Privacy policy

This policy covers rendonarango.com and its projects, including LFM. The data controller is Simon Rendon Arango, London, United Kingdom. For any privacy question or request, write to privacy@rendonarango.com.

The site collects personal data only when you use one of the features below. It has no accounts and no advertising cookies.

• Contact form. Your name, email address and message, and your IP address. Resend delivers them to my inbox as an email. The site keeps no copy in a database.
• Ask chat. The question you type and the recent messages of the conversation. The site sends them to OpenAI to search my CV and project write-ups and to write the answer. It sends the question and the answer to OpenAI again to suggest follow-up questions. The site does not store them, and it asks OpenAI not to store them either.
• Lab: talk to the site. When you start a call, your voice goes to OpenAI Realtime for the length of the call. OpenAI turns it into text and answers out loud. The site also sends OpenAI a hashed value of your IP address, so OpenAI can detect abuse. The site does not record or store the audio or the transcript.
• Lab: reorder the page. The line you write about yourself goes to OpenAI, which writes a plan for the page. The site keeps the plan for 30 days, so a shared link shows the same page. The plan can repeat a short description from your line. The site keeps a hash of the line, not the line itself.
• Lab: give my agent a job. The task you type goes to OpenAI, which writes a small app and its tests. The site does not store the task or the app.
• Lab: portfolio page from GitHub. The site fetches the public profile, the public repos and some READMEs of the GitHub account you name. OpenAI writes the text of the page from that data. The site stores the page for 7 days at a public link, and it remembers which account the page is for during 24 hours. To remove a page sooner, email simon@rendonarango.com.
• Hero terminal. If you type something that is not a command, the site sends that text to TypeSafe, whose Jev model picks the page you most likely want. The site does not store this text.
• Jev games. While you type, the site sends your text to TypeSafe, so the Jev model can score it. The site does not store it.
• LFM waitlist. Your name and email address, the answers you give in the form, your time zone, your browser’s user agent and your IP address. Resend delivers them to my inbox as an email. There is no database. Cloudflare Turnstile checks that a person, not a bot, sends the form.
• Analytics. Vercel Web Analytics counts page views, and Vercel Speed Insights measures how fast pages load. Vercel states that both work without cookies. I see totals, not individual visitors.
• Rate limits. To stop abuse, the server counts requests for each IP address. The counts for each minute stay in server memory only. The daily counts for the Lab, the Ask chat, the games and the terminal are in Upstash Redis for up to 26 hours. These daily counts never hold your IP address. They hold a hash of it, made with a secret value.
• On your device. Your browser keeps your theme choice and some display settings in local storage. They stay on your device.

• Contact form, Ask chat, Lab demos, terminal and games: legitimate interests, to answer you and to run the feature you chose to use.
• Analytics and rate limits: legitimate interests, to keep the site fast and to protect it from abuse.
• LFM waitlist: your consent, which you give when you tick the box. You can withdraw it at any time by email.

• Vercel hosts the site and runs Web Analytics and Speed Insights.
• Resend delivers contact and waitlist emails.
• OpenAI answers the Ask chat and runs the models of the Lab demos, including the voice call.
• Upstash stores the daily rate-limit counts, the Lab pages and plans, and the search index of the Ask chat.
• GitHub gives the public profile data for the portfolio demo.
• TypeSafe runs the Jev model for the games and the terminal.
• Cloudflare runs the Turnstile check on the LFM waitlist.

I do not sell personal data. I share it only with these providers, to run the site, or when the law requires it.

• Contact and waitlist emails stay in my inbox until I no longer need them to reply to you, or until LFM launches. Ask me, and I delete them sooner.
• OpenAI and TypeSafe process the text under their API terms. The site asks OpenAI not to store the chat and Lab text. OpenAI can still keep API data for up to 30 days to detect abuse.
• Pages from the portfolio demo: 7 days.
• Plans from the reorder demo: 30 days.
• Daily rate-limit counts, with a hashed IP address: up to 26 hours.
• Rate-limit counts for each minute: in server memory only, until the server restarts.

Vercel, Resend, OpenAI, Upstash, GitHub, TypeSafe and Cloudflare can process data outside the UK, for example in the United States. They do so under their own data protection terms.

Under UK data protection law, you can ask for a copy of your data, ask me to correct or delete it, object to its use or ask me to limit it. Write to privacy@rendonarango.com. If you are not happy with my answer, you can complain to the Information Commissioner’s Office at ico.org.uk.

The site is not for children under 13. I do not knowingly collect their data.

When this policy changes, the date at the top changes. If a change is material, I say so on this page.

Questions or requests: privacy@rendonarango.com.