Sultan Kautsar
Hire me

Privacy Policy

This site is a personal portfolio. It collects as little as it can: no account, no newsletter, no third-party embeds, and nothing stored on your device for analytics unless you allow it.

Who Is Responsible

The controller for this site under the General Data Protection Regulation (GDPR) is Sultan Kautsar. For any question about your data, email hello@sultankautsar.com.

Hosting

The site is served by Cloudflare Pages (Cloudflare, Inc.). To deliver pages and protect the site from abuse, Cloudflare processes technical data from every request, such as your IP address, browser, the page requested, and the time of the request. To make pages open faster, your browser may load a page from this site in advance when you hover over or press a link to it; that request reaches Cloudflare like any other, but Google Analytics only runs once you actually open the page.

This is necessary to run the site, so the legal basis is my legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). The fonts, images, and video on this site are hosted on the same domain; no request goes to a font or media service.

When you first visit, a banner asks what you allow. Your answer is saved in your browser’s local storage under the key consent, together with the time you chose. It never leaves your device, and it expires after 12 months, when the banner asks again. If you switch between light and dark mode with the theme button, that preference is saved the same way under the key theme. The prices on the site are shown in US dollars, or in Indonesian rupiah if your browser reports an Indonesian time zone or language. If you switch the currency to US dollars, euros, or rupiah, that choice is saved under the key currency. Both stay on your device.

If the saved choice has an invalid timestamp or a time in the future, it is ignored and the banner asks again.

“Reject all” and “Accept all” appear side by side with the same outlined styling.

Storing this choice is necessary to respect it, so it does not need consent itself. You can change or withdraw your choice at any time with Cookie settings in the footer of every page. Denying analytics deletes the Google Analytics cookies accessible to this site, including when your previous choice has expired or is no longer saved. Denying advertising likewise removes the accessible advertising measurement cookies.

Google Analytics

I use Google Analytics 4 (Google Ireland Limited), loaded through Google Tag Manager, to see which pages are read, how visitors find the site, and which of a few key actions they take: clicking the main buttons, asking about a package or service on the Web Development, Marketing Technology, or AI Integration pages, opening an email link, sending the contact form (only that it was sent, never what you wrote), running the Tracking Check (only how many issues and warnings it found, never the address you checked), asking for a Tracking Check report by email (only that you asked, never your email address), and reading a case study to the end. A separate consent_update event records your analytics and advertising choices when you save them. Consent defaults are set before Google Tag Manager loads. The setup uses Google Consent Mode V2 in advanced mode:

  • Before you choose, or if you decline: Google Tag Manager still loads, and Google Analytics sends cookieless pings. These contain no cookies or identifiers, only that a page was viewed and basic technical details such as browser type. Google uses them to estimate visits in aggregate. The legal basis is my legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR).
  • If you allow analytics: Google Analytics sets the cookies _ga and _ga_*, which store a random ID for up to 2 years so repeat visits can be recognized. The legal basis is your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG).

Google Analytics 4 does not log or store IP addresses. Analytics data is kept for 14 months and then deleted automatically. If you want to know how the consent signals work in detail, I wrote about it in Consent Mode V2.

Advertising

This site does not currently run advertising tags. The Advertising option in the banner controls the Consent Mode signals ad_storage, ad_user_data, and ad_personalization, and it stays off unless you turn it on. If I add advertising measurement in the future, this page will be updated first.

Contacting Me

When you send the contact form, your name, email address, subject, and message go to a small function on Cloudflare, which delivers them to my inbox as an email through Cloudflare’s own email service. Nothing from the form is stored on the way, and nothing from the form is sent to Google Analytics. To stop the form being flooded, the function also uses a one-way hash of your IP address and the current hour to identify a counter on Cloudflare, scheduled for deletion when that UTC hour ends, which only counts how many messages your connection has sent; the address itself is never stored. I use what you write only to reply to you, and delete it when the conversation no longer needs it. The legal basis is answering your request (Art. 6(1)(b) and (f) GDPR).

The Tracking Check

When you run the Tracking Check, the address you enter goes to a small function on Cloudflare, which downloads that one page, reads its HTML, and sends the result back to your browser. Neither the address nor the result is stored. The request to the checked site comes from Cloudflare, not from your device, and identifies itself as “sultankautsar.com tracking check”. To stop the check being misused, the function uses a one-way hash of your IP address and the current hour to identify a counter on Cloudflare, scheduled for deletion when that UTC hour ends, which only counts how many checks your connection has run; the IP address itself is never stored. The legal basis is providing the check you asked for (Art. 6(1)(b) and (f) GDPR).

If you ask for the report by email, your email address and the address you checked go to a small function on Cloudflare, which checks that page again and delivers the result to my inbox as an email through Cloudflare’s own email service, with your address as the reply address. I then send you the report with my notes from my own inbox. Nothing is stored on the way, and your email address is never sent to Google Analytics. The same kind of hourly counter as the contact form, counted separately, limits how many reports one connection can ask for. I use your email address only to send the report and answer any reply, and delete it when the conversation no longer needs it. The legal basis is answering your request (Art. 6(1)(b) and (f) GDPR).

Transfers Outside the EU

Cloudflare and Google may process data in the United States. Both companies are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognizes as providing an adequate level of protection (Art. 45 GDPR).

Your Rights

Under the GDPR you have the right to:

  • access the data held about you (Art. 15),
  • have it corrected (Art. 16) or deleted (Art. 17),
  • restrict its processing (Art. 18),
  • receive it in a portable format (Art. 20),
  • object to processing based on legitimate interest (Art. 21),
  • withdraw consent at any time, without affecting processing before the withdrawal (Art. 7(3)).

To use any of these rights, email hello@sultankautsar.com. You also have the right to complain to a data protection supervisory authority, in particular the one where you live or work (Art. 77 GDPR).

Next step

Have a project in mind? Let's talk.

See how I work and what it costs, or email me. I usually reply within one working day.

Write to Me

Tell me about your project or idea. I usually reply within one working day.