Privacy notice
Last updated: 2026-10-05
This page explains what data this site collects, why, where it goes, and how to get it deleted. Short version first, details below.
Short version
| Question | Answer |
|---|---|
| Do you track me without asking? | Analytics runs from the first page load, before you do anything, and we do not ask first. We rely on legitimate interest (see below). The analytics script (Umami) sets no cookies and stores nothing in your browser (last verified 2026-10-05). |
| Do you store my IP address? | The hosting provider (Vercel) processes your IP for transport and security logs. Analytics does not set an identifier in your browser. It derives a pseudonymous visit hash on the server from your IP address, browser user agent and the site ID, as Umami documents. The form payload does not include your IP address. As with any web request, the form endpoint sees your connection IP for delivery and security. Google also receives your IP with the font requests. Vercel log retention: [operator to state]. |
| What if I submit the email form? | Your submission (name, email, any context you add) plus a hashed session ID is kept for 90 days. Then the operator deletes it. The alert email and reply may remain in the operator mailbox ([operator to name the mailbox provider and period]); Brevo retention follows its policy. |
| Can I get my data deleted anytime? | Yes. Email jed@byjed.com with "delete" and your email address. We find the session hash stored with your form submission, then delete your form records and the analytics rows that carry that hash. Target action 72 hours, legal deadline one month (see rights below). |
| Do you share data with anyone? | With the parties in the "Where the data lives" table, plus our own consultant.com site (same controller, it receives the audit ID in the click-through URL): hosting, the email form processor and our own analytics. The form processor and analytics run in the EU. No ad networks. No data brokers. |
| Does this meet GDPR requirements? | We aim to. Form submissions rest on consent, which is recorded. Analytics rests on legitimate interest, without asking first. Deletion on request. The email relay (Brevo) acts under a DPA [operator to verify before publish]; our own n8n and Umami are self-hosted. Hosting (Vercel) and Google Fonts run on global infrastructure. Final legal assessment is yours or your counsel's. |
What gets collected, when, and why
1. The hashed session ID
When you land on the audit tool at hermesagentguide.com/audit/, the tool generates a random identifier in your browser. That identifier is immediately hashed using SHA-256. The raw value is discarded before anything leaves the tab.
Only the hash (a 64-character string of letters and numbers) travels anywhere. The hash:
- appears in the URL when you click a CTA to consultant.com (our own site, same controller)
- gets stored in your browser's local storage on hermesagentguide.com, not this site, for up to 14 days [confirm TTL] so if you come back to hermesagentguide.com, the same session continues
- is part of the page address while you are on this site, so analytics records it as part of the page URL
- gets sent to the email form if you submit it
Why: to measure whether audit tool visitors go on to book a consulting conversation. Without it, the funnel is invisible and KPIs are guesses.
Important: the hash cannot be reversed to the original value. The original random ID never existed outside your browser memory.
2. The email form
If you fill out the form at the bottom of this site, the following gets submitted:
- Your name
- Company (optional)
- Your email
- Where you are with Hermes Agent (dropdown)
- Free-text context (optional)
- The hashed session ID (from above)
- The tier of the audit CTA you arrived from (if any)
This goes to a self-hosted form processor (n8n on EU infrastructure, hosted at roboty.pokokar.de), then to Brevo (transactional email relay, EU region) for the operator alert. Brevo acts as processor under a GDPR DPA [operator to verify before publish]. n8n is self-hosted and we run it ourselves. Brevo is the only third-party processor on this path.
The operator receives the submission by email and responds within 48 hours.
Storage: submissions retained for 90 days, then purged manually by the operator. Analytics event retention: [operator to state; not set in this repo]. The alert email and reply may remain in the operator mailbox ([operator to name the mailbox provider and period]); Brevo retention follows its policy.
Your email is used to reply to your inquiry. Not for newsletters. Not for cold outreach. Not shared.
3. Analytics events
This site uses Umami, a cookieless analytics tool that we host ourselves in Germany (EU, analytics.pokokar.de). The script loads on every page view, before you interact with anything. It records:
- The page you viewed, its full address including any query string (for example campaign tags or the hashed ID above), and the page title
- The referrer, browser, operating system, device type, screen size, language and country
- Clicks on the main call-to-action links, and a "request submitted" event with the option you picked in the form (no name, email or free text)
The visit hash Umami derives on the server from IP, user agent and site ID lets us count one visit as one visit. It is separate from the audit session hash in section 1, and it is not stored in your browser. No screen recording. No heatmaps. No advertising. The audit session hash in section 1 is the same value on hermesagentguide.com and on this site, so both sites (same controller) can link one visit across the two. No third-party trackers run on this site. Google Fonts is the one third-party request, listed in the table below.
