Privacy Policy

I work in information security, so this isn't just legal boilerplate. I actually care about this. Here's what happens when you visit matelendvai.eu.

What I collect

Nothing, unless you contact me or use the light/dark toggle. There's no tracking, no analytics, no advertising technology, and no cookies that follow you anywhere else. The one exception: the light/dark toggle sets a small cookie so the site remembers your preference next time, and the newsletter popup uses your browser's session storage so it doesn't show itself twice in one visit. Both stay local to that one decision - nothing is tracked, sold, or shared.

If you click the envelope icon and email me, your address and message land in my Gmail inbox. I use it to reply. I don't add you to any list or pass it on to anyone.

The Inner Circle popup on this site is just a link out to my Substack. I don't collect, see, or store your email anywhere on this site - when you click through and subscribe, that happens entirely on Substack's own page, in their form. I use my Substack publication to send occasional emails about AI, risk management, information security, and career topics. No schedule - only when I have something worth saying.

Substack (newsletter platform)

My newsletter runs on Substack, a US-based publishing platform. When you subscribe, your email is stored on Substack's servers - not mine. Substack is certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), which is the legal basis for your data leaving Europe. Substack maintains its own privacy policy: substack.com/privacy.

I don't sell or share your data with anyone. You can unsubscribe at any time using the link at the bottom of every email, or by managing your subscription directly on Substack.

Third-party services

This site self-hosts its fonts. No files are loaded from Google Fonts or any other external server, so your IP address isn't transmitted anywhere just by loading the page.

I don't use Google Analytics, tracking pixels, or any advertising technology. The only things stored locally are the light/dark mode cookie and the newsletter popup's session flag, both covered above - nothing else.

Hosting

The site runs on Rackhost.hu in Hungary. Like any web host, their servers keep standard access logs: your IP, the page you requested, the timestamp. That's normal infrastructure, not something I look at or configure. Rackhost's own policies govern how long they keep those logs.

Your Gmail if you contact me

Gmail is Google's product, so Google's privacy policy applies to anything you send me: policies.google.com/privacy. I can't change that, but I don't forward your messages to anyone or use them for anything other than replying.

Your rights under GDPR

You have the right to see what I hold about you, correct it, or have it deleted. For newsletter subscribers, you can unsubscribe any time - the link is in every email. If you want your data removed from Substack entirely, you can unsubscribe from your Substack account settings, or email me and I'll help. You can also complain to a supervisory authority - in Hungary that's the NAIH, and since I'm based in Frankfurt am Main, the relevant German authority is the Hessischer Beauftragter für Datenschutz und Informationsfreiheit (HBDI).

Changes

If anything material changes here I'll update the date at the top. This URL always has the current version.