Dirck Mulder

Privacy Policy

Last updated: 2026-09-25

This policy explains how Dirck Mulder("I") handle your data when you visit dirckmulder.com. I follow the EU General Data Protection Regulation (GDPR).

1. Data controller

Pure Studio (Dirck Mulder), based in The Netherlands (KVK 98665103, BTW NL005345618B56). For privacy questions: privacy@dirckmulder.com.

2. What I collect

Contact form: name, email, and message content submitted through the contact form. Delivered by Resend so I can reply. Legal basis: consent (Art. 6(1)(a) GDPR).

Product analytics: PostHog (EU-hosted) records which pages and components are viewed. It uses a random anonymous identifier in your browser. Legal basis: legitimate interest in improving the site (Art. 6(1)(f)). PostHog cookies are essential to the analytics feature and not used for advertising.

Newsletter:your email address, which page you signed up from, the exact consent wording you agreed to, your browser's user-agent, and a one-way salted hash of your IP address. I never store the IP itself. Legal basis: consent (Art. 6(1)(a) GDPR). Subscription is double opt-in, so you are only added after clicking the link in the confirmation email, and addresses that are never confirmed are deleted after 30 days. Every issue carries a one-click unsubscribe. Stored in Supabase (EU), delivered by Resend (EU).

Newsletter design pages and kit panels: on the /designs pages linked from an issue, and on the kit signup panels in blog posts, I record which buttons are pressed (opening the page from the email, downloading, sharing, copying a link, opening or sending the form). When you arrive from your own email the presses are linked to your subscription, so I can count downloads and shares per subscriber. Otherwise they are anonymous, tied only to a random id in a first-party cookie. A share link carries a random id of its own, so I can see whether it was opened and whether someone signed up through it. Nothing is recorded just by loading a page. IP addresses are stored only as a one-way salted hash, for rate limiting. Legal basis: legitimate interest in knowing whether the free downloads are used (Art. 6(1)(f)).

Server logs: Vercel logs IP address and user-agent for security and abuse prevention. Retained up to 30 days.

3. Subprocessors

EU/US transfers rely on Standard Contractual Clauses (SCC).

  • PostHog — Product analytics (EU-hosted) (EU).
  • Resend — Contact form and newsletter email delivery (EU/US (SCC)).
  • Supabase — Newsletter subscriber storage (EU).
  • Vercel — Website hosting and edge delivery (EU/US (SCC)).

4. Retention

  • Contact form messages: 12 months, then deleted.
  • Newsletter subscribers: until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days. A record that an address unsubscribed is kept so you are not accidentally added again.
  • Server logs: up to 30 days.
  • Analytics events: 12 months, then aggregated.

5. Your rights

Under the GDPR you have the right to:

  • Access the personal data held about you;
  • Correct or delete it;
  • Restrict or object to processing;
  • Receive your data in a portable format;
  • Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Email privacy@dirckmulder.com to exercise any of these rights. I respond within 30 days.

6. Cookies

Only essential cookies are used. There are no advertising cookies and no cross-site profiling.

7. Changes

I may update this policy as the site evolves. The "Last updated" date above reflects the most recent revision.