Privacy Policy

Version 5 · last updated 2026-10-18

This policy explains what personal data gravam.com collects, why, who helps process it, and the rights you have. gravam.com is a personal site run by Tan Gravam. It carries no advertising and does not sell your data.

What I collect

  • Contact form — when you message me, I receive the name, email address and message you submit, and the name of the page on this site you came from. A short automatic acknowledgement is sent to the address you gave; before sending it, the site checks that the address's domain accepts mail (a DNS lookup of the domain only).
  • Newsletter — if you subscribe, I store your email address so I can send the newsletter, together with the record that proves you asked for it: which page you signed up from, when you confirmed, the version of this policy in force at the time, and whether you have since unsubscribed. That trail exists because consent has to be demonstrable, not because I want the detail.
  • Analytics — only if you accept analytics cookies. Google Analytics records events against a pseudonymous identifier stored in your browser: pages visited, approximate location, device and browser type. This site also sends a small set of its own events — that a tool was opened, first used, completed, exported or shared, that a newsletter signup was started and from which embed, that an enquiry was sent about a particular offer and which page sent it, that a table or checklist was copied, and which article, guide or product link was followed next. None of them carry anything you typed: no email address, no form contents, no tool inputs. One exception to be aware of: a tool's share link carries its inputs inside the address itself, so if you open one with analytics accepted, that address can reach Google Analytics as the page visited. See the Cookie Policy.
  • Searches that find nothing — when a search on this site (the writing, the code lookup or the topic index) returns no result, the words you searched for are saved, with which of the three it was and the time. Nothing else: no IP address, no browser details, no cookie, no identifier, so a saved search cannot be tied to you or to another search. Terms that look like an email address, an account number or a phone number are not saved. I read the list to see what is missing from the site.
  • Workflow X-Ray — the text you paste into Workflow X-Ray is sent to Anthropic, the AI provider that runs the analysis, and the result is sent back to your browser. I do not store the text or the result, do not write either to a log, and do not send either to analytics. Anthropic does not use it to train its models and keeps it for a limited period under its own retention policy. Please do not paste confidential, personal, customer, employee or proprietary information into it.
  • Server logs and abuse prevention — like any website, the hosting layer records technical data such as IP address, browser type and request time. The application itself also reads your IP address in order to rate-limit the contact and newsletter forms, which is what stops them being used to send mail in your name, and to cap how many Workflow X-Ray analyses one visitor can run in a day (a count held in memory, cleared daily). It is used for that check and nothing else — it is never stored in the database and never attached to a message or a subscription.

There are no user accounts on this site, and I do not ask for a phone number, address or any special-category data.

Why I use it, and the legal basis

  • To reply to your message (legitimate interest / your request).
  • To send the newsletter you asked for (consent).
  • To understand traffic and improve the site (consent, via analytics).
  • To keep the site secure and operational — including rate-limiting the forms by IP address (legitimate interest).
  • To analyse a workflow you submit to Workflow X-Ray (your request).

Service providers

A few trusted providers process data on my behalf so the site can run:

  • DigitalOcean — application hosting.
  • Cloudflare — content delivery and DDoS protection.
  • Supabase (PostgreSQL) — stores contact and newsletter records.
  • Resend — delivers transactional email.
  • Anthropic — runs the Workflow X-Ray analysis on the text you submit to it.
  • Google Analytics — traffic analytics, loaded only after you consent.

Several of these providers are based in the United States, so data may be transferred there under the safeguards they offer, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long I keep it

Contact messages are kept while the conversation is live and are deleted on request; I have no automated deletion job, so if you want a message removed, ask and I will remove it. Newsletter emails are kept while you're subscribed — every newsletter includes an unsubscribe link. After you unsubscribe, your address is retained on a suppression list (marked unsubscribed) so it isn't accidentally emailed again; you can ask me to erase it entirely at any time. Server logs are short-lived and rotated by the hosting provider.

Your rights (GDPR)

You have the right to:

  • access the personal data I hold about you;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict or object to processing;
  • withdraw consent (e.g. for analytics or the newsletter) at any time;
  • receive your data in a portable format.

To exercise any of these, use the contact page. You also have the right to complain to your local data protection authority.

Children

This site is not directed at children and does not knowingly collect data from anyone under 16. If you believe a child has provided personal data, contact me and I will remove it.

Changes to this policy

This policy may be updated from time to time. The current version always lives on this page.

Contact

For any privacy question, reach out via the contact page.