Portfolio Assistant
Ask about Kevin
Login required
Sign in to chat with me — I'll answer your questions about Kevin's projects and experience, or help you leave a message to get in touch.
Free account required · No spam
Last updated: 29 October 2026
This policy explains which personal data this website processes, why, on what legal basis, for how long, who receives it, and the rights you have under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the French Data Protection Act. It complements the Legal Notice and Terms of Use.
Kevin De Benedetti, reachable at contact@kevindb.dev, is the controller of the processing described here. No data protection officer has been appointed, as none is required for this processing.
Every request leaves a technical log line (IP address, requested address, date, browser identifier). Purpose: run the site, keep it secure and detect abuse. Legal basis: our legitimate interest in a working and secure site. Kept for 7 days at most. To limit abuse, your IP address, your account identifier if you are signed in, and a fingerprint of the email address you enter in the contact or sign-up form are also counted in memory for the length of each rate-limit window (24 hours at most). The fingerprint is a one-way hash: the address itself is not kept there.
Audience is measured with Umami, hosted on our own servers: no data is shared with a third party. It uses no cookie, honours your browser's "Do Not Track" setting and never stores your IP address: it only derives an approximate location (country, region, city) from it, and recognises a visit by a fingerprint that changes every month. It records the page path (never its query string), the referring site, technical characteristics of the browser, page loading times and a few actions (opening a project, its repository or its live site, following a link to a social network, sending the contact form). The back-office is never measured. Purpose: understand how the site is used and improve it. Legal basis: our legitimate interest. Kept for 25 months at most, then erased automatically.
If you create an account or sign in (email and password, or through GitHub or Infomaniak), we process your email address, name, profile picture, a hash of your password (never the password itself), the sign-in provider used, the dates of email verification and last sign-in, the date and version of the terms you accepted, and any deletion request. Purpose: provide and secure your account. Legal basis: performance of the terms of use you accept, and our legitimate interest in securing access. Kept until your account is deleted. An account created with a password whose email address is never confirmed is deleted after 7 days. Email verification links expire after 24 hours and password reset links after one hour; expired links are then erased automatically.
When you write through the contact form — including the one the assistant can show you in the chat — we process your name, email address, subject, message and IP address. Purpose: answer you and prevent spam. Legal basis: our legitimate interest and steps taken at your request. Kept for 12 months, then erased automatically.
The form on the home page is protected against bots by Cloudflare Turnstile. The check only starts once you begin filling in the form, and only if you are not signed in: Cloudflare then checks your browser and receives your IP address for that check alone. It does not read what you write.
When you use the assistant, we process your messages and its answers, their dates, the conversation identifier, the model used, the response time and any rating you give. Your message is sent to a language-model provider (see section 3) to generate the answer; it is also screened automatically before and after generation, to refuse harmful content or attempts to bypass the assistant's rules. Purposes: provide the assistant, keep it safe and improve its quality. Legal basis: performance of the assistant's terms, which you accept before your first message, and our legitimate interest in its security. Conversations are kept for 90 days, then erased automatically; email addresses and phone numbers written in them are masked after 24 hours. We do not use your conversations to train models and do not sell them. Please do not enter sensitive personal data in the chat.
We send the emails your account needs (address confirmation, password reset, password change notice). Legal basis: performance of the terms of use.
Your data is accessible only to Kevin De Benedetti. It is never sold. The following providers process it on our behalf, each for its own part of the service:
The assistant reaches OpenAI through a gateway hosted on our own servers.
Hosting takes place in the European Union. Switzerland is recognised by the European Commission as providing an adequate level of protection. Transfers to the United States (sections 2.4, 2.5 and 3) rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can ask for more information at contact@kevindb.dev.
Traffic is encrypted (HTTPS), passwords are stored hashed, access to the data is restricted to the administrator, and the measures above (screening, rate limits, automatic erasure) limit what is kept and for how long.
No decision producing legal effects concerning you is taken by automated means alone. Abuse protection is automated (refusal of a message flagged by screening, rate limits, reduced daily allowance after repeated bypass attempts); if you think it applied to you wrongly, write to contact@kevindb.dev.
You have the right to:
To exercise them, write to contact@kevindb.dev: we answer within one month. You may also lodge a complaint with a supervisory authority — in France, the CNIL (cnil.fr).
Creating an account is reserved for people aged 15 or over, or younger with the consent of a holder of parental authority.
This policy changes whenever the processing it describes changes. The date of the version in force is shown at the top of this page, and account holders are informed of any substantial change.