Privacy

What happens to your data

Last updated: 23 August 2026

The short version

This is a static site. It runs no analytics, carries no tracking pixels and sets no cookies of its own. Nothing here follows you around.

I only get personal data when you hand it over on purpose, and there are three ways to do that: the contact form, the booking window and the newsletter. Each one has a section below saying what it collects and which company helps me run it. Two of those companies are outside the EU, which is spelled out where it applies.

Who is responsible

This site is run by Jonas, who writes as That Jonas at thatjonas.com. For anything on this page, write to hello@thatjonas.com.

Hosting

The site is hosted on Cloudflare Pages and delivered through Cloudflare's network (Cloudflare, Inc.). Like any web host, Cloudflare processes the technical data that a request carries, such as your IP address, browser type and the page requested. This is necessary to deliver the site and to protect it from attacks. I do not receive a personal profile from it.

The contact form

The form on the front page asks for three things: your name, your email address and the message you write. Nothing is asked for that I do not need to answer you.

Why I may use it: to read your message and reply. The legal basis is your consent and the steps taken at your request before any work begins (GDPR Article 6(1)(a) and (b)).
Who processes it: the form is relayed to my inbox by Web3Forms, which receives your name, email and message in order to deliver them. It does not become their mailing list.
The tick box: the spam check on the form is hCaptcha, run by Intuition Machines, Inc. in the United States. When it loads it receives your IP address and technical signals from your browser. It is loaded only once you scroll down to the form, so a visit that never reaches it never touches hCaptcha at all.
Leaving the EU: both Web3Forms and hCaptcha operate outside the European Economic Area, in the United States. The transfer runs on the European Commission's standard contractual clauses. If you would rather nothing left the EU, email me directly instead of using the form: it is the same inbox.
How long I keep it: as long as the conversation is live, and no longer than 12 months after our last exchange, unless we end up working together and the message is part of that work. Ask me sooner and I delete it sooner.

Booking a call

The "Book a call" buttons open a booking window inside the page. It belongs to Cal.com and runs on their European instance at cal.eu, so what you type there is processed in the European Union.

To hold a slot it takes your name, your email address and the time you pick, and it sends the confirmation. The window is not loaded until you click the button, so simply reading the page sends nothing to them. Cancelling or rescheduling works from the link in that confirmation email.

If you sign up, this is what happens:

What I ask for: your email address. Nothing else. No name, no company, no phone number.
Consent and confirmation: signing up sends you a confirmation email. Your address is only added to the list after you click the link in it (double opt-in). If you never click, it is discarded.
Who processes it: the list runs on EmailOctopus, a product of Three Hearts Digital Ltd in the United Kingdom. They store and send on my instructions only. The UK has its own GDPR and is covered by the European Commission's adequacy decision, so your address does not leave a jurisdiction with equivalent protection.
What I do with it: send you the letters. That is all. I do not sell it, rent it, or hand it to anyone else for their own use.
How long I keep it: until you unsubscribe. Every email has an unsubscribe link, and one click is enough. After that your address is removed from the list.

If you email me

Messages you send to hello@thatjonas.com are ordinary correspondence. I keep them as long as they are useful for our conversation or for work we do together, and I do not add you to the newsletter because you wrote to me.

Cookies and tracking

This site sets no cookies of its own and stores nothing in your browser. There is no analytics tool, no advertising tag, no social media pixel and no font loaded from someone else's server: the fonts you are reading are served from this site itself. Nothing here measures you.

Two third parties can set their own cookies or storage, and only inside their own window, and only if you go near them: the booking window (cal.eu) once you click "Book a call", and the captcha on the contact form once you scroll down to it. Both are strictly there to make the thing work - a booking that remembers your slot, a spam check that can tell a person from a script - which is why there is no cookie banner to click away. Neither is used to advertise to you, and I get nothing back from either that would build a profile.

Your rights

Under the GDPR you can ask me to:

tell you what data I hold about you,
correct it if it is wrong,
delete it (right to erasure),
send you a copy of it,
stop using it.

Write to hello@thatjonas.com and I will handle it myself, normally within a few days. If you are unhappy with how I did it, you can complain to the data protection authority in your country.

Changes

If this page changes, the date at the top changes with it. There is no version history worth keeping yet.