Privacy policy

01Who is responsible

The controller for the data processing described here is Charalampos (Haris) Kostaras, Bülach, Zürich, Switzerland, trading as Kostaras Digital. For any privacy question, write to haris@kostaras.digital.

This policy follows the Swiss Federal Act on Data Protection (nDSG / revFADP) and, where it applies to visitors from the EU and EEA, the General Data Protection Regulation (GDPR).

02Hosting in Germany

This website runs on WordPress and is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, on servers in Germany. I have a data processing agreement with IONOS (Art. 28 GDPR).

To deliver the pages and keep them secure, the server automatically processes technical data such as your IP address, date and time of the request, the page requested, your browser and operating system, and the referring page. This data is used only to run the site and protect it against misuse, and is kept for a short period. Germany is recognised by Switzerland as having an adequate level of data protection. Legal basis under GDPR: legitimate interest in running a secure website (Art. 6(1)(f)).

03Cookies and your consent

This website uses no analytics, no advertising tools and no tracking cookies. Fonts are served from this website itself, so your browser doesn't contact Google or other font services.

The cookie notice is run by Cookiebot, a service of Usercentrics A/S, Copenhagen, Denmark. When you first visit, its script loads from Cookiebot's servers and asks for your choice. Your choice is saved in a cookie called CookieConsent for up to 12 months, and Cookiebot keeps a record of it (with a shortened IP address, date and time, browser details and your choice) as proof of consent. Legal basis under GDPR: legal obligation to document consent, and my legitimate interest (Art. 6(1)(c) and (f)). You can change your choice at any time with Cookie settings at the bottom of every page.

Your browser also stores a few small preferences locally: light or dark mode, and how many AI demo questions you've asked today. This stays on your device and you can delete it at any time by clearing your browser's site data. If you open a password-protected prototype, a technically necessary cookie remembers for 30 days that you entered the password.

04When you contact me or book a call

If you write by email, send a WhatsApp message or book a call, I process the details you share (for example your name, email address, organisation and message) to reply and to prepare our conversation. Legal basis under GDPR: steps before a contract, or my legitimate interest in answering enquiries (Art. 6(1)(b) and (f)).

• Book a call: your booking (name, email, organisation, your note, the time you chose) is stored on this website's server in Germany. You get a confirmation email with a calendar invite and a link to cancel. To create the meeting link, the booking is added to my calendar at the provider you pick: Google Meet (Google Ireland Ltd.) or Microsoft Teams (Microsoft Ireland Operations Ltd.). The provider then sends you the invitation, under its own privacy terms.
• Notifications: I get a short alert about new bookings on my phone via Telegram (Telegram FZ-LLC, Dubai). It contains only what's needed to see the booking, such as your name, organisation and the time.
• Email is handled by my email hosting provider.
• WhatsApp is run by WhatsApp Ireland Ltd. / Meta, under its own privacy policy.

Google Calendar connection. The website's booking tool is connected to my own Google account through the Google Calendar API, only to create, update and cancel the meeting event (with its Google Meet link) for a call you book. It uses the permission calendar.events and does not read, store or share any other Google data. Your own Google account is never accessed: you only receive the calendar invitation by email. The access token is kept only on this website's server in Germany, is used only by the booking tool, and can be revoked at any time in my Google account. The use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

I keep enquiries and bookings for as long as needed to handle them, and at most two years if no project follows. If we work together, business records are kept for as long as Swiss law requires (usually ten years).

05AI live demos

On the AI pages you can type a question to demo assistants. Your question is sent through this website's server (IONOS, Germany) to Infomaniak Network SA in Switzerland, where the open-source model Apertus generates the answer. Questions are only used to create that answer. I don't store them. Infomaniak processes them under its own privacy terms.

To limit the demo to 3 questions per visitor per day, the server keeps a counter for 24 hours under a one-way code made from your IP address and the date. The IP address itself is not stored. Please don't enter personal or sensitive information in the demo.

06Prototype previews

Under /prototypes/ I share private website prototypes with the organisations I've made them for. The links aren't listed publicly. When a prototype is opened, I log the visit so I know my proposal arrived: the time, the page viewed, your IP address, the referring page, the browser type, and an approximate location and network name looked up from the IP address (via ipwho.is). I may get a short alert about the visit via Telegram. Only the last 100 visits per prototype are kept, and the log is deleted with the prototype. Legal basis under GDPR: legitimate interest in following up on a proposal I sent (Art. 6(1)(f)).

07Links to other services

Links to LinkedIn and WhatsApp open those services. Once you're there, their own privacy policies apply.

08Sharing your data

I don't sell or rent personal data. It is only shared with the service providers named above, as far as needed for them to do their job, or where the law requires it.

09Your rights

You can ask me at any time:

• what data I hold about you (right of access)
• to correct or delete it
• to stop or restrict processing, or to object to it
• to receive your data in a common format (data portability)

Just write to haris@kostaras.digital. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to your local data protection authority.

10Changes

I update this policy when the website or my services change. The date at the top shows the latest version.