Privacy policy

This site collects nothing about you unless you write to me through the contact form. There are no advertising cookies and no third-party services reading along when you visit. Two exceptions: one technical cookie for your choice of language, and anonymous visitor statistics on my own server - more on both below.

I am the controller for the data processed on this site: Noa Yan, based in Biel/Bienne, Switzerland. You can reach me at the address at the bottom of this page.

Only what you type into the contact form yourself: name, email address and your message. Plus the language you were using the site in and the time of the enquiry. When you submit, I also process your IP address briefly to stop anyone flooding the form: it stays in memory for at most an hour and is never stored.

Solely to answer your enquiry. I do not sell your data and do not use it for advertising; apart from the delivery services named in the next section, nobody receives it.

This site is aimed primarily at clients in Switzerland, so the revised Swiss Data Protection Act (revFADP) applies. If you write to me from the EU, the GDPR applies as well. I process your enquiry in order to prepare a possible contract (Art. 6(1)(b) GDPR); the access logs and the spam protection rest on my legitimate interest in running the site securely (Art. 6(1)(f)).

In an SQLite database on a server in Switzerland that I run myself. So I see a new enquiry quickly, the site sends a push notification (ntfy; without an instance of my own it runs via ntfy.sh in Germany) - it only says that an enquiry has arrived, with its number, but contains neither name, address nor text. Once mail delivery is set up, the mail service Resend (USA) will handle the confirmation email; name, email address and message are transmitted to it.

An enquiry is kept for at most 12 months - after that a weekly clean-up run deletes it. Sooner works too: an informal email is enough and I delete it right away. Separately, I make a backup every day and keep the last 30; a deleted enquiry disappears from them after 30 days at the latest. If I ever have to restore a backup, I immediately delete deleted and expired enquiries again.

The web server records every request: IP address, timestamp, the address requested and the browser identifier. I need this to spot faults and attacks. The logs are rotated daily and deleted automatically after 14 days; I do not analyse them to follow individual visitors.

A single technical cookie: it remembers which language you read the site in. It holds nothing but the language code - de, en or fr - and no identifier that could recognise a device. It counts nothing, does not follow you and therefore needs no consent. The fonts are served from my own server, not from Google.

I count page views with Umami, a statistics tool running on my own server. It sets no cookies and builds no profiles - I only see which pages are visited how often, on what type of device, and roughly from which country. The data never leaves my server and cannot be linked to a person.

You can ask at any time what data I hold about you, and demand that it be corrected, deleted or handed over in a common format. You can also object to the processing. Just write to me - an informal email is enough, and you do not have to give a reason. If you think I am handling your data wrongly, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or, from the EU, to the data protection authority of your country.