This website is a personal portfolio showcasing case studies and blog posts. I am committed to a tracker-free web experience and process only the minimum data necessary to operate this site.

1. Data Controller

This website is operated by Michael Lundie, an individual developer based in Japan. For all data-related enquiries, please use the contact form on this website or email hello@lundie.io. I aim to respond to all requests within 30 days.

2. Data I Collect, Why, and the Legal Basis

Contact Form

When you submit a message, I collect your name, email address, and message content. This is used solely to respond to your enquiry.

• Purpose of use: Responding to enquiries and communicating with prospective clients or collaborators.
• Lawful basis: Legitimate interests – it is in both your and my interest to be able to communicate effectively. This does not override your rights; the data is minimal and used only for the stated purpose.

Contact Form Delivery (Formspree)

Contact form submissions are processed and delivered to me using Formspree (Formspree, Inc., United States). When you submit the form, your name, email address, and message pass through and are stored by Formspree so the message can be delivered to me and so I can reply. Formspree acts as a data processor on my behalf.

• Lawful basis: Legitimate interests in receiving and responding to enquiries.
• Your submission is transferred to and stored on servers in the United States. For details, see Formspree’s privacy policy.

Security Infrastructure & Hosting (Cloudflare)

This site is hosted on Cloudflare Pages and delivered via Cloudflare’s global network (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107). To serve pages and protect against malicious traffic, Cloudflare automatically processes connection metadata – including your IP address, request timestamp, browser type, and the page requested. This is handled transiently for security and delivery purposes. No identifiable data is retained by me as a result. Cloudflare may set strictly necessary cookies to secure the site against automated abuse; these are not used for tracking or advertising.

• Lawful basis: Legitimate interests in maintaining a functional and secure website.
• Cloudflare participates in the EU–US Data Privacy Framework, providing a valid basis for transfers to the United States. For further detail, see Cloudflare’s privacy policy.

Privacy-First Analytics (Umami)

I use Umami (provided by Umami Software, Inc., United States) to monitor aggregate traffic – for example, total page views. Umami does not use tracking cookies, does not identify you across websites, and fully anonymises IP addresses before any data is recorded. Aggregate, non-identifying analytics are processed on Umami’s cloud infrastructure. No personal data is collected through this tool.

3. Data Retention

• Contact form records are deleted once our exchange has concluded, and in any case within 12 months of last contact, unless an ongoing professional relationship is established.
• Cloudflare processes IP data transiently for security and delivery purposes – I do not retain this data.
• Formspree submissions are stored in my Formspree inbox; I delete them once our exchange has concluded, subject to Formspree’s own retention practices.
• Analytics data is fully anonymised and is not subject to retention limits as it contains no personal data.

4. International Data Transfers

Website infrastructure and Cloudflare’s network routing operate via servers in the United States, and the contact form (Formspree) and analytics (Umami) providers are also US-based. Cloudflare participates in the EU–US Data Privacy Framework and maintains standard contractual protections for data transferred outside the UK and Japan. By using this site, routine network traffic is processed across US and Japan infrastructure as a technical necessity.

5. Data Sharing

I do not sell, rent, trade, or share your personal data with any third-party advertisers or data brokers. Data is only shared with the third-party services named in this policy – Cloudflare, Formspree, and Umami – strictly for the purposes described above.

6. Your Rights

You have the right to:

• Access personal data I hold about you
• Correct inaccurate data
• Erasure of your personal data
• Object to processing based on legitimate interests
• Data portability (where applicable)

To exercise any of these rights, please contact me via the website form or at hello@lundie.io. I will respond within 30 days.

7. Complaints

UK visitors: You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully.

Japan and other visitors: You may raise a concern with Japan’s Personal Information Protection Commission (PPC) at ppc.go.jp.

8. Data Breach Notification

In the event of a personal data breach likely to result in harm to affected individuals, I will notify the relevant supervisory authority and affected individuals in accordance with applicable legal requirements.

9. Changes to This Policy

If this policy is updated, the revised version will be published on this page with an updated date. For material changes, I will make reasonable efforts to notify regular visitors.