The site has no on-page switch for this. To object, email jed@byjed.com. Content blockers may block the script depending on your browser, extension and filter lists; we make no promise.
Where the data lives
| Recipient | Purpose | Region | GDPR DPA |
|---|---|---|---|
| Vercel | Website hosting | EU + global CDN | Yes [operator to verify before publish] |
| Operator self-hosted n8n | Form webhook + optional pseudonymized audit contribution (receive, validate, route). See the note below the table | Poland (EU) | Operator is controller + processor |
| Brevo | Outbound form alert emails (transactional) | Paris + Frankfurt (EU) | Yes [operator to verify before publish] |
| Analytics exclusion list (operator-held) | Stores IP and browser details of people who objected, until the objection is withdrawn or [operator to state retention period] | Operator infrastructure | N/A (own controller) |
| Umami (self-hosted, EU) | Analytics events | EU region (our infrastructure) | N/A (own controller) |
Optional audit contribution. If you opt in while working with an audit, you allow us to use a pseudonymized failure pattern from it. Per the site's own description of this option, only a pseudonymous hashed ID and a deployment profile are used, never raw data or your name. It rests on your consent and you can withdraw it at any time.
Beyond the parties in the table above, consultant.com (our own site, same controller) receives the hashed session ID (the audit ID) in the click-through URL when you follow a CTA (see section 1). No advertising networks. No data brokers. No affiliate tracking.
Your rights under GDPR
Under Art. 15 to 22 of the GDPR, you have the right to:
- Access (Art. 15): get a copy of everything stored about you. Email jed@byjed.com with "data access request". Legal deadline one month, extendable by two months for complex requests; target action 72 hours.
- Rectify (Art. 16): correct incorrect data. Same email path.
- Erase (Art. 17): have your data purged. Email with "delete" and the email you submitted. We map your email to your session hash and delete your form records and the analytics rows carrying that hash. Analytics rows are pseudonymous, not anonymous. We find them through the email link, or through the IP address and browser details if you send them to us, and delete them. Legal deadline one month, extendable by two months for complex requests; target action 72 hours.
- Restrict processing (Art. 18): ask that we pause certain processing while a dispute or correction is open.
- Port data (Art. 20): receive your data in a machine-readable format.
- Object (Art. 21): stop processing (including analytics events). Analytics rests on legitimate interest. Email us to object and we add your IP address and browser details to an exclusion list within 72 hours. If your IP changes, exclusion can lapse; email us again. Analytics rows are pseudonymous, but if you also submitted the form we can link your email to your session hash, and we can delete the analytics rows that carry it. The site does not read your browser's Do Not Track setting.
- Not be subject to automated decision-making (Art. 22): this site does not use automated decision-making or profiling that produces legal or significant effects.
- Withdraw consent (Art. 7(3)): where processing rests on consent (the email form, the optional audit contribution), you can withdraw it at any time by emailing jed@byjed.com. Withdrawal does not affect processing done before it. Withdrawal is by email, not a checkbox. We action it within the deadline stated above.
- Complain: lodge a complaint with your country's supervisory authority.
Legal basis for processing
| Processing activity | Lawful basis (GDPR Art. 6) |
|---|---|
| Email form submission (name, company, email, context) | Art. 6(1)(a) consent (checkbox) |
| Analytics events (full page URL including the hashed session ID, referrer, device, country, CTA and form events) | Art. 6(1)(f) legitimate interest |
| Optional pseudonymized audit contribution (opt-in) | Art. 6(1)(a) consent |
| Analytics exclusion list (IP, browser details, kept only to honour your objection) | Art. 6(1)(f) legitimate interest |
| Hosting + security logs (IP, request) | Art. 6(1)(f) legitimate interest |
Cookies
This site sets no cookies. The analytics script is cookieless and this site does not write to your browser's local storage. The form uses a hidden honeypot field for spam protection. It sets no cookies, and real visitors leave it empty so nothing about them is stored because of it.
The audit tool on hermesagentguide.com is a separate site with its own storage. The hashed session ID described above is created there, not here.
Changes to this notice
Material changes post-ship are dated at the top and logged in git. Minor typo fixes do not trigger a date update.
Data controller and contact
Data controller: byJed (Jędrzej Tabaczyński). The operating entity is being established as byJed LLC (United States); see the imprint for operator details.
Jędrzej Tabaczyński
jed@byjed.com
For formal GDPR requests, the email path above is the fastest route.