Skip to content
Alireza Rastineh – Home
Let’s talk

Last updated

Privacy policy

Controller

The controller for data processing on this website is Alireza Rastineh, email: contact@alirezarastineh.me.

Hosting and server logs

This website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Nuremberg.

For every request the web server automatically records: IP address, date and time, the address requested, the referrer, browser and operating system (user agent) and the response status. When you open a link that carries a question for the assistant (see “Sharing a question”), that question is part of the address requested and is recorded with it. This is used to keep the site secure and to fix faults, and is deleted after 14 days.

The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is operating the website securely and reliably.

Contact form

When you write to me through the contact form, I store your name, email address, message and the page language in order to reply. To prevent abuse I also store a salted hash of your IP address, from which the address cannot be recovered — not the address itself.

The message is delivered to me by the email service Resend (Resend, Inc., USA), which transfers your name, email address and message to the USA. The transfer is safeguarded by the European Commission's standard contractual clauses.

Stored messages, with that hash, are deleted 180 days after they were sent, within six hours of that. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract, otherwise Art. 6(1)(f) GDPR.

Portfolio assistant (AI)

In the About section, through the ask bar at the top of the home page, or with the buttons on case studies and articles, you can ask an AI assistant about my work. Its answers are generated by a language model from the content of this website and may contain mistakes. Please do not enter personal data there.

To answer, your question, the earlier questions and answers of the same conversation and the page language are sent to Google (Gemini API; Google Ireland Ltd. or Google LLC, USA). Under Google's terms for developers in the European Economic Area, Google does not use them to improve its products; it logs them for a limited time, solely to detect and prevent misuse and for disclosures the law requires. If Google cannot answer in time, they are sent instead to OpenRouter (OpenRouter, Inc., USA) and the provider of the free model it selects; the providers of these free models may store your input and use it to train or improve their models. This may involve a transfer outside the EU, in particular to the USA, safeguarded by the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

The page you read, what you point at, and your level

With each question the assistant sends the address of the page you are on, so that “this” can mean the case study or article you are reading. On case studies and articles, the “ask” and “Explain” buttons send which section or code block you mean, and the button that appears when you select text sends the text you selected, at most 600 characters. If you type “level plain” or “level expert”, your browser keeps that choice (see “Cookies and browser storage”) and sends it with each question; “level standard” removes it. Together with your question, these go to the providers named above (the page only if it is a case study or article). The text you selected is not stored, unless the answer quotes it; what I keep is listed below.

Read next and what's new

At the end of each case study and article, “Read next” suggests three related pages. To find them, your browser loads the list of this website's published pages from my server, with no AI model involved; requests for it are limited using a salted hash of the IP address, deleted within a day and a half. “How do they connect?” asks the assistant like any other question.

“What's new” works only if you turn it on; nothing is stored before you do. Once it is on, your browser keeps the date of your last visit (see “Cookies and browser storage”) and, on your next visit, compares it with the pages' dates itself: the date is never sent. Listing what is new calls no AI model; “summarize them” asks the assistant a question that names the new pages' titles.

Tours

Typing “tour” shows a short tour of the website, put together in your browser without any AI model; nothing is sent. Typing “tour” followed by an interest (at most 120 characters, for example “tour data platforms”) asks the assistant to plan a tour for it: your interest is sent, like a question, to the providers named above, together with the list of the website's pages, and is kept like a question (see “What I keep”), with the tour's introduction and stops as its answer. “tour more like this” plans once more from the stop you are on. Where you are in a tour stays in your browser with the conversation (see “Cookies and browser storage”).

Sharing a question

Beside each answer, “share” copies a link to the page you are on with your question in its address (“?ask=…”). Whoever opens the link finds the question in the assistant's prompt; nothing is sent until they press Enter. As the page opens, their browser removes the question from the address, and Umami never receives it (see “Analytics with Umami”). The web server records it with the address, as it does for every request, and deletes it after 14 days (see “Hosting and server logs”). Anyone who has the link can read the question, and so can the services you send it through.

Matching a text against my work

If I offer it, typing “match role”, “match project” or “match problem” (or “fit”, for a role) opens a box where you paste a job description, or describe a project or a problem, in at most 4,000 characters. Nothing is sent until you press “check it”. Please don't paste confidential details: the text goes to the model providers named above, under the terms of their free tiers, which may let them store it and use it to improve their models.

