Privacy notice

This is the privacy notice for kyle-dsgn.com, the personal portfolio of Kyle Hazan, an independent product designer based in Paris. I decide what happens to the data described here, which makes me its controller under the GDPR.

It covers this website only — not the products I designed for clients, which are governed by those companies’ own notices.

There are no advertising tags on this site and nothing is sold or profiled. Fonts are self-hosted, so simply loading a page does not announce your visit to anyone else.

Three things produce data:

Contact form

Your name, email address, project type, timeline, and — if you fill them in — a start date and a description of your project. Nothing is pre-filled and nothing is required beyond those first four fields.

Analytics

If — and only if — you accept the banner, Google Analytics records which pages you view, roughly where in the world you are, what kind of device you are on, and a handful of actions: opening the About or Contact panel, opening my resume, and starting or sending the contact form. It stores an anonymous ID in your browser so a second page counts as the same visit. IP addresses are truncated before they are stored. Decline, and the script is never downloaded at all.

Server logs

Like any web server, mine records the requests it serves: IP address, timestamp, page requested, and browser user-agent. Submitting the contact form also holds your IP address in memory for ten minutes so the endpoint can rate-limit abuse.

Contact form submissions exist for one reason: so I can reply to you. The legal basis is the step taken at your request before any contract — you wrote to me about working together. I do not add you to a mailing list, and I have none to add you to.

Server logs and rate limiting rest on legitimate interest: keeping the site online and the contact endpoint free of automated abuse. It is the minimum a working web server produces.

Analytics rests on your consent, and nothing else. I use it to see which case studies are worth keeping and where people lose interest — not to identify you. You can withdraw that consent at any time, and it costs you nothing to refuse in the first place.

No one buys it, and no one is sold it. Four processors are involved in running the site:

Google Analytics

Measures the traffic described above, once you have accepted. Google is based in the United States; the transfer runs on the European Commission’s standard contractual clauses. Refusing the banner means Google never hears from your browser.

Resend

Delivers the contact form as an email to my inbox. It handles the fields you submitted, in transit.

Hosting provider

Serves the pages and keeps the request logs described above.

Image hosts

A few placeholder images in the homepage header are still loaded from Unsplash, so your browser requests them directly and Unsplash sees your IP address. These are being replaced with locally hosted images.

Contact emails stay in my inbox for as long as our conversation is live, and for up to two years after it ends in case we pick it back up. Ask me to delete one sooner and I will.

Analytics data is kept for the shortest window Google offers — two months — after which only aggregate counts remain. Your consent choice itself lives in your browser, not on my server.

Rate-limiting records live in memory for ten minutes and vanish on every server restart — they are never written to disk. Server logs follow my host’s standard retention, a matter of weeks.

The only cookies this site can set are Google Analytics’, and only after you press Accept. Press Decline and none are set, because the script that would set them is never loaded. Nothing on this site is gated behind that choice — the banner is a real question, not a formality.

Two other things are stored in your browser and are not cookies: your answer to the banner, which is kept locally so you are not asked on every page, and a session flag that tells the next page whether to play the transition animation you just triggered. Neither travels to a server, and the second disappears when you close the tab.

To change your mind, clear this site’s data in your browser settings — the banner will ask again on your next visit.

Under the GDPR you can ask for a copy of the data I hold about you, have it corrected, have it deleted, have it sent to you in a portable format, or object to my holding it at all. There is no form for this and no verification hoop — write to me and I will handle it within a month.

If you think I have handled your data badly, you can complain to the CNIL, the French supervisory authority.

Last updated 4 September 2026. Analytics was added on this date, behind the consent banner. If the site starts doing something else with data — a newsletter, anything measurable — this page changes before that ships, not after.