Privacy Policy

This policy explains how Tiago Lopes (“I”, “me”) processes personal data when you visit https://tiagolopes.com. It is written for this site as it actually works today, not as a generic template.

Who is responsible

The controller is Tiago Lopes, a natural person in Portugal. For privacy questions, email legal@tiagolopes.com. You can also reach me on LinkedIn.

The Portuguese supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD). See cnpd.pt.

What this site does not do

This website does not:

• run analytics, advertising, or social-media pixels
• set cookies or use localStorage / sessionStorage
• embed third-party frames, maps, videos, or comment widgets
• offer accounts, a contact form, or a newsletter signup
• sell, rent, or share visitor data for marketing

Because there are no non-essential cookies or trackers, there is no cookie consent banner. See the Cookie Policy for the same conclusion in cookie-specific terms.

What is processed when you visit

Hosting and content delivery

The site is a set of static files hosted on Amazon Web Services (AWS) Simple Storage Service (S3) and delivered through AWS CloudFront, a content delivery network. AWS acts as a processor for hosting and delivery.

Requesting a page necessarily sends technical data to those systems so the files can be served. That typically includes Internet Protocol (IP) address, date and time, requested URL, referrer (if the browser sends one), user-agent, and similar HTTP headers. AWS may keep access logs for security, abuse prevention, debugging, and operating the CDN. I do not run a separate analytics product on top of those logs, and this repository does not include a logging dashboard or visitor profiler.

I cannot see an individual browsing session in real time. If AWS logging is enabled on the account that hosts the site, I would only consult those logs if needed to keep the site available and secure.

Fonts, scripts, and images

Fonts (Syne, Manrope, and JetBrains Mono) are downloaded at build time and served from this site. Your browser does not contact Google Fonts or other font CDNs. JavaScript for the page, including the optional Three.js background, is also first-party. There are no content images on the pages themselves beyond icons and a social sharing image, which are likewise served from this site.

Device motion used only in your browser

On some devices the background animation may use pointer movement or, after a gesture and (where the operating system requires it) permission, device orientation or motion. Those readings stay in the browser to move the graphic. They are not sent to me or to a third party.

Email and LinkedIn

If you email legal@tiagolopes.com, I process the address and message you send in order to reply. If you contact me on LinkedIn, LinkedIn is the controller of that platform; I only see what LinkedIn shows me.

Cookies and similar storage

This site does not set cookies and does not write to localStorage or sessionStorage. It does not use a consent-management platform. Your browser will still keep its own HTTP cache of files, which is a browser function, not a cookie I set.

CloudFront can be configured to set cookies in other setups (for example signed cookies). This site is a public static website and does not use signed CloudFront cookies. A response from the live homepage did not include a Set-Cookie header when this policy was written.

Legal bases

• Hosting and security logs: legitimate interests (Article 6(1)(f) GDPR) in delivering the website, keeping it secure, and investigating abuse. Those logs are a by-product of making a public site available, not a marketing tool.
• Email you send me: legitimate interests in answering, or pre-contractual steps if you write about work, and sometimes your consent if you volunteer extra information.

No processing on this site depends on cookie consent, because no non-essential cookies or trackers are used.

How long data is kept

Static site files are kept while the site is published. CDN or bucket access logs, if enabled, are kept only as long as needed for security and operations. Emails are kept as long as the conversation and any follow-up reasonably require.

International transfers

AWS is a US-headquartered provider. CloudFront serves files from edge locations, so a request may be handled outside Portugal. Where personal data in logs is transferred outside the European Economic Area, AWS relies on mechanisms such as the EU–US Data Privacy Framework and/or Standard Contractual Clauses. I do not otherwise send visitor data to other countries.

Your rights

Under the GDPR you may request access, rectification, erasure, restriction, objection to processing based on legitimate interests, and data portability where applicable. You may also lodge a complaint with the CNPD or another EU supervisory authority where you live or work.

Because this site does not run identifiable analytics, I may not be able to match a casual visit to you unless you tell me something that identifies the request (for example an approximate time and IP if you have it) or you email me directly.

Children

This site is a professional portfolio. It is not directed at children.

Changes

If the site starts using analytics, forms, or non-essential cookies, I will update this policy and, where the law requires it, add an opt-in consent banner before those tools run. The date at the top of this page is the effective and last-updated date.