Privacy policy
Last updated:
This policy explains which personal data Alberto Antequera processes through albertoar.com, through the private services hosted on its subdomains, and through the applications registered in his Google Cloud project.
1. Data controller
- Controller: Alberto Antequera (private individual; this site carries no commercial activity).
- Location: Málaga, Spain.
- Contact: privacidad@albertoar.com
2. Scope
This policy covers:
- The public website albertoar.com (blog, journey, projects, contact form, AI chat and MCP server).
- The self-hosted private services on albertoar.com subdomains, for personal use and invitation-only access.
- The applications that request access to a Google account via OAuth and are registered in the controller's Google Cloud project.
All infrastructure runs on the controller's own server (homelab) located in Spain. No third-party hosting provider is used for the website.
3. What data is processed, and why
Contact form
- Data: name, email address, message body, site language and submission date.
- Purpose: to read and reply to your message.
- Legal basis: your consent when submitting the form.
- Retention: up to 24 months from submission, or until you ask for deletion.
AI chat
- Data: the text of the questions you type during the conversation.
- Processing: questions are sent to a language model self-hosted on the controller's homelab. They are not sent to OpenAI, Google or any other external AI provider.
- Retention: conversations are not stored in any database. They only live in your browser for the duration of the session.
- Legal basis: legitimate interest in providing the service you requested by typing.
Please do not enter sensitive personal data or confidential information into the chat.
Technical logs and abuse limiting
- Data: IP address and timestamp of requests to the chat, the contact form and the login.
- Purpose: rate-limiting per IP to prevent abuse and brute-force attacks.
- Retention: kept in volatile memory in 10 to 15 minute windows; lost when the service restarts. Never written to a database.
- Legal basis: legitimate interest in the security of the service.
Administration accounts
- Data: email, password hash (bcrypt) and TOTP secret for the second factor.
- Purpose: managing the site's content. Used exclusively by the controller.
- Legal basis: operation of the service itself.
Cookies and local storage
- No analytics, no advertising and no third-party cookies. Google Analytics and equivalent tracking tools are not used.
- Session cookie (
authjs.session-token): only created when signing in to the private area. Strictly necessary. - SSO cookie (
authelia_session): only on the private subdomain services, to keep the authenticated session. Strictly necessary. - localStorage: the chat remembers its size and position in your browser. That value never leaves your device.
4. Your Google account data
Some of the controller's applications request permission to access a Google account through OAuth 2.0. Only the strictly necessary access is requested, and always after you explicitly grant it on Google's consent screen.
Scopes that may be requested
| Scope | What it is used for |
|---|---|
drive.file | Creating and managing only the files the application itself creates in your Google Drive: encrypted infrastructure backups. The application cannot see or read the rest of your Drive. |
openid, email, profile | Identifying you so you can access the private services: account identifier, email address and profile name. |
How it is used and where it is stored
- Backups are uploaded end-to-end encrypted and stored in the Google Drive of the very account that authorised the application. They are not copied anywhere else.
- Profile data obtained at sign-in is used only to identify the session. It is never enriched or cross-referenced with other sources.
- Access and refresh tokens are stored encrypted in the homelab secret manager and are shared with nobody.
Limited Use (Google API Services User Data Policy)
These applications' use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:
- Google data is not sold, rented or transferred to third parties.
- It is not used for advertising, profiling or market research.
- It is not used to train, fine-tune or improve any artificial intelligence model, first- or third-party, including generalised models.
- Humans read that data only when you explicitly authorise it, when necessary for security purposes, or where required by law.
How to revoke access
You can withdraw the granted permission at any time from your Google account permissions page. The application immediately loses access to your data.
5. Recipients and third parties
Data is not shared with third parties, other than the providers strictly necessary for the service to work:
- Google Ireland Limited — storage of encrypted backups in Google Drive, when that integration is used.
- Outbound mail provider (SMTP) — occasional system notifications.
There are no international transfers beyond those performed by those providers under the European Union's standard contractual clauses.
6. Retention periods
| Data | Retention |
|---|---|
| Contact form messages | Up to 24 months, or until you ask for deletion |
| Chat conversations | Not stored |
| IPs for abuse limiting | Volatile memory, 10 to 15 minutes |
| Administration accounts | For as long as the account exists |
| Google Drive backups | Per the homelab rotation policy; deleted when access is revoked |
7. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw your consent, by writing to privacidad@albertoar.com. Requests are answered within one month at the latest.
If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
8. Security
- All traffic is encrypted over HTTPS with Let's Encrypt certificates.
- Passwords are stored as bcrypt hashes, never in plain text.
- The admin panel requires mandatory two-factor authentication (TOTP).
- Backups are encrypted before leaving the server.
- Security headers and a restrictive Content Security Policy are enforced.
9. Minors
This site is not directed at children under 14 and does not knowingly collect data from minors.
10. Changes to this policy
This policy may be updated to reflect changes in the service or in applicable law. The date of the latest revision is shown at the top of the page.