Who is responsible
Ktesio is the controller for the personal data described on this page. The page covers ktesio.dev and the sites of the open-source projects it publishes, such as hekma.ktesio.dev. The company site is ktesio.com.
- Ktesio, KVK 42172743
- Post address: Postbus 21534, 3001 AM Rotterdam, the Netherlands
- Email: privacy@ktesio.com
Questions about this statement or about your data go to the email address above.
The short version
- The sites set no cookies. That’s why there is no cookie banner.
- There are no analytics, no tracking pixels, and no advertising.
- Each site serves its own fonts, styles and scripts. Your browser loads nothing from any other domain.
- There are no forms and no accounts. If you email Ktesio, your message goes to Ktesio’s mailbox so Ktesio can reply, and the provider that hosts that mailbox stores it there.
- The sites are hosted by Cloudflare. Some of the data a visit or an email creates can be processed outside the EU, including in the United States. The section on where your data is processed explains what and why.
Visiting the sites
The sites are hosted on Cloudflare Pages. When your browser asks for a page, Cloudflare receives the technical data that comes with every web request: your IP address, the address of the page, the time, your browser’s user agent and, if your browser sends it, the page that linked to this one. Cloudflare uses this data to deliver the page and to protect the sites against attacks.
The sites keep no request logs of their own. Cloudflare’s dashboard shows Ktesio aggregate traffic figures, such as requests per day, not individual visitors.
Where a page shows live numbers, such as a project’s latest version, they are fetched from GitHub and crates.io when the site is built, not by your browser.
The search box in Hekma’s docs downloads the search index from hekma.ktesio.dev the first time you use it and searches it in your browser. What you type is never sent anywhere.
Legal basis: Ktesio’s legitimate interest in running a secure website that stays online (Article 6(1)(f) GDPR).
Settings kept in your browser
If you switch between the dark and light theme, your choice is saved in your browser’s local storage so the next page opens the same way. It is not a cookie, it is never sent to Ktesio or anyone else, and clearing a site’s data in your browser removes it.
Install commands and links to other sites
The install commands on these sites download an install script from cli.ktesio.dev, which Cloudflare also hosts for Ktesio, and the software itself from GitHub, crates.io or Homebrew. Those requests come from your terminal when you run the command, not from the site. Cloudflare handles the request for the script as described under “Visiting the sites”; GitHub, crates.io and Homebrew handle theirs under their own privacy policies.
Pages also link to GitHub, crates.io, ktesio.com and other sites. Following a link takes you to that site, and its own privacy policy applies.
Email sent to Ktesio is routed by Cloudflare: inbound email through Email Routing, and Ktesio’s replies through its Email Service. Cloudflare, Inc. is a US company; these transfers to the United States rest on its certification under the EU-U.S. Data Privacy Framework, with the EU standard contractual clauses as a fallback. The provider that hosts Ktesio’s mailbox stores the email delivered to it, including your message and Ktesio’s replies, mainly in the United States, under the EU standard contractual clauses.
Ktesio uses your message to reply to you and, if you decide to work together, to agree a scope.
Legal basis: steps you ask for before a possible contract (Article 6(1)(b) GDPR), and Ktesio’s legitimate interest in answering questions and business enquiries (Article 6(1)(f) GDPR).
How long it’s kept: if your message doesn’t lead to work, Ktesio deletes it within 12 months of your last message. If it does, the parts that belong to Ktesio’s business records are kept for the 7 years that Dutch tax law requires.
Issues and pull requests you open on GitHub are not email: they are public, and GitHub’s privacy policy covers them.
Where your data is processed
Cloudflare runs a global network. Your request is handled by one of its data centers, normally one close to you, so for most visitors in Europe the page is served from Europe. Some processing can still take place in the United States, such as storing request logs and security data.
Cloudflare, Inc. is a US company. For transfers to the United States it relies on its certification under the EU-U.S. Data Privacy Framework, with the EU standard contractual clauses as a fallback.
The provider that hosts Ktesio’s mailbox processes the email it stores mainly in the United States, and those transfers rest on the EU standard contractual clauses.
Who receives your data
- Cloudflare, Inc. hosts the sites and the install scripts, routes email to Ktesio and sends Ktesio’s replies. It does this as Ktesio’s processor, under Cloudflare’s data processing terms.
- The provider that hosts Ktesio’s mailbox stores the email delivered to it, including your message and Ktesio’s replies, mainly in the United States, under the EU standard contractual clauses.
Nobody else. Ktesio doesn’t sell your data and doesn’t use it for marketing.
Your rights
You can ask Ktesio for a copy of your personal data, and ask for it to be corrected or deleted. You can ask for processing to be restricted, or for your data in a portable format. Where processing rests on Ktesio’s legitimate interest, you can object to it. Email privacy@ktesio.com and Ktesio replies within 1 month, as the GDPR requires.
If you think your data is being handled wrongly, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
Changes
If what the sites collect changes, this page changes with it. The date at the top shows when it last changed.