The assistant lists the points your text asks for, searches this website for each one, and checks each against what is published; a point that nothing published shows is marked “not published”, and one about pay, a budget or a rate gets no estimate. Your text is kept like a question (see “What I keep”): its first 2,000 characters, redacted, for 90 days, with the points, the pages each search found and how each was marked. At the end, the assistant offers the contact form, with a draft that names the kind and begins with the first words of your text; your text and the check are attached only if you tick the box (see “Handing a conversation to the contact form”). Requests are limited to 3 an hour per conversation and 6 a day per IP address, using salted hashes deleted within a day and a half.

Seeing how an answer was made

Under each answer the assistant can show how it was made: which kind of model answered, how many lookups it made, how many sources it checked, and whether anything was removed. Each source shows when its page last changed. Typing “inspect” shows what I keep about one of your answers (see “What I keep”): its steps, the models tried, its lookups with their search terms, its sources and its checks, never the text of a model's reasoning or of its instructions. Only the conversation in your tab can ask for this: the request carries its session id, which is checked against the salted hash I keep. Nothing more is stored to show either.

Deleting your conversation

Typing “forget”, then “yes”, deletes what I keep of your conversation in this tab (see “What I keep”), including what you asked in it before typing “reset”, together with your ratings, what your browser reported, my weekly review of those answers, and the example questions a topic quoted from it (see “Improving the content”). Two things stay: a message you sent me through the contact form keeps the conversation you attached to it, since you sent it to me; and a test case I already made from one of your questions stays, since nothing personal was left in it. Your browser then forgets the level you chose and the date kept for “What's new”, ends any tour, and a new conversation begins. I count how often “forget” is used each day, never by whom. Requests are limited using a salted hash of the IP address, deleted within a day and a half.

What I keep, and for how long

I keep the following for 90 days to improve the assistant, and delete each within six hours after that, or at once when you delete your conversation (see “Deleting your conversation”):

  • your question (for a tour, the interest you typed; for a match, the first 2,000 characters of the text you pasted), and the first 2,000 characters of the answer (for a tour, its introduction and stops; for a match, its points and how each was marked), with email addresses, phone numbers and long digit sequences removed first;

  • when it was asked, the page language, which model answered, how long it took, its cost, which documents it cited, whether you rated it and, with a thumbs-down, the reason you picked;

  • the case study or article you asked from, if any; whether you pointed at a section, a code block or a selected passage, and whether that page holds it, but never the text you selected; and the level you chose, if any;

  • the steps the assistant took: which tools it used and what it passed to them (its search terms, for example), redacted the same way and cut to 300 characters each, and how many passages the guard removed, by kind, never their text; for a tour, how many stops it has and which of its checks failed before it was shown; for a match, the kind of text, the points listed from it (redacted the same way, at most 160 characters each), the pages each search found, how each point was marked and which checks it failed;

  • what your browser reports about the answer: how long until its first words appeared and until it was complete, whether you stopped it, how many of its suggested follow-up questions and sources you clicked, how often you copied it, and how often you asked again after an error; for a tour, how many of its steps you took and whether you reached its last stop. These are counts and times only, never text; if you leave the page before they are sent, your browser sends them as the page closes;

  • whether you accepted its offer to hand you to the contact form;

  • a salted hash of the assistant's random session id, which groups one conversation but does not identify you.

I do not store IP addresses; requests are limited using a salted hash of the IP address that is deleted within a day and a half. The conversation itself stays in your browser's session storage and is deleted when you close the tab; this is required for the function you are using (§ 25(2) no. 2 TDDDG).

How answers are checked

  • Every answer passes automatic checks of its language and its citations. A guard removes passages copied from the assistant's own instructions, and its keys, before you see the answer. A question that looks like an attempt to override the assistant is marked as such.

  • Each week I read a small random sample of answers, plus those the checks or a thumbs-down flagged.

  • Each night, a model may also score a random 5 % of the previous day's answers, plus the flagged ones: how faithful each is to the documents it cites, and how helpful it is. Only a model that already answers visitors does this, and the score is kept with the answer, as long as the answer.

The assistant's scorecard

If I publish it, typing “evals” shows how the assistant does: the results of its latest test run, and for the last 30 days shares and counts computed from all answers, for example how many cited only real sources, or how long until the first words appeared. Each figure needs at least 20 answers and says nothing about any one visitor. Requests for it are limited using a salted hash of the IP address, deleted within a day and a half.

