Privacy policy

1. Who is responsible

The controller is João Saldanha, working as onyr1x, based in Almada, Portugal. Contact for anything about your data: hello@onyr1x.com.

Given the small scale of processing, no Data Protection Officer has been appointed.

2. What I collect and why

• Messages and enquiries (contact forms or email to an @onyr1x.com address): your name, email address, the details you choose to share, the page and language you used, and, if you arrived through a social-media link, which platform it was (for example “Instagram”). Purpose: to reply and, if you ask, to prepare and carry out an agreement. Legal basis: steps taken at your request before a contract (GDPR art. 6(1)(b)) and my legitimate interest in answering messages (art. 6(1)(f)).
• Technical data needed to deliver the site: IP address, browser type, requested page and time, processed by the hosting provider for delivery and security. The contact form also holds your IP address briefly in memory to block spam; it is not stored. Legal basis: legitimate interest in running a secure website (art. 6(1)(f)).
• Music playback: only if you allow the SoundCloud player (see section 3). Legal basis: your consent (art. 6(1)(a) and Law 41/2004).
• Analytics (only if you opt in): pages viewed, clicks, device and browser type, approximate country, page performance, errors, and recordings of how the page was used, with every form field hidden. IP addresses are anonymised. Purpose: understanding which pages help and fixing problems. Legal basis: your consent (art. 6(1)(a) and Law 41/2004).

Providing your details is voluntary, but I need an email address to reply. No automated decisions or profiling take place, and your data is never sold or used for advertising.

3. Cookies and similar technologies

• Strictly necessary: “onyr1x-consent” in your browser's local storage remembers your privacy choices for 12 months. It is exempt from consent because it is needed to respect those choices.
• SoundCloud player (optional): once you allow it, SoundCloud's player loads and may set its own cookies under SoundCloud's cookie policy. It never loads before you press play and agree.
• Analytics (optional, off by default): if you opt in, PostHog stores a first-party cookie and local-storage entry (named “ph_…_posthog”) with a random visitor ID, kept for up to 12 months. It never loads if you decline or your browser sends a Global Privacy Control signal.
• No advertising cookies and no fingerprinting. Fonts are hosted on this site, so no request is made to Google Fonts.

You can change or withdraw your choices at any time through “Privacy settings” at the bottom of every page. Withdrawing consent does not affect anything done before.

4. Who else handles your data

• Vercel Inc. (USA): website hosting.
• Resend (Plus Five Five, Inc., USA; sending from its EU region in Ireland): delivers contact-form messages to my inbox.
• Forward Email (Forward Email LLC, USA): forwards email sent to @onyr1x.com addresses.
• Google Ireland Limited (Gmail): the inbox where messages are kept.
• Cloudflare, Inc. (USA): domain name (DNS) services.
• PostHog, Inc. (USA): website analytics and session recordings, only if you opt in. Data is sent through this site's own address and IP addresses are anonymised.
• Six Minutes Late Digital Solutions LLC (USA): builds and maintains this website and manages the hosting and email-delivery accounts on my behalf.
• SoundCloud Global Limited & Co. KG (Berlin, Germany): only if you allow the player, as an independent controller for the data it collects.

Service providers act on my instructions under data-processing terms. Where a provider is outside the European Economic Area, transfers rely on the EU–US Data Privacy Framework (for certified companies) or on the European Commission's Standard Contractual Clauses (GDPR art. 45–46).

5. How long data is kept

• Enquiries that don't lead to a project: deleted within 24 months of our last contact.
• If we work together: for the duration of the project, then as long as Portuguese tax and accounting law requires for invoices and related records (generally 10 years).
• Hosting request logs: kept only briefly by the hosting provider for delivery and security.
• Analytics (if you opted in): session recordings are deleted after 30 days; usage statistics are kept in pseudonymous form and deleted on request.
• Your privacy choices: 12 months on your own device.

6. Your rights

You can ask to access, correct or delete your data, restrict or object to its use (including processing based on legitimate interests), receive it in a portable format, or withdraw consent at any time (GDPR art. 15–22 and 7(3)). Email hello@onyr1x.com; I'll reply within one month, free of charge. I may ask you to confirm your identity.

You also have the right to complain to the Portuguese data-protection authority: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt, or to the authority in the EU country where you live or work.

7. Security, children and changes

The site is served only over encrypted HTTPS, and access to messages is limited to me and the service providers above.

This site is not aimed at children. Under Portuguese law, children under 13 should not send personal details without a parent or guardian.

If this policy changes, the date at the top will change. Significant changes will be highlighted on this page.