Privacy Policy

Who operates this website

This portfolio is operated by Mai Bunheng. For privacy questions or requests, contact [email protected].

Storage and preferences

The site stores your theme and language preferences in your browser. The privacy choice is stored in browser local storage as a versioned accept or reject record and expires six calendar months after it is made. The owner-only Admin login uses an essential authentication session cookie and Cloudflare Turnstile for sign-in security; these are not optional analytics. Newsletter verification also stores the submitted email in browser storage after verification.

Optional analytics and tracking

Google Analytics, LinkedIn Insight, Vercel Analytics, and Vercel Speed Insights are optional. They are not loaded until you explicitly accept optional tracking. You can change or withdraw that choice at any time using Privacy preferences in the site footer. The site cannot reliably remove cookies previously set by those third parties; you can also manage cookies in your browser.

Google Tag Manager is currently disabled while its published tag configuration is reviewed. No behavior from that container is included in this policy.

Contact form

If you use the contact form, the site processes the name, email address, phone number, company, and message you provide and sends them to the operator through Telegram. The endpoint uses the request IP address for an in-memory rate limit; its counter is cleared after one hour.

Newsletter registration

If you register for the newsletter and free tools, the site stores your email address, a keyed hash of a new ten-minute verification code, verification status, attempt count, and timestamps in MongoDB. Historical records may retain an older verification code until separately reviewed. Resend sends the verification email. After verification, the operator is notified through Telegram, and the email address is stored in your browser for the site’s newsletter flow. The application does not define a database deletion schedule for subscriber records. Public form rate limits store keyed hashes of client IP addresses or normalized email addresses with expiry timestamps.

This site does not currently provide an unsubscribe or self-service deletion flow. Contact the operator at the address above with a privacy request. Newsletter expiry, unsubscribe, retention, and deletion procedures have not yet been independently reviewed.

Retention and requests

The application code does not establish a general retention period for contact messages or newsletter records. Please email [email protected] for questions or a request concerning information you provided. The operator will need to review and respond to each request; no response timeline or automated deletion process is stated here.

Policy updates

This page may be updated when the site’s data practices change. The date at the top indicates the latest update.