Privacy notice

Who is responsible

This is a personal portfolio website. The person responsible for processing personal data on it (the controller) is Mikhail Fediunin. You can reach me by email at fediuninmichail@gmail.com.

Visiting the website

When you open a page, your browser sends technical data to the server that hosts the site: your IP address, the page requested, the time, and your browser and operating system. The hosting provider processes this data to deliver the site and keep it secure, and may keep it in server logs for a limited time.

The legal basis is a legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

Cookies and local storage

The website does not set cookies and does not store anything in your browser's local storage. Fonts are served from this website, not loaded from third-party font services.

Contact form

If you send a message through the contact form, I receive what you enter — your name, how to reply (email address or Telegram username), the topic and the message. The message is delivered to me through the Telegram Bot API, which means it is transmitted to and stored by Telegram, a service that may process data outside the European Union.

To protect the form from spam, the sender's IP address is held in the server's memory for up to ten minutes to limit how many messages can be sent in a row. It is not written to a database.

The legal basis is responding to your enquiry and taking steps before a possible contract (Art. 6(1)(b) GDPR) or a legitimate interest in answering messages (Art. 6(1)(f) GDPR). I keep messages as long as needed to handle the enquiry and any work that follows, and delete them on request.

Live API in the system playground

When you switch the playground to Live API, your browser sends demo requests to the site's API server. Like any server, it receives your IP address with each request.

The first live request creates an anonymous sandbox: a random token, and a secret the page uses to sign demo webhooks, both kept only in the page's memory (no cookies, no storage). The server stores a SHA-256 hash of the token and the secret, in memory without disk persistence, and forgets them after 30 minutes.

To limit how many requests one client can send, the server uses a hash of your IP address keyed with a secret that changes every day. The address itself is not stored, and access logs are turned off.

Orders you create in the sandbox hold only demo fields — product, quantity and delivery type — and are deleted when the sandbox expires or when you choose to delete it. The trace of each request (operation names and timings, no request bodies) is kept for five minutes so the page can replay it.

Background jobs you start (a report, a demo payment through a simulated provider) pass through a message queue. A job holds only the task id, the demo fields and the hashed sandbox key; jobs, their records and failed jobs in the dead letter queue are deleted after at most 30 minutes.

Demo webhooks you send record the event id, its type, the order number and the resulting payment status under the hashed sandbox key; they are deleted after at most 30 minutes.

While Live API mode is on, the page keeps a WebSocket connection to the same API server so the results of your sandbox's requests are pushed to it. The connection identifies the sandbox with its token once, in its first message; it is held only in the server's memory and closes when the sandbox expires or is deleted. The latest notifications (the event name, a task or order number and the time — at most 20) are kept with the sandbox and deleted with it.

Creating a demo order also publishes an order event — the same demo fields and the hashed sandbox key — to an event log, where demo services reserve stock, add the sale to anonymous daily totals and queue a demo notification for the sandbox. The event log keeps events for an hour; reservations and notifications go with the sandbox, and the daily totals hold no sandbox key.

The legal basis is a legitimate interest in running the demonstration you asked for (Art. 6(1)(f) GDPR).

Links to other services

The site links to external services, such as professional profiles or a scheduling page. When you follow such a link, the other service's privacy policy applies.

Your rights

Under the GDPR you have the right to:

• access the personal data I hold about you;
• have it corrected or deleted;
• restrict or object to its processing;
• receive it in a portable format;
• lodge a complaint with a data protection supervisory authority.

Changes

This notice is updated when the website changes how it handles data. The date of the last update is shown above.