the message via email.
• Google Gmail (United States or nearest available data center): receives and stores the message.

Third-Party Privacy Policies

For more details on how these services handle data, you may review their respective privacy policies:

• Netlify: Privacy Policy
• hCaptcha / Intuition Machines: Privacy Policy
• Maileroo: Privacy Policy
• Google: Privacy Policy

Note: These links open in new windows and will show the most current version of each company's privacy policy.

5. Legal Basis for Processing

• Philippines (RA 10173):Processing is based on your consent when you voluntarily submit the form, and on legitimate business purposes such as responding to your inquiry.
• EU/UK (GDPR/UK GDPR), where applicable:Processing is based primarily on legitimate interests (Article 6(1)(f)) — receiving and responding to inquiries, and keeping the site secure (spam and abuse prevention, including transient IP-based rate limiting) — and consent (Article 6(1)(a)) where consent is specifically requested.
• Other regions:Processing is based on your voluntary submission and applicable local privacy law.

6. Data Retention

• Contact form submissions are not stored in Netlify Forms or in any database operated by this site. Messages are relayed by email and retained in Gmail as correspondence records, generally for up to two (2) years after our last exchange. Where an inquiry leads to an engagement, related correspondence may be retained as business records for up to five (5) years after the engagement ends, or longer where required by law or an active dispute.
• Your IP address is held only transiently in server memory for rate limiting and is discarded automatically.
• You may request deletion at any time (see Section 9).

7. Cookies, Local Storage, Embeds, and Analytics

This site does not set cookies of its own, and uses no advertising or cross-site trackers. Basic, anonymous visit statistics are collected with GoatCounter, a privacy-focused analytics tool (see below).

• This site uses GoatCounter (privacy policy) for aggregate visit statistics. GoatCounter is cookieless and designed not to collect personal information: it records the page URL, referring page, browser type, screen size, and a country derived from your IP address. The IP address itself is not stored, and no persistent identifier follows you across visits or sites.
• This site stores only display preferences in your browser's localStorage: a theme key (light/dark mode) for the main site, and a similar theme key for the /wiki/ pages. These contain no personal data and never leave your device.
• When the hCaptcha widget loads on the contact page, hCaptcha may set its own cookies or use similar technologies for security and anti-abuse purposes — see the hCaptcha privacy policy linked in Section 4.
• Some portfolio pages embed YouTube videos in YouTube's "privacy-enhanced" mode (youtube-nocookie.com), which is designed not to set cookies when the page merely loads. If you play a video, YouTube/Google may set cookies or use local storage and collect viewing data under the Google privacy policy linked in Section 4.
• Some pages (such as the wiki) load fonts from the jsDelivr CDN; like any web request, jsDelivr sees standard technical data such as your IP address, but it sets no cookies here.

If the analytics setup ever changes, this policy will be updated to describe exactly what is collected before the change goes live.

8. Security

Data is encrypted in transit (HTTPS/TLS). Netlify, hCaptcha, Maileroo, and Google provide their own security measures for the services they operate. However, no system is 100% secure, and I cannot guarantee absolute protection.

9. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access the personal data I hold about you
• Correct inaccurate information
• Request deletion of your data
• Object to, or request restriction of, certain processing
• Receive a copy of the data you provided in a portable format
• Withdraw consent to processing
• File a complaint with a relevant data protection authority (in the Philippines, the National Privacy Commission)

10. Cross-Border Data Transfers

Because this site uses service providers that process data in the Philippines, the United States, Germany, and other locations where they or their sub-processors operate, your data may be transferred internationally, including to countries whose data-protection standards differ from those of your own. Where such transfers are subject to the GDPR or UK GDPR, they rely on the safeguards those providers maintain — such as certification under the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses, as applicable to each provider (see their privacy policies linked in Section 4). Data is encrypted in transit (HTTPS/TLS) at every stage.

11. Updates

This Privacy Policy may be updated from time to time. The "last updated" date at the top will reflect any changes.

12. Contact

If you have questions about this Privacy Policy, to exercise your data rights, or how your data is handled, please contact me at dataprivacy[at]matthewoyan.com and I will get back to you as soon as I can.