← Back

Privacy Policy

Last updated: 29 July 2026

Who this policy covers

This website is operated by me, Todor Hlebarov, based in Sofia, Bulgaria ("I", "me"). For anything in this policy, you can reach me at hello@todorhlebarov.com.

This site is my personal portfolio. Any paid client work you see showcased here was carried out through Cosmonavt Ltd, a separate legal entity I co-founded — if you're a client or prospective client, that relationship (and any data it involves) is governed by our separate agreement with you, not by this website policy.

What data I collect

Information you give me

If you email, call, or message me through the contact page, I receive whatever you send me — typically your name, email address or phone number, and the content of your message. I use this only to reply to you.

Basic visit statistics — no consent needed

I use Cloudflare Web Analytics for a basic count of visits and pages viewed. It doesn't use cookies, localStorage, or any other identifier to recognize you — it can't tell you apart from any other visitor to this site, so no consent is required and it runs for every visitor regardless of your cookie choice below.

Google Analytics — only with your consent

I additionally use Google Analytics for a fuller picture (which pages are viewed, roughly how, and general location derived from IP address). Unlike the basic statistics above, this is off by default — it only activates if you click "Accept" on the cookie banner, and you can withdraw that consent at any time via "Cookie preferences" in the footer. Declining or withdrawing consent means no analytics cookie is set, and any already set are removed.

Google Analytics is provided by Google Ireland Limited and may process data on servers outside the EU/EEA, under Google's standard contractual clauses. See Google's own Privacy Policy for how Google handles this data.

Hosting and security logs

This site is served through Cloudflare, which — like effectively every website host — processes visitor IP addresses as a normal part of serving pages and protecting against abuse. This happens for every visitor, regardless of your cookie choice, and is necessary for the site to function and stay secure.

Cookies and similar storage

The "necessary" items above are stored in your browser, not sent anywhere — they're what makes small preferences (like which view you last chose) persist between visits, and don't require consent under GDPR/ePrivacy rules.

Legal basis for processing

• Contact requests — my legitimate interest in responding to you, and where relevant, taking steps prior to entering a contract.
• Basic visit statistics (Cloudflare) — legitimate interest; no personal identifier is involved, so this isn't "processing" in the sense that requires consent.
• Google Analytics — your consent, given via the cookie banner. Withdrawable at any time.
• Security/hosting logs — legitimate interest in keeping the site running and secure.

Your rights

Under GDPR, since I'm based in Sofia, Bulgaria, you have the right to:

• Access the data I hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time (for analytics: use "Cookie preferences" in the footer)
• Lodge a complaint with your local data protection authority — in Bulgaria, the Commission for Personal Data Protection (CPDP)

To exercise any of these, email hello@todorhlebarov.com.

Data retention

Contact messages are kept for up to 1 year, then deleted. Google Analytics retains event data for 14 months and user-level data for 2 months, after which it's automatically deleted on Google's side.

Changes to this policy

I may update this policy from time to time. The "Last updated" date above reflects the most recent revision.