Privacy Policy

This Privacy Policy explains how personal data is handled when you visit thefalcon.dev (the "Site"), the personal portfolio of Rishabh Kumar. For visitors in the European Economic Area (EEA) and the United Kingdom, Rishabh Kumar is the data controller under the GDPR and UK GDPR. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), the equivalent role is data fiduciary.

Who is responsible for your data

Rishabh Kumar, Jalandhar, Punjab, India. For anything related to your personal data, contact [email protected]. I aim to respond to all privacy requests within 30 days.

What data is collected, why, and on what legal basis

Contact form. If you use the contact form, I collect your name, email address, the inquiry type you select, and your message. This data is stored in the Site's database (MongoDB Atlas) and delivered to my inbox by the email service Resend; you also receive an automatic confirmation email. Legal basis: legitimate interest in responding to enquiries and, where your message concerns work, steps taken prior to entering into a contract (GDPR Art. 6(1)(b) and 6(1)(f)).

Talent and hiring inquiries. If you use the hiring inquiry dialog, I collect your email address, the role or pitch you describe, and any document you choose to attach (for example a job description). This is stored in the Site's database (MongoDB Atlas) and delivered to my inbox by Resend. Legal basis: steps taken prior to entering into a contract and legitimate interest (GDPR Art. 6(1)(b) and 6(1)(f)).

Newsletter. If you subscribe to the newsletter, your email address is stored with Resend, the service that also sends the newsletter, and is used solely to send you new posts published on this Site. Legal basis: your consent (GDPR Art. 6(1)(a)). Every newsletter contains an unsubscribe link; unsubscribing takes effect immediately and no further newsletters will be sent; you can additionally request full deletion of your address at any time.

Analytics. The Site uses Google Tag Manager and Google Analytics to understand how the Site is used: pages visited, approximate location at city level, device type, and interactions such as searches and downloads. The Tag Manager script loads in consent-denied mode: your browser requests it from Google's servers (which involves your IP address), but no analytics cookies are set and no identifiers are collected unless you click Accept in the cookie banner. Advertising storage and ad-personalisation signals are permanently disabled on this Site, regardless of your choice. Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time via Cookie settings in the footer. Details are in the Cookie Policy at thefalcon.dev/legal/cookies.

Server logs. The hosting infrastructure records standard access logs (IP address, requested URL, timestamp, user agent) for security, abuse prevention, and operational monitoring. Legal basis: legitimate interest in running the Site securely (GDPR Art. 6(1)(f)).

Cookies and local storage

The Site stores a small number of items in your browser: your theme preference, your cookie-consent choice, and one-time interface flags (a splash-screen marker and a hiring-popup marker). All are strictly necessary and contain no personal identifiers. Analytics cookies are set only after you opt in. The full list, with purposes and durations, is in the Cookie Policy at thefalcon.dev/legal/cookies.

Service providers

The Site relies on a small set of providers that process data on my behalf:

Vercel Inc. (USA) hosts the Site and serves its pages, processing standard server logs. See vercel.com/legal/privacy-policy.

MongoDB, Inc. (USA) provides MongoDB Atlas, the managed database that stores Site content, contact form submissions, and hiring-inquiry submissions. See mongodb.com/legal/privacy-policy.

Cloudflare, Inc. (USA) stores and delivers the Site's images and files (R2); serving a file involves processing the requesting IP address. See cloudflare.com/privacypolicy.

Resend (Plus Five Five, Inc., USA) sends transactional email and the newsletter, and stores newsletter subscriber addresses. See resend.com/legal/privacy-policy.

Google LLC (USA) provides Google Tag Manager and Google Analytics. The script loads in consent-denied mode; analytics measurement and cookies are enabled only after you consent. See policies.google.com/privacy.

Fonts are self-hosted with the Site's build, so visiting the Site makes no request to Google Fonts or any other font service.

International data transfers

I am based in India, and the providers above operate primarily in the United States. Where personal data of EEA or UK visitors is transferred outside those regions, it is protected by appropriate safeguards: the EU–US Data Privacy Framework where the provider is certified, and/or the European Commission's Standard Contractual Clauses.

How long data is kept

Contact form and hiring inquiry data is kept for as long as needed to handle the conversation and is reviewed and deleted within 24 months at the latest. Newsletter addresses are kept until you unsubscribe. Google Analytics data is retained for 14 months. Server logs are kept by the hosting providers for short operational windows under their own policies. You can request earlier deletion of any of your data at any time.

Your rights in the EEA and UK (GDPR / UK GDPR)

You have the right to access your personal data; to have it corrected or erased; to restrict or object to its processing; to receive it in a portable format; and to withdraw consent at any time without affecting processing that happened before withdrawal. To exercise any of these rights, use the Data Subject Request form at thefalcon.dev/legal/data-request, or email [email protected] as a fallback. You also have the right to lodge a complaint with your local data protection supervisory authority.

Your rights in India (DPDP Act, 2023)

You have the right to access a summary of the personal data processed about you, to correction and erasure, to grievance redressal, and to nominate another individual to exercise your rights on your behalf in case of death or incapacity. Use the Data Subject Request form at thefalcon.dev/legal/data-request, or email [email protected] directly — requests will be addressed promptly.

Your rights in California (CCPA / CPRA)

California residents have the right to know what personal information is collected, to access and delete it, to correct it, and to opt out of its sale or sharing. This Site does not sell personal information and does not share it for cross-context behavioural advertising. You will not be discriminated against for exercising any of these rights. Use the Data Subject Request form at thefalcon.dev/legal/data-request, or email [email protected].

Children

The Site is not directed at children, and I do not knowingly collect personal data from anyone under 16. If you believe a child has submitted personal data, contact me and it will be deleted.

Security

All traffic to the Site is encrypted in transit (TLS). Data is stored with reputable providers using access controls, and access to submissions and subscriber lists is limited to me.

Automated decision-making

The Site performs no profiling and makes no automated decisions that produce legal or similarly significant effects on you.

Changes to this policy

This policy may be updated as the Site or legislation changes; the "last updated" date above reflects the latest revision. Material changes to how consent-based data is used will trigger a fresh consent request.

Contact

For any privacy-related question or request, email [email protected].