Privacy Policy

Welcome to Gerald Bahati's Portfolio ("I", "me", or "my"). I am committed to protecting your personal information and respecting your privacy. This Privacy Policy explains how I collect, use, disclose, and safeguard personal information when you visit or use my website at geraldbahati.dev and related services (collectively, the "Services").

Please read this Privacy Policy carefully. By using my Services, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Services.

Data Controller:
Gerald Bahati
Based in Nairobi, Kenya

Privacy Contact:
Email: contact@geraldbahati.dev

For privacy inquiries, to exercise your rights, or to report a privacy concern, contact me using the email address above.

• Personal information / personal data: Any information that identifies or can reasonably identify an individual.
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• Service Providers / Processors: Third parties who process data on my behalf.

I collect personal information in two ways: information you provide directly and information collected automatically.

4.1 Information You Provide

When you interact with my Services, you may provide:

• Identity & Contact: Name and email address.
• Communications: Messages you send through the contact form, support requests, and feedback.
• Content you submit: Any information included in your contact form submissions.

4.2 Information Collected Automatically

I automatically process limited technical information needed to operate, secure, and diagnose the Services, such as IP address, browser type, operating system, user agent, approximate country or region, request metadata, and application error details. Sentry error monitoring is configured without default personal-information collection, and sensitive query parameters are removed before an error event is sent. I do not collect precise GPS location.

Only after you accept analytics, I additionally collect:

• Usage data: Pages viewed, time on page, scroll depth, projects opened, and interactions with contact links and navigation.
• Performance data: Core Web Vitals used to understand and improve page performance.

PostHog session recording and automatic element capture are disabled. The portfolio sends page views and the specific interaction events described above only after consent.

Separately, Cloudflare Web Analytics measures aggregate traffic on every page load. It records the page address, the referring address, browser and operating system type, approximate country, and page-load timings. It sets no cookies, writes nothing to your device, and assigns you no identifier, so it cannot follow you between sites or be used to build a profile of you.

I use personal information for the following purposes and legal bases where applicable:

• To provide and operate the Services.
• To respond to contact form submissions and inquiries.
• To send transactional communications related to a message or request.
• To improve the website, its content, and its performance.
• To comply with legal obligations and protect legal rights.
• To prevent fraud, spam, and abuse.

If I rely on consent to process information, you may withdraw that consent at any time.

Analytics require your consent

No analytics cookies or browser storage are used until you accept them. When you first visit, a banner asks whether you consent to analytics. Until you choose, analytics remain off.

• If you accept: Analytics storage is enabled and the usage information described above may be collected.
• If you decline: No analytics events are sent.

Cloudflare Web Analytics sits outside that choice. Because it uses no cookies and no browser storage, it neither reads from nor writes to your device, and it runs on every page load regardless of what you decide here. It reports visit counts and page timings in aggregate only.

Categories of storage

• Essential: Required for core functionality, form submission, and security.
• Analytics: Used only with consent to understand how the site is used.
• Functional: Used to remember preferences, including your analytics choice.

You can withdraw or grant consent at any time using the analytics controls at the bottom of this page.

I may share personal information with service providers that help operate this website, when required by law, to protect legal rights or safety, or when you instruct me to do so.

Third-Party Services

The portfolio currently uses service providers for:

• Hosting and edge infrastructure: Cloudflare Workers.
• Database and form processing: Cloudflare D1 and the portfolio API.
• Email delivery: Resend.
• Product analytics: PostHog EU Cloud, only with your consent.
• Aggregate traffic measurement: Cloudflare Web Analytics, cookieless and not dependent on consent.
• Error monitoring: Sentry, used as essential operational monitoring with data minimisation and URL scrubbing.
• Media delivery: Cloudflare Stream, Images, and R2.
• Authentication: Better Auth for restricted administration features.

These providers maintain their own privacy policies and security measures.

Some service providers may process information outside Kenya. Analytics are configured for PostHog's European Union cloud. Where information is transferred internationally, I rely on the safeguards supplied by the relevant provider and applicable law.

Contact contact@geraldbahati.dev for information about processing locations and safeguards.

I retain personal information only as long as needed for the purposes described and to comply with legal obligations. Typical periods include:

• Contact form submissions: Up to 2–3 years, or until a valid deletion request is completed.
• Email communications: Up to 2 years for business correspondence.
• Analytics data: According to the analytics project's configured retention settings.
• Application error data: According to the error-monitoring project's configured retention settings.
• Security and server logs: Generally up to 30 days.

Actual periods may vary with the nature of the request and legal or security requirements.

Depending on your jurisdiction, you may have rights including:

• Access: Request a copy of your personal data.
• Rectification: Request correction of inaccurate or incomplete information.
• Erasure: Request deletion where permitted by law.
• Restriction: Request limits on processing in certain circumstances.
• Portability: Receive information in a commonly used, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent where processing depends on it.

To exercise a right, email contact@geraldbahati.dev. I may need to verify your identity and will respond in accordance with applicable law, typically within 30 days.

The contact form is protected by rate limiting and anti-abuse controls. When you submit the form, technical request information such as IP address and user agent may be processed for security and fraud prevention.

If you are in the EU, EEA, or UK, the GDPR provides rights similar to those described above. Legal bases may include performance of a contract, compliance with legal obligations, legitimate interests in operating and protecting the site, and consent.

Consent is the basis for optional product analytics. Nothing is collected for that purpose until you accept, and withdrawing consent is as easy as granting it. Essential security, abuse prevention, minimised application-error monitoring, and cookieless aggregate traffic measurement rely on legitimate interests in operating and protecting the Services.

The Services are not directed to children under 13, or under 16 where local law requires. I do not knowingly collect personal data from children. If I learn that this has happened without appropriate consent, I will take steps to delete it.

I use reasonable technical and administrative safeguards, including encrypted transport, access controls, authentication, rate limiting, and security monitoring.

No internet transmission is completely secure. If you believe information submitted through this website has been compromised, contact contact@geraldbahati.dev.

The Services may link to third-party websites, projects, or profiles. This Privacy Policy does not apply to those third parties. Review their privacy information before providing personal data.

I may update this policy to reflect operational, legal, or regulatory changes. Material changes will be indicated by updating the effective date and version shown on this page.

For privacy questions, requests, or complaints:

Gerald Bahati
Based in Nairobi, Kenya

Email: contact@geraldbahati.dev

Availability: Monday–Friday, 9:00–18:00 EAT. Email is available asynchronously at any time.