Skip to content
Reza Motaghi

Privacy Policy

Last updated · July 11, 2026

The short version

  • This site sets no cookies and shows no ads.
  • Visitor statistics are collected without cookies and without personal identifiers. We cannot tell who you are, and we do not try to.
  • The only personal data you can give us is what you type into the contact form, and it is used for exactly one thing: replying to you.

The rest of this page says the same thing in the detail the law rightly requires.

1. Who is responsible

The controller for any personal data processed through this website is:

Reza Motaghi Osterleitengasse 2, 1190 Wien, Austria Contact: contact form

2. What this website is

A personal publication: essays, professional pages, and a contact form. There are no user accounts, no shop, no comments, and no advertising. That scope is why so little data is involved.

3. What we process, and why

3.1 Contact form

If you write to us, we process the name, email address, and message you provide. Purpose: reading and answering your message. Legal basis: taking steps at your request prior to entering into contact with you, and our legitimate interest in responding to correspondence (Art. 6(1)(b) and (f) GDPR).

Your message is transmitted to us as an email through Google's Gmail service and delivered to our mailbox hosted by Zoho Mail. Both act as processors for this delivery; the message content is not used for any other purpose.

Spam protection works without storing anything about you: a hidden form field catches bots, and a rate limit holds your IP address briefly in server memory only. The IP address is never written to a database or log by us.

We keep correspondence as long as the conversation and legitimate follow-up require, then it is deleted.

3.2 First-party analytics (AI crawlers and referrals)

Our server records a request only when it carries a signal of AI-engine involvement: a known AI crawler's user agent, or a referral from an AI service. For those requests we store the page path, user agent string, referrer, and timestamp. No IP address, no cookie, no identifier of any kind is stored. These records cannot identify a person and exist to show us whether AI systems read and cite this site. They are stored with Neon (Postgres database, EU region, Frankfurt). Legal basis: legitimate interest (Art. 6(1)(f) GDPR); the data is anonymous at collection.

3.3 Pageview statistics (GoatCounter)

We count pageviews with GoatCounter, a privacy-focused service that works without cookies and without tracking you across sites. It processes the page URL, referrer, browser type, screen size, and approximate country, and does not store your IP address in a form that identifies you. See GoatCounter's privacy policy. Legal basis: legitimate interest in knowing which pages are read (Art. 6(1)(f) GDPR).

3.4 Hosting and performance (Vercel)

The site is served by Vercel. Like any host, Vercel processes IP addresses and request data transiently in server logs to deliver pages and defend against abuse. We also use Vercel Speed Insights, which reports anonymous performance measurements (how fast pages load) without cookies or persistent identifiers. See Vercel's privacy policy.

3.5 Stored in your browser only

Your light/dark theme choice is kept in your browser's local storage. It never leaves your device and is not a cookie.

4. Third-party content and outbound services

  • YouTube thumbnails. Some articles show a preview image loaded from YouTube's image server; your browser requests it directly, which discloses your IP address to Google, as with any image on the web. The video itself only plays if you follow the link to YouTube.
  • Newsletter. The newsletter is hosted by Substack. If you subscribe there, Substack is the controller for that relationship; see Substack's privacy policy.
  • External links. Linked sites are outside our control and have their own policies.

5. What we do not do

We do not sell, rent, or share personal data. We do not profile visitors, run ads, or use marketing trackers. Data is disclosed only if the law requires it (for example, a valid order by a court or authority).

6. International transfers

Some providers above (Google, Vercel, Zoho, Substack) may process data outside the EU/EEA. Where that happens, transfers rest on the safeguards the GDPR provides for, such as adequacy decisions or standard contractual clauses maintained by those providers.

7. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent where processing rests on consent. Exercise any of these via the contact form. You also have the right to lodge a complaint with a supervisory authority; in Austria that is the Datenschutzbehörde (dsb.gv.at).

A practical note: for the anonymous statistics in sections 3.2 and 3.3 we hold nothing that can be linked to you, so there is usually nothing to look up or delete; the contact form is where personal data actually exists.

8. Children

This site is not directed at children and we do not knowingly collect personal data from them.

9. Changes

Updates to this policy are published on this page with a new date at the top.