Privacy policy
This site is a personal portfolio. It sets no advertising cookies and does not build visitor profiles. What is collected, and why, is listed below.
Controller
Yazan Alrefaai, Damascus, Syria · eng.alrefaai@gmail.com
Contact form
The form collects your name, email address, and message. You may also provide optional project type, budget range, and timeline details. It is delivered by a small script that runs in my own Google account (Google Apps Script): it emails the enquiry to my Gmail inbox, sends you one confirmation email, and adds it to a private Google Sheet that only I can open. No third-party form service is involved. Your data is used only to answer your enquiry. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract) or Art. 6(1)(f) GDPR (legitimate interest in replying). Retention: enquiries are kept in my mailbox and that sheet for as long as needed to handle them, then deleted on request.
Hosting
The site is hosted by Vercel Inc. Vercel processes server log data (IP address, time of request, browser and operating system) to deliver the site and protect it from abuse. Legal basis: Art. 6(1)(f) GDPR.
Analytics
This site uses Vercel Web Analytics to count page views and a small set of non-personal interactions: whether a contact-form submission went through, copying the email address, use of the project filter, opening WhatsApp, downloading the CV, requesting a service package, and opening a case study. Event payloads carry at most a page or package name, never names, email addresses, messages, or form values. It also uses Vercel Speed Insights to measure page performance on real visits. Neither sets a cookie, and neither gives you an identifier that follows you to another website. They are not fully anonymous either: Vercel derives a temporary hash from the incoming request (IP address, browser and operating system) so that several page views within roughly 24 hours count as one visit rather than several. That hash is computed and held on Vercel's side, is never written to your device, is not shown to me, and expires with the session window. What reaches me are counts: that a link was used, not who used it. Vercel documents its own handling at vercel.com/docs/analytics/privacy-policy. Legal basis: Art. 6(1)(f) GDPR.
Third-party content
No page on this site embeds content from a third-party server. Fonts, images, and the GitHub contribution graph are all served from this domain, so no outside provider receives your IP address because of something a page loaded. That is narrower than "nothing leaves your device". Every page you open is requested from Vercel, which sees that request as the site's host (see Hosting), and the analytics above are collected through this domain and processed by Vercel on my behalf. Submitting the contact form additionally sends what you wrote to FormSubmit. Those are the transfers; there are no others.
Local storage
Your theme choice (dark or light) is saved in your browser's local storage. It stays on your device, is never sent to a server, and is not used to identify you. Clearing your browser data removes it. Your language is not stored anywhere. It is part of the address of the page you are reading (/en/, /ar/ or /de/), so switching language changes the URL and nothing else.
Your rights
If you are in the EU/EEA or the UK you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. To exercise any of these, email eng.alrefaai@gmail.com. You also have the right to lodge a complaint with your national data protection authority.
International transfers
I am based in Syria. The providers named above (Vercel, and Google for the contact form and my email) are US companies, so data you send through this site is processed outside the EU/EEA. Whether a particular provider is certified under the EU–US Data Privacy Framework, or relies on standard contractual clauses instead, is that provider's own statement to make. I have not independently verified it for either, so please do not read this page as a guarantee of adequacy. By using the contact form you accept the transfer it involves. Emailing me directly takes the same route: my address is a Gmail account, so a message sent that way is also processed by Google. If that does not suit you, send a short note without personal details and we can arrange another channel.
Last updated: September 26, 2026