Privacy policy

Who is responsible

Yury Donchenko is the controller of the personal data described in this policy. He runs this website as a self-employed professional (autónomo) in Spain under the trading name Synaxis Labs.

For any question about this policy or your data, write to hello@synaxislabs.com. Data-protection requests are handled through the same address.

What the contact form collects

If you choose to use the contact form, it asks for the following information. The fields are required to send the form, but using the form is voluntary and you may contact us by email instead.

• Name — so we know who we are replying to.
• Work email — the address we reply to and use as the reply-to address of the internal notification.
• Message — the enquiry or project information you choose to provide.

Purposes and legal bases

We use the form data only to read, manage and reply to your enquiry, and to continue the related professional correspondence. Where you request services for yourself or take steps towards a contract to which you would be a party, the basis is Article 6(1)(b) GDPR. For other professional enquiries, including enquiries made on behalf of a company, the basis is Article 6(1)(f): our legitimate interest in responding to relevant business communications.

Spam prevention, rate limiting and security logs rely on Article 6(1)(f) GDPR: our legitimate interest in protecting the form, the mail service and the availability of the website. We do not add contact-form details to marketing lists or use them for unrelated advertising.

Spam protection and temporary identifiers

Cloudflare Turnstile protects the form against automated abuse. It processes signals such as the IP address, TLS fingerprint, user-agent header, site key and associated origin. Cloudflare acts as our processor when it uses those signals to protect this website, and as a separate controller when it uses them to improve Turnstile’s bot-detection capabilities.

The application also keeps short-lived rate-limit entries keyed by IP address in server memory for no more than one hour. Aggregate request and delivery counters use fixed labels rather than user identifiers and may remain for up to 24 hours. To suppress an accidental duplicate, the application keeps a SHA-256 fingerprint derived from the email address and normalised message for the configured duplicate window, normally 30 minutes and never more than 24 hours. These values are not written to an application database and are removed sooner if the service restarts.

Server logs

The edge server creates ordinary security and access logs that may contain the IP address, timestamp, requested path, response status and user agent. They are used to diagnose faults and detect abuse. Retention is controlled by bounded, size-based log rotation rather than a fixed number of days, so the exact period varies with traffic. Older entries are discarded as the log files fill, and the logs are not combined with the content of contact messages for profiling.

Service providers and international transfers

We do not sell contact data. The following providers receive only the information needed to supply hosting, email or form-security services. Their roles and processing locations are not identical.

• Hetzner Online GmbH (Germany) — hosts the website infrastructure in the European Union and processes hosting data on our behalf.
• Zoho — provides the mailbox and outbound email service through the European service region. Limited access from other Zoho group locations may occur for support and resilience; Zoho states that such access is covered by standard contractual clauses and supplementary measures.
• Cloudflare — supplies Turnstile. It may process signals internationally. For website protection it acts as a processor under the applicable data-processing terms; for improving Turnstile it acts as a controller under its Turnstile Privacy Addendum and main Privacy Policy.

How long we keep data

Contact messages that do not lead to a client relationship are kept for no longer than 12 months after the last exchange and are then deleted from the active mailbox. If an enquiry leads to a contract, related correspondence may be retained for the duration of the relationship and afterwards for as long as legal obligations or the establishment, exercise or defence of claims require.

IP-keyed rate-limit entries are removed after their protection window, which is no more than one hour; aggregate counters without user identifiers may remain for up to 24 hours. Duplicate fingerprints are normally removed after 30 minutes and never later than 24 hours. Server logs follow the size-based rotation described above. Providers may retain data for their own documented periods when they act as separate controllers or must meet legal and security obligations.

Cookies and analytics

We do not use analytics, advertising cookies, tracking pixels or social-media widgets. Turnstile is loaded only after you interact with the contact form and may use strictly necessary signals or storage technologies described in Cloudflare’s policies to detect bots. We do not use Turnstile for advertising or cross-site profiling. Because the site does not use optional analytics or advertising technologies, it does not display a consent banner.

Your rights

Subject to the conditions in the GDPR, you may request access to, rectification or erasure of your data, restrict its processing, receive portable data where applicable, or object to processing based on legitimate interests. Write to hello@synaxislabs.com; we normally respond within one month.

If you believe your data has been handled improperly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the supervisory authority in the country where you live or work.

Changes to this policy

If we change how the website handles personal data — for example by adding analytics or another contact channel — we will update this page and the date above before the change takes effect.