Privacy policy

This site is a portfolio: no accounts, no cart, no advertising, no commercial trackers. The only personal data it processes is what you type into the contact form yourself, plus the technical minimum needed to protect that form from abuse. This document states everything that happens next. The French version is binding.

Data controller: Michaël Kodji, Abidjan, Côte d'Ivoire — contact@michaelkodji.com.

Processing falls under Ivorian law no. 2013-450 of 19 June 2013 on the protection of personal data. Because the site is reachable from the European Union and partly addressed to visitors residing there, Regulation (EU) 2016/679 (GDPR) also applies to those visitors' data, and the rights it grants are recognised for them.

What you type. The contact form asks for a name, an email address, a message, and optionally a subject. The page language is sent along, solely so the reply reaches you in that language. No other field exists — and the form's hidden field, invisible on screen, only catches bots: if it is filled in, the submission is discarded.

What the server sees. Like any web server, this one receives your IP address, your browser and the page requested. The IP address is used exclusively to count submissions from the same sender, in order to block automated floods: it is never tied to the content of a message, never written to the database, and the counter is destroyed at most fifteen minutes after the last submission.

Audience measurement. The site uses Vercel Web Analytics and Vercel Speed Insights, which measure traffic and page speed without cookies and without a persistent identifier. Measurements are aggregated; they can neither recognise you from one visit to the next nor identify you.

What is not collected. No profiling, no automated decision-making, no advertising, no embedded social networks, no data brokers. No data is sold, rented or traded — under any circumstances.

• To answer your message and prepare a possible engagement. Processing is necessary for pre-contractual steps taken at your request; under Ivorian law it rests on your consent, given by submitting the form.
• To keep a record of the request for the duration of the business relationship — quotes, follow-up, accounting and evidentiary obligations. Legitimate interest, and legal obligation for accounting records.
• To protect the site against spam and mass submissions. Legitimate interest in the security of the service.
• To measure audience anonymously, in order to improve the pages. Legitimate interest, with no individual tracking.

You are never obliged to write: the email address and phone number in the footer allow the same contact outside any form.

Your message travels to a small number of technical providers, each acting on instruction and for the stated purpose only:

• Vercel Inc. (United States) — site and serverless function hosting, audience measurement.
• Supabase — durable storage of the message, so that no request is lost.
• LWS or Resend — delivery of the notification email and of your acknowledgement of receipt.
• Google (Google Sheets) and Notion Labs — request tracking, when those synchronisations are enabled.
• Upstash — anti-abuse counter, which receives only an IP address, a submission count and an expiry time, and no message content.

None of these providers is permitted to use your data for its own purposes. Some are established outside Côte d'Ivoire and outside the European Union, notably in the United States: those transfers rely on the European Commission's standard contractual clauses and on each provider's contractual commitments. Finally, your data may be disclosed to a judicial or administrative authority where the law so requires — and in that case only.

• Messages with no follow-up: three years from the last exchange, then deletion.
• Messages that led to an engagement: for the duration of the contractual relationship, then the applicable limitation period; accounting records are kept for the statutory periods.
• Anti-abuse counter: fifteen minutes.
• Audience measurement: kept in aggregate form by Vercel, with no identifying data.

Once those periods elapse, records are deleted or irreversibly anonymised.

This site sets no advertising, analytics or social-network cookies. It therefore shows no consent banner, because there is nothing to consent to. Only two items are kept in your browser, and both are strictly necessary to the functionality you asked for:

• a language cookie (NEXT_LOCALE), set by multilingual routing to remember the language you chose;
• your theme preference (light or dark), stored in your browser's local storage.

You can clear them at any time from your browser settings: the site keeps working, it simply returns to its defaults.

You have the right of access, rectification, erasure, objection, restriction and portability, the right to withdraw your consent at any time, and the right to set directions concerning your data after your death.

To exercise them, write to contact@michaelkodji.com stating the purpose of your request. A reply follows within thirty days at most. No identity document is required by default: a request sent from the email address used for the original contact is enough to authenticate it. Proof of identity is asked for only in case of serious doubt about the requester, and is destroyed as soon as the reply is sent.

If the reply does not satisfy you, you may lodge a complaint with the Telecommunications/ICT Regulatory Authority of Côte d'Ivoire (ARTCI), the data protection authority. Visitors residing in the European Union may in addition lodge a complaint with their national supervisory authority — the CNIL in France.

The measures in place are those of a site that takes the matter seriously: end-to-end encryption of traffic (HTTPS), strict and bounded validation of every field received, rate limiting per sender, a bot filter, request origin checking, security headers, and access secrets held server-side only — never exposed to the browser. Access to received messages is personal and protected.

No system is infallible. In the event of a data breach likely to create a risk to your rights, the individuals concerned and the competent authority are notified within the periods laid down by law.

This site addresses professionals and is not intended for people under sixteen. No data is knowingly collected from a minor; were such a submission identified, it would be deleted without delay.

This policy may change along with the site and its providers. The date of last update appears at the top of the page; any substantial change will be flagged on this same page.