Legal / Data principles
Data Policy
The practical rules I follow to collect less, separate purposes, limit access, and delete data responsibly.
- 01Collect less
- 02Keep purposes separate
- 03Protect private records
- 04Retain with an end date
- 05Delete carefully
- 06Request a change
Collect less
I ask only for information needed to provide a feature or answer a request. Public forms are not intended for identity documents, financial information, health records, precise location, or private attachments.
Keep purposes separate
An enquiry, publication subscription, Vartalap contribution, privacy request, and optional Aeva share serve different purposes. A submission for one purpose is not silently reused for another.
Protect private records
Private operational records are kept behind authenticated access. Public content and private submissions are treated as separate data classes. Service providers receive only the information needed for hosting, delivery, storage, abuse prevention, or an optional AI answer.
Retain with an end date
Personal records receive a defined retention period based on their purpose. Expired records are removed by controlled maintenance, subject to a documented legal or security hold when one is genuinely required.
Delete carefully
A deletion request is verified, scoped, applied to eligible active records, and allowed to reach protected backups through expiry. I keep only the minimum evidence needed to record that the request was completed.
Request a change
To request access, correction, deletion, consent withdrawal, or a grievance review, use the privacy request form. The current Privacy Notice explains how I handle the request itself.