Privacy Policy

Version 2 · last updated 2026-09-03

This policy explains what personal data gravam.com collects, why, who helps process it, and the rights you have. gravam.com is a personal site run by Tan Gravam. It carries no advertising and does not sell your data.

What I collect

  • Contact form — when you message me, I receive the name, email address and message you submit.
  • Newsletter — if you subscribe, I store your email address so I can send the newsletter, together with the record that proves you asked for it: which page you signed up from, when you confirmed, the version of this policy in force at the time, and whether you have since unsubscribed. That trail exists because consent has to be demonstrable, not because I want the detail.
  • Analytics — only if you accept analytics cookies. Google Analytics records events against a pseudonymous identifier stored in your browser: pages visited, approximate location, device and browser type. This site also sends a small set of its own events — that a tool was opened, first used, completed, exported or shared, that a newsletter signup was started and from which embed, that an enquiry was sent about a particular offer and which page sent it, that a table or checklist was copied, and which article, guide or product link was followed next. None of them carry anything you typed: no email address, no form contents, no tool inputs. See the Cookie Policy.
  • Server logs and abuse prevention — like any website, the hosting layer records technical data such as IP address, browser type and request time. The application itself also reads your IP address in order to rate-limit the contact and newsletter forms, which is what stops them being used to send mail in your name. It is used for that check and nothing else — it is never stored in the database and never attached to a message or a subscription.

There are no user accounts on this site, and I do not ask for a phone number, address or any special-category data.

Why I use it, and the legal basis

  • To reply to your message (legitimate interest / your request).
  • To send the newsletter you asked for (consent).
  • To understand traffic and improve the site (consent, via analytics).
  • To keep the site secure and operational — including rate-limiting the forms by IP address (legitimate interest).

Service providers

A few trusted providers process data on my behalf so the site can run:

  • DigitalOcean — application hosting.
  • Cloudflare — content delivery and DDoS protection.
  • Supabase (PostgreSQL) — stores contact and newsletter records.
  • Resend — delivers transactional email.
  • Google Analytics — traffic analytics, loaded only after you consent.

How long I keep it

Contact messages are kept while the conversation is live and are deleted on request; I have no automated deletion job, so if you want a message removed, ask and I will remove it. Newsletter emails are kept while you're subscribed — every newsletter includes an unsubscribe link. After you unsubscribe, your address is retained on a suppression list (marked unsubscribed) so it isn't accidentally emailed again; you can ask me to erase it entirely at any time. Server logs are short-lived and rotated by the hosting provider.

Your rights (GDPR)

You have the right to:

  • access the personal data I hold about you;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict or object to processing;
  • withdraw consent (e.g. for analytics or the newsletter) at any time;
  • receive your data in a portable format.

To exercise any of these, use the contact page. You also have the right to complain to your local data protection authority.

Children

This site is not directed at children and does not knowingly collect data from anyone under 16. If you believe a child has provided personal data, contact me and I will remove it.

Changes to this policy

This policy may be updated from time to time. The current version always lives on this page.

Contact

For any privacy question, reach out via the contact page.