Privacy Policy
Last updated: 28 September 2026
This policy explains what personal data is processed when you visit gmanov.com (the "Site"), why, and what rights you have. It is written to meet the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the ePrivacy Directive and the Bulgarian Personal Data Protection Act.
1. Who is responsible for your data
The data controller is Georgi Manov, a private individual based in Sofia, Bulgaria. For any privacy question or request, email georgi.manov@gmail.com.
This is a personal website and blog. I do not sell personal data, run advertising, or build marketing profiles.
2. What data is processed and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Delivering the Site and keeping it secure | IP address, browser and device information, requested URL, time of request (server logs) | Legitimate interest in operating a secure website (Art. 6(1)(f) GDPR) | Kept by the hosting provider for a short period, typically up to 30 days |
| Website analytics (Google Analytics 4), only if you accept | Pages visited, referrer, approximate location (country/city), device and browser type, a random client identifier stored in a cookie | Your consent (Art. 6(1)(a) GDPR; Art. 5(3) ePrivacy Directive) | Event data: 14 months in Google Analytics. The _ga cookies expire after up to 2 years. |
| Answering messages you send through the contact form or by email | Your name, email address and the content of your message | Legitimate interest in replying to you, or steps before entering into a contract at your request (Art. 6(1)(b) and (f) GDPR) | As long as needed to handle the conversation. Messages are deleted manually, no later than 2 years after the last contact, or earlier on request |
| Site administration (owner login only) | Name, email and profile image of the administrator via Google Sign-In, session cookie | Legitimate interest in protecting the admin area (Art. 6(1)(f) GDPR) | For the duration of the session or account |
Contact form submissions are stored in the Site's database and are only visible to me. To block spam and automated abuse, the form uses a hidden field, limits how many messages can be sent from the same email address, and uses Vercel BotID. BotID runs an invisible check in your browser when you send the form, analysing technical signals such as your IP address, browser and device characteristics to tell people from bots. It does not track you across websites and is not used for analytics or advertising. The legal basis is my legitimate interest in protecting the Site and my inbox (Art. 6(1)(f) GDPR). Because this check is strictly necessary for the security of the form you are using, it does not require cookie consent.
Visitors cannot create accounts on the Site. Google Sign-In is used only by the Site owner to manage content. No automated decision-making or profiling with legal or similarly significant effects takes place.
3. Cookies and similar technologies
Strictly necessary storage is used without consent because the Site cannot work without it:
gm-cookie-consent(browser local storage): remembers your cookie choice for 12 months.authjs.*cookies: only set when the Site owner signs in to the admin area.- Vercel BotID: security check on the contact form (see section 2). It may use short-lived browser storage for this purpose only.
Analytics cookies are set only after you click "Accept" in the cookie banner. Until then, the Google Analytics script is not loaded at all and no data is sent to Google.
_gaand_ga_*(Google Analytics): distinguish visitors and sessions. They expire after up to 2 years.
Google Analytics is configured with Google Signals and ad personalisation disabled. Google Analytics 4 does not log or store IP addresses. You can change or withdraw your consent at any time with the "Cookie settings" link in the footer. Withdrawing consent stops analytics and deletes the Google Analytics cookies from your browser. It does not affect processing that took place before you withdrew.
Fonts are self-hosted, so loading a page does not contact Google Fonts or other font services.
4. Who receives your data
I use the following service providers (processors), bound by data processing agreements:
- Vercel Inc. (USA): website hosting, server logs, image storage and bot protection for the contact form (Vercel BotID).
- Neon (Databricks, Inc.) (USA): database hosting for Site content and messages sent through the contact form.
- Google Ireland Ltd. / Google LLC: Google Analytics (only with your consent) and Google Sign-In for the administrator.
Personal data is not shared with anyone else unless the law requires it, for example at the request of a court or public authority.
5. Transfers outside the EU/EEA
Some of the providers above are based in, or may process data in, the United States. These transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary measures. You can ask me for more information about these safeguards.
6. Your rights
Under the GDPR you have the right to:
- access the personal data I hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data deleted (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw your consent at any time, with effect for the future (Art. 7(3)).
To use any of these rights, email georgi.manov@gmail.com. I will reply within one month. I may ask you to confirm your identity first.
You also have the right to complain to a data protection supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg. You can also complain to the authority in the EU country where you live or work.
7. Security
All traffic to the Site is encrypted with HTTPS. Access to the admin area and the database is restricted to the Site owner.
8. Children
The Site is not aimed at children, and I do not knowingly collect personal data from anyone under 16.
9. Other websites
The Site links to external websites such as LinkedIn and GitHub. Once you follow such a link, the privacy policy of that website applies.
10. Changes to this policy
I may update this policy when the Site or the law changes. The date at the top shows the latest version. If the changes affect your consent, the cookie banner will ask you again. See also the Terms of Use.