What happens to your data.
tl;dr: I use Google Analytics to collect some basic user data about the website, and that’s about it. I don’t sell your data to anyone or share anything, and there’s no advertising on this site. Read on for more detail.
If you fill out the form
You give me a name, an email address, and a few sentences about your business. That goes straight to my inbox so I can reply. The form runs through Formspree, which passes it along to me and keeps a copy in their dashboard as a backup in case an email goes astray. My email is hosted with Google Workspace.
I use it to answer you and, if we end up working together, to keep in touch about the work. I don’t add you to a mailing list, because I don’t have one. I don’t pass it to anyone else — though if a referral to a colleague ever makes sense, I’ll ask you first before I share your contact information.
If you’d rather skip the form entirely, email me at hello@danciardi.com.
If you’d rather I didn’t count you
I use Google Analytics 4 to collect some basic information about how people use the site. GA4 sets cookies (look for names starting with _ga in your browser’s cookies if you want to delete them) that expire after two years by default, and it sends data about your visit to Google, a US company. That data usually includes your IP address — which Google uses momentarily to derive approximate location (country, city) before discarding it; it isn’t logged or shown in GA4 itself — along with which URLs you view, which events you complete (clicks, form submissions, and so on), your device type, and your operating system.
You should see a consent bar at the bottom of the site on your first visit asking about this. If you say “no thanks,” Analytics never loads at all. The site works exactly the same either way. I store your choice in your browser so I don’t ask again; that’s the only thing kept if you decline.
If your browser or extension sends a Global Privacy Control signal, I treat that as a “no” and don’t ask at all. You don’t have to do anything else. More about GPC at globalprivacycontrol.org.
If you change your mind, . And if you’d rather block Google Analytics everywhere, not just here, Google publishes a browser add-on for that.
The stuff every website does
My web host is Cloudflare. Like any host, it processes requests in order to serve the site — that includes your IP address, what was requested, when, and what browser or bot did the requesting. This is standard for every site on the internet and it’s how site owners spot problems or abuse. I don’t have access to raw server logs on my plan and I don’t keep copies of them; what Cloudflare retains is governed by their own privacy policy.
What I don’t do
No advertising, no tracking pixels from social platforms, no selling or renting your information, no newsletter, and no attempt to work out who you are beyond what you tell me. Nothing on this site makes automated decisions about you.
Why I’m allowed to do this
For analytics, my basis is your consent: nothing loads unless you opt in, and you can withdraw it any time with the link above. For the inquiry form and any emails that follow, it’s performance of a contract, including the steps leading up to one: you contacted me about work, and replying is the thing you’d expect. For the request data my host handles in order to serve the site and keep it available, it’s legitimate interests. I’m the data controller for all of this, and the only person who reads what you send me. Cloudflare, Google, and Formspree handle data on my behalf as service providers, and also process some of it for their own security and operational purposes, which their own policies cover.
How long I keep things
Inquiries that don’t go anywhere get cleared out periodically, and I aim to delete them inside a year. Correspondence with people I’ve actually worked with sticks around longer, since it doubles as business records I have accounting reasons to keep. Event-level analytics data is held by Google for 14 months; aggregated reporting isn’t tied to individuals. Request data handled by Cloudflare follows their own retention policy, and I don’t keep copies. Copies of form submissions sitting in Formspree get cleared out along with the emails.
If you’d like me to delete our correspondence, ask and I will.
Kids
This site is aimed at businesses, and I don’t knowingly collect anything from anyone under 18. If you think a child has sent me something through the form, email me and I’ll delete it.
Your call, always
Want to know what I’ve got, want it corrected, want it deleted, or want to ask what any of this means? Email hello@danciardi.com and I’ll sort it out. This is a business, but I’m a person, and I care about privacy.
I’ll never treat you differently for asking. If a request comes from an address I don’t recognize, I may ask a question or two to check you are who you say you are — that’s to protect you, not to stall. Someone can make a request on your behalf if you’ve authorized them to.
If you’re in the EU or UK, you have specific rights under GDPR, and you can complain to your national data protection authority if you think I’ve handled something badly. Some US states like California (CCPA & CPRA) have their own privacy laws, as well. Same deal, though: you’re free to opt out of tracking, and I’ll honor any request to see, correct, or delete what I have.
If any of this changes
If I ever change how this works, I’ll update this page and the date at the bottom. If it’s a significant change, I’ll say so on the page rather than quietly swapping the text. And in the unlikely event I sell or wind down the business, any information I hold would go with it — I’d tell you here first.
Last updated July 31, 2026.
For the record
A more formal summary of the above, for anyone who needs it in this form. Nothing here differs from what’s described in plain English above.
Categories of personal information collected
Categories are those listed in the California Consumer Privacy Act. This reflects the last twelve months.
| Category | Collected | What that means here |
|---|---|---|
| A. Identifiers | Yes | Your name and email from the form; IP address processed by analytics, and by my host when serving pages |
| B. California Customer Records categories | Yes | Name and email, as above |
| C. Protected classification characteristics | No | |
| D. Commercial information | No | Nothing is sold through this site |
| E. Biometric information | No | |
| F. Internet or network activity | Yes | Pages viewed and events, via analytics — only if you opt in. My host processes request data regardless |
| G. Geolocation data | Yes | Approximate country and city derived from IP by Google. No device location is ever requested |
| H. Audio, electronic, or sensory information | No | |
| I. Professional or employment information | Yes | Only if you mention your role or company in the message field |
| J. Education information | No | |
| K. Inferences used to build a profile | No | Google Signals is switched off, so no demographic or interest profiling occurs |
| L. Sensitive personal information | No |
Retention by category. A, B and I follow the correspondence practice above: inquiries cleared within about a year, client correspondence retained longer as business records. F and G follow Google’s retention setting (14 months at the event level) and Cloudflare’s own retention policy.
Sources. Everything in A, B and I comes directly from you. Everything in F and G is collected automatically when you visit.
Disclosure and sale. I have not sold or shared personal information, and I don’t intend to. Service providers who handle it on my behalf — Formspree, Google Workspace, Cloudflare, and Google Analytics if you’ve opted in — are named above.
Your rights under US state law
If you’re a California resident, you have the right to know what I hold, access it, get a copy, correct it, delete it, and not be treated differently for asking. The right to opt out of sale or sharing for targeted advertising doesn’t come up here, because none of that happens. Nor does the right to limit use of sensitive personal information, because none is collected.
I honor Global Privacy Control signals as an opt-out preference.
Shine the Light. California Civil Code §1798.83 lets California residents ask once a year, free of charge, what personal information was shared with third parties for their direct marketing purposes. The answer is none — I don’t do that.
International transfers
I’m based in Massachusetts, so any information you send me leaves the EU or UK by definition. Google Analytics and my other service providers are US companies. Where transfer safeguards are required, I rely on the terms my providers have in place, which incorporate the European Commission’s Standard Contractual Clauses.
Contact
Dan Ciardi · hello@danciardi.com · danciardi.com/#contact