diaboliko.dev Back to portfolio ↗
EN
Italiano ITEnglish EN
System
Theme preference

Privacy

How personal data is used

Last updated:

The data controller is Karim El Azazy, publicly known as Diaboliko, based in Rome, Italy. This website is a personal portfolio. For privacy requests, email contact@diaboliko.dev.

The portfolio presents personal work, projects and interests. The contact form asks for your name, email address, subject and message so that your enquiry can be answered. These details are needed to use the form and receive a reply; you may contact me directly by email instead. Please avoid sensitive or unnecessary information. The website and security services also process technical request data, such as IP addresses, browser characteristics and information used to identify abuse.

Handling correspondence and protecting the portfolio rely on the legitimate interest in answering incoming enquiries and securing the service under GDPR Article 6(1)(f), taking account of individuals’ rights. Where an enquiry specifically concerns steps requested before entering into a contract, Article 6(1)(b) applies to the relevant processing. The form does not request blanket consent or subscribe anyone to a newsletter or promotional messages.

When the form is enabled, Cloudflare Workers validates the data and checks a Turnstile token only if Turnstile is enabled in the configuration. Cloudflare’s native FORM_EMAIL binding sends the message directly to the controller’s verified Gmail inbox, where it is read and stored. Separately, the public address contact@diaboliko.dev uses Cloudflare Email Routing to forward incoming email to that inbox. The personal Gmail address is not published in the frontend. The code does not store messages in an application database or write their contents to application logs. A form confirmation means acceptance by the email service, not guaranteed delivery.

Cloudflare provides Workers Static Assets hosting, Workers for the API, Turnstile spam protection when enabled, the native email binding for notifications to the verified Gmail inbox and Email Routing for the public email address. Google provides Gmail for receiving, managing and storing correspondence. Relevant notices are Cloudflare Privacy, the Turnstile Privacy Addendum and Google Privacy. Contractual roles and applicable terms depend on the services and account actually used.

Turnstile is currently disabled. It loads only when enabled in the configuration and after you select “Activate verification”. In that case, your browser communicates with Cloudflare to obtain a token that the Worker must verify before sending. Cloudflare may process technical device and connection signals to distinguish human requests from automated traffic. Pre-clearance is not requested. Attempt limiting uses an IP-derived key in Cloudflare’s native service; the code does not maintain an application IP database. These measures protect the contact form. Any Cloudflare WAF rules are separate from Turnstile and depend on the platform configuration. Direct email remains available.

The controller retains messages for no more than 12 months after the last communication, a period approved by the controller. Open enquiries or records subject to an applicable obligation are kept only as long as needed for that purpose and reviewed periodically. Deletion covers copies managed by the controller in Gmail, including Sent and Trash where applicable. Providers’ technical logging, backup and deletion periods follow their own terms and settings; they are separate from this inbox policy and must be checked for the actual account.

Using Cloudflare’s network and Gmail may involve processing outside the European Economic Area. Providers publish information about transfer arrangements and safeguards: see Cloudflare Privacy and Google’s transfer information. The controller must verify which terms and safeguards apply to the actual account. Processing exclusively in Italy or the EEA is not promised.

You may request access, correction, deletion and restriction, object to processing based on legitimate interests and request portability where the relevant conditions apply. Email contact@diaboliko.dev. The controller normally responds within one month; any GDPR-permitted extension is communicated within that period. You may complain to the Italian supervisory authority, the Garante per la protezione dei dati personali. No automated decisions with legal or similarly significant effects on individuals are intended.

Theme and language preferences are described in Cookies and preferences. No analytics, advertising, remote fonts or embedded videos are included. External links lead to services with their own notices.