Privacy notice.

Who operates this site

Michael Sanford operates this personal website and is responsible for the personal information described here. Sanford Labs product websites have their own privacy notices. To ask a question or make a privacy request, use the contact form.

Information collected

• Contact information you provide. Your name, reply email and message, including any other information you choose to include. These fields are needed to submit the form and receive a reply. Please do not send passwords, financial account details or other sensitive information.
• Website usage. Pages visited, referring website, browser and device information, visit timing and approximate location derived from network information. Analytics are configured without advertising cookies, session recordings or automatic capture of form interactions.
• Technical and security information. Hosting and security systems may process your IP address, user agent, request time and requested URL to deliver pages, diagnose problems and prevent abuse. Spam prevention may process browser and device signals and the result of a challenge.

How information is used

I use this information to respond to messages and privacy requests, understand how the site is used, maintain its reliability and security, prevent spam and meet applicable legal obligations. Messages are not added to a marketing mailing list or sent to an AI model for processing by this site.

Where a legal basis is required, these activities rely on legitimate interests in communicating with visitors, operating and improving the site, and preventing abuse; legal obligations where applicable; or consent where required. Sending a message does not give consent to unrelated marketing.

I do not sell personal information, share it for cross-context behavioral advertising, or use it to make solely automated decisions with legal or similarly significant effects.

Service providers

The following providers support the site. They receive information needed for their services; enabling a service determines whether its processing takes place.

• OVHcloud: website hosting and infrastructure.
• PostHog US Cloud: cookieless usage analytics. See PostHog’s privacy policy.
• Cloudflare Turnstile: automated-submission checks when enabled on the contact form. See the Turnstile privacy notice.
• Postmark: delivery of contact messages when delivery is enabled. See Postmark’s privacy policy.
• Google Workspace: the mailbox used to receive and respond to messages. See Google’s privacy policy.

Information may also be disclosed when required by law, to protect people or the security of the site, or at your direction. This notice does not describe a sale of data to these providers.

Analytics and browser choices

PostHog is configured in cookieless mode without persistent analytics identifiers in cookies or browser storage. Cookieless does not mean no data is processed: network and browser information can be used to distinguish visits for analytics. The site does not identify visitors using contact-form details, record sessions or capture typed messages.

The analytics loader respects Global Privacy Control and Do Not Track signals by not loading analytics when either is enabled. You can also use browser controls or a content blocker. Spam-prevention services may process technical information separately to protect the contact form.

Retention

Contact messages are retained as needed to respond, maintain relevant correspondence and address follow-up requests, disputes or legal obligations. There is no automatic deletion schedule for correspondence at present. You can request deletion through the contact form.

The site does not maintain a database of form submissions or log message contents. Temporary rate-limit records expire after ten minutes or when the contact service restarts. Analytics, infrastructure logs and provider backups follow their configured retention settings; a single fixed retention period does not apply across those services. Backup copies may remain until they expire under the provider’s schedule.

Your privacy rights

Depending on your location and applicable law, you may have rights to access, correct or delete personal information, obtain a portable copy, restrict processing, object to processing based on legitimate interests, or withdraw consent where processing relies on consent. Withdrawing consent does not affect processing that was lawful before withdrawal.

You may object to processing based on legitimate interests. To exercise a right or raise a concern, use the contact form and describe your request. I may ask for limited information to verify your identity and will respond within the period required by applicable law. Requests are subject to applicable exceptions, including legal obligations and the rights of others.

You may also complain to your local privacy regulator. UK visitors can contact the Information Commissioner’s Office; EEA visitors can contact their national data protection authority. Where applicable, you may challenge a decision about your request through the contact form. You will not be treated unfairly for exercising a privacy right.

Security and international processing

The site uses HTTPS and measures such as request validation, spam checks and restricted service access to protect information. No system can guarantee absolute security.

The site and its providers may process information in the United States and other countries, whose privacy laws may differ from those where you live. Where applicable law requires safeguards for international transfers, those safeguards must apply to the relevant provider relationship. Contact me for information about the processing arrangements relevant to your request.

Children and external links

This site is not directed to children under 13, and I do not knowingly collect their personal information. If you believe a child has provided information, use the contact form so I can address it.

Links to social profiles, Sanford Labs products and other websites lead to services with their own privacy practices. Review their notices before providing information.

Changes and contact

This notice may change as the site changes. The date above identifies the latest revision. Material changes will be identified here and, where required, communicated separately.

For questions about this notice or your information, send me a message.