Who is responsible

Michael Micle (michaelddev), Rollegemstraat 55, 8880 Ledegem, Belgium, KBO 1024.504.003, support@michaelddev.com. Phone: +32 494 62 47 94 (normal rate). I'm a sole-proprietor, so I'm also your contact for every privacy question.

This policy explains how I handle personal data when you visit michaelddev.eu or michaelddev.com, contact me, book or buy a service, or follow my social media accounts.

What I collect and why

When you visit the website. Squarespace, my website host, automatically records technical data such as your IP address, browser, device, the pages you view and the date and time. This is needed to run the website and protect it against abuse (legitimate interest). These security logs are kept for the limited period set by Squarespace.

Fonts. The website's fonts are loaded from Google Fonts, which receives your IP address when a page loads (legitimate interest in displaying the website correctly).

Visit statistics. Only if you accept statistics cookies, I see anonymous figures on which pages are visited, so I can improve the site (consent). You can withdraw your consent at any time with the cookie button. Details are in the cookie policy.

Spam protection on forms. My forms use Google reCAPTCHA, which checks your IP address, browser and how you interact with the form to block automated spam (legitimate interest). Google keeps this data for the period set in its own policy.

When you contact me. If you write to me through the contact form, email, WhatsApp or Telegram, I use your name, contact details and message to answer you (your request and my legitimate interest in replying). I keep these messages for 12 months after our last contact.

When you book a service. I use your name, email, phone number, the service and date you chose, and your answers to the booking questions to provide the service (contract). I keep this for 24 months after the service. Video calls take place on the video platform named in your booking confirmation; I don't record calls unless we both agree beforehand.

When you pay. Payments are handled by Stripe. I only see the amount, the date and the last digits of your card; your full card details stay with Stripe. I use this to get paid, to refund you if needed and to prevent fraud (contract and legal obligation). Belgian tax and VAT law requires me to keep payment records and invoices for 10 years.

Invoices and quotes. For invoices and quotes I use your name and address, and your company and VAT number if you're a business (legal obligation). I keep them for 10 years, as Belgian tax and VAT law requires.

When you ask me to check something. I use the links, screenshots, documents or addresses you send me only to carry out the check or report you asked for (contract). I delete them 12 months after delivering the report.

Incident support. If you ask for help after a scam or hack, I use the details of what happened, which can include information about a suspected offence against you, only to help you secure your accounts and report the incident (contract). I only collect what is needed and delete it 12 months after the case closes, unless you ask me to keep it longer.

Security testing. If we sign a security testing agreement, I process only the data needed to carry out the test (contract) and delete it within 30 days of delivering the report.

When I act on your behalf. If a security test or build gives me access to personal data you are responsible for, such as your customers' data or server logs, I process it only on your instructions, under a data processing agreement we sign first.

Your consent to start early. If you ask me to start a service or deliver a report within the 14-day withdrawal period, I keep a record of that request and of your confirmation that you lose your withdrawal right, so I can prove it if needed (legal obligation and legitimate interest). I keep this record for 5 years.

Newsletter. Only if you sign up, I use your email address to send you occasional updates (consent). You can unsubscribe with one click in any email, and I then remove your address. Service emails, such as booking confirmations, receipts and reminders, are always sent because they are part of the service you booked.

Telegram bot and subscriptions. If you use my Telegram bot (@michaelddevsbot), I store your Telegram name, username and profile photo as Telegram provides them, your app language, and the messages, links, screenshots and files you send, to answer you and provide the checks, reports or subscription you asked for (your request or contract). The bot runs on SendPulse. Messages and files are deleted 12 months after our last contact; blocking the bot removes your data from the bot platform within about 30 days. Automated replies are marked as such. If you buy a subscription, Stripe processes the payment and I keep your subscription status and the dates you have access.

I don't sell your data, I don't use it for advertising, I don't build profiles, and I don't make automated decisions about you.

Other people's data. What you send me may contain data about others (for example a scammer's profile, a sender's email or a screenshot of a group chat). I use it only for your check or report, keep it as short as possible and never publish it. If you're one of those people and want to know what I hold, contact me.

Where data comes from. Most data comes from you. For checks and reports I also use public sources, such as blockchain explorers, domain registration records (WHOIS), public code repositories, websites and public social media posts.

Children. My services are for adults. If you're under 18, please ask a parent or guardian to contact me for you. If I learn that a child sent me personal data without a parent's involvement, I delete it unless I need it to help that child stay safe.

Who processes data for me

• Squarespace (website hosting, forms, booking via Acuity Scheduling, email campaigns), USA

• Stripe (payments), Ireland/USA

• SendPulse (Telegram bot platform), only if you use my bot

• Google (reCAPTCHA spam check on forms, website fonts), USA

• Private Email, United States

• Cookiebot by Usercentrics (cookie consent records), Denmark

• My accountant, Belgium, for invoices only

• WhatsApp (Meta) or Telegram, only if you choose to contact me there or use my telegram/whatsapp bots; their own privacy policies apply

Where data goes to the USA, it is protected by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. I only share data with authorities when the law requires it, or with your permission when you ask me to help you report an incident.

My social media. If you follow, message or interact with my accounts on X, Telegram or other platforms, those platforms process your data under their own policies. I only see what they show me and use it to reply to you.

Do you have to give me your data? No. But without your contact details I can't reply to you, and without booking and payment details I can't provide a paid service. Cookies other than strictly necessary ones are always optional. Please refer to the Cookie Policy for more information.

Your rights. You can ask to see, correct or delete your data, to restrict or object to its use, to receive it in a portable format, and to withdraw consent at any time. Email support@michaelddev.com; I reply within one month and may ask you to confirm who you are. You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, +32 2 274 48 00, www.dataprotectionauthority.be.

Security. Two-factor login on all my accounts, encrypted devices, and suspicious files and links opened only in an isolated environment. Clients' contact details are also saved on my business phone so I can reach you; they are deleted together with the rest of your data. If a data breach puts your rights at risk, I inform you and, where required, the Data Protection Authority.

Changes. If this policy changes, the new date appears at the top. Important changes are announced on the homepage for 30 days.