Search by meaning

To find passages related to your question, the assistant may also send its search terms, which come from your question, to Google's embedding model (Gemini API, as above). They are not stored beyond the steps described above.

Improving the content

  • I may group the questions of the last 30 days into topics, to see what the portfolio does not answer yet; this may also run automatically when answers start failing more often. A model from the providers named above reads the questions, redacted as above, to do this, together with the points of matched texts that nothing published covers. The topics, with a few example questions, are kept for at most 60 days; “forget” removes the example questions and points taken from your conversation.

  • An FAQ entry may be drafted from such a topic, or from a single answer's question. A model from the same providers reads those questions as data, never as instructions. The draft waits for my decision and is deleted at the latest with the questions it came from: after at most 60 days for a topic, 90 for an answer. Once I accept or reject it, no draft text is kept.

  • My notes on why an answer failed, and the lessons I draw from them, hold none of your question's text, only a few of its keywords. I keep them until I delete them.

Test cases

I may keep a question as a test case, to check that later versions of the assistant still answer it well, together with up to three questions you asked before it in the same conversation. Before keeping them, I remove anything personal from each and confirm that nothing personal is left. They are then kept until I delete them, beyond the 90 days. The assistant's answers are not kept with them: each test answers the questions anew.

Handing a conversation to the contact form

  • If you accept the assistant's offer to write to me, the contact form opens with a draft message. After a match, the draft names its kind and begins with the first words of your text.

  • Your conversation is attached only if you tick “Attach my conversation with the assistant”. It is then stored with your message: the same redacted questions and answer excerpts as above, at most the last 10. It is deleted with the message, as described under “Contact form”.

  • Without the tick, nothing is attached; the answer that made the offer still records that you accepted it.

For AI agents and tools

This website offers a read-only interface for AI agents and tools: /llms.txt, an agent card at /.well-known/agent-card.json, and an MCP endpoint at https://api.alirezarastineh.me/v1/mcp. It serves only the published content and calls no AI model. For a request to the endpoint I store nothing of its content, only a daily count of its kind. Requests are limited using a salted hash of the IP address, deleted within a day and a half.

Legal basis

The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is answering questions about my work directly, checking that those answers are accurate, and offering the published content in a form that AI tools can read. If you hand a conversation to the contact form, the section on the contact form applies.

Analytics with Umami

To understand which pages are read, I use Umami. It runs on my own server; no data is shared with third parties. Umami sets no cookies and stores no IP addresses. It records the page visited, referrer, browser, operating system, device type and country, and which features are used (for example opening the assistant, and from which button or a shared link, asking a question, an answer arriving, stopping, copying, rating, inspecting or sharing an answer, clicking one of its sources or suggested questions, accepting its offer of the contact form, reading the scorecard, reading on from a case study or article, turning “What's new” on or off, taking a tour, its steps and whether it was finished, or opening the box to match a text and sending it, by kind), without any text you enter. A question carried in a shared link is removed from the addresses Umami records.

The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is improving the website based on how it is used.

Error monitoring with Sentry

If a technical error occurs, an error report is sent to Sentry (Functional Software, Inc., USA) and stored in the EU (Frankfurt). It contains the error message, the page concerned, and the browser and operating system; IP addresses are not stored. As Sentry is a US company, access from the USA cannot be ruled out; it is safeguarded by the European Commission's standard contractual clauses.

The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is a website that works.

Cookies and browser storage

When you switch language, this website sets one cookie, “portfolio-lang”. It stores only the language you chose, so your next visit opens in that language, and expires after one year. If you switch between light and dark mode, your choice is kept in your browser's local storage (“theme”) until you clear it. If you choose how technical the assistant's answers are (“level plain” or “level expert”), that choice is kept there too (“ask:level”), until you type “level standard” or “forget”, or clear it. If you turn on “What's new”, the date of your last visit is kept there as well (“ask:news”), until you turn it off, type “forget”, or clear it. The assistant keeps your conversation in your browser's session storage until you close the tab (see above), with where you are in a tour, a text you pasted to match (so that it can be sent again after an error), and the session ids of what you asked in that tab before typing “reset”, so that “forget” can delete that too. Each of these is required for a function you asked for (§ 25(2) no. 2 TDDDG). Other cookies are set only by the admin area, and only for the site owner.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Write to contact@alirezarastineh.me to exercise them. What I keep of a conversation with the assistant you can also delete yourself, with “forget” (see “Deleting your conversation”).

You may also lodge a complaint with a data protection supervisory authority, for example the one where you live.