PRIVACY.

Controller

Email: why@notanothertab.com

This statement applies to the Not Another Tab portfolio website.

Hosting & access data

The website is served through Cloudflare Workers and Cloudflare’s delivery network. Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. IONOS provides the email mailbox; website content is not served by IONOS or Netlify.

A page request involves processing technical connection data, including the IP address, requested address, time and browser information. This enables website delivery and helps detect errors and attacks.

The legal basis for necessary technical operation is Article 6(1)(f) GDPR. The legitimate interest is the secure and reliable provision of this website.

Cloudflare may process data outside the EU or EEA. Information on data processing and transfer safeguards, including EU standard contractual clauses and the EU–US Data Privacy Framework, is provided in the Cloudflare Data Processing Addendum. Further information: Cloudflare privacy policy.

Workers Logs and Workers Traces are disabled for this website. We do not store our own access logs or IP addresses in a database. Cloudflare processes network and security data for secure delivery; retention depends on the relevant security or operational purpose, legal requirements and Cloudflare’s privacy information. We do not state a blanket retention period of our own for this processing.

Privacy settings, intro & statistics

Fonts, images and film preview images are delivered with the website. There are no public user accounts or ordering or payment functions. Optional statistics and intro memory can be selected separately. Without consent, no Google Analytics library is loaded and no measurement request is sent to Google.

If you allow ‘Remember to skip the intro’ and watch the intro to completion or deliberately skip it, we store the first-party cookie nat-intro-seen-nat with the value v1 for 180 days. It contains no visitor ID and only makes the homepage show the portfolio immediately on your next visit. Switching tabs or abandoning the intro does not set this marker. The legal basis is consent under Section 25(1) TDDDG and, where personal data is processed, Article 6(1)(a) GDPR.

Your choice, including a rejection, is stored under nat-privacy-choice in local browser storage for 180 days so that we can respect it without asking on every page request (Section 25(2)(2) TDDDG; Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR). ‘Accept all’ permits the optional functions shown; consenting to statistics alone does not permit intro memory. You can change your choice or withdraw consent for the future using ‘Privacy settings’ in the footer. Withdrawal removes the intro marker or the accessible analytics cookies. You can also delete all stored website data in your browser.

Google Analytics 4 provides optional audience measurement. Only with your consent does Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, process technical device and browser data, approximate location, cookie identifiers, page, project and service views, contact/email/service-link clicks and language changes. The content language, selected target language and a stable service identifier may also be recorded. Transfers to Google LLC in the USA are possible; Google identifies the EU–US Data Privacy Framework and standard contractual clauses as transfer safeguards. Data processing terms have been agreed. We do not send email addresses, contact contents or URL query parameters as event parameters, and we do not use a User-ID. Enhanced automatic measurement, additional data sharing and advertising personalisation are disabled. Analytics cookies last no more than 180 days without renewal on every visit. In the property, event data is retained for 2 months and user data for 14 months; new activity resets the user-data period. These periods do not apply to aggregated standard reports, which may be retained longer. Meta and other advertising pixels are disabled. The legal bases for optional analytics are Article 6(1)(a) GDPR and Section 25 TDDDG.

Film player / YouTube

Some project pages contain YouTube films (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Initially, only a locally delivered preview image is shown. ‘Load YouTube and play’ loads the player through youtube-nocookie.com; permission to play is independent of consent to statistics. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Loading gives YouTube or Google technical connection data and information about player use. This may include the IP address, browser information and playback activity. Information on further processing is provided in Google’s privacy policy. Processing in the USA is possible; Google identifies the EU–US Data Privacy Framework and standard contractual clauses as transfer safeguards.

Permission applies only to the selected film and is not stored permanently by this website. ‘Close player’ or leaving the project removes the embedded player. The separate ‘Watch on YouTube’ link opens the external YouTube website.

Contact enquiries

If you contact us by email, your sender address, message and any additional information are processed to handle your enquiry. Article 6(1)(b) GDPR applies to enquiries relating to a contract; otherwise, the legitimate interest in responding under Article 6(1)(f) GDPR applies.

We retain enquiries and related correspondence while they are needed to handle the enquiry, maintain a business relationship, meet statutory retention duties, or establish or defend legal claims. We review whether these purposes still apply before deleting manually. The website does not automatically delete emails.

The email mailbox is provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. IONOS processes message and connection data for delivery and secure operation. A data processing agreement has been concluded. Under the IONOS service description (March 2026), email data is deleted no later than 7 days after our deletion or termination of the contract; technical email logs no later than 28 days after creation. These subsequent periods do not replace our purpose-based deletion or statutory retention duties described above.

Instagram & other external links

Instagram and linked project websites are accessible through ordinary links. This website does not load Instagram posts, social media pixels or other websites in embedded windows. Following a link opens the external service, whose privacy information then applies.

Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction and data portability. You can withdraw consent for the future. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation.

You can complain to a data protection supervisory authority, especially in your place of residence, workplace or the place of the suspected infringement. In Berlin: Berlin Commissioner for Data Protection and Freedom of Information.

This website does not make automated decisions with legal or similarly significant effects. Information on statutory rights is available in the General Data Protection Regulation.