Privacy Policy — Durga Gairhe

This policy describes how durgagairhe.com.np (operated by Durga Gairhe, Kathmandu) collects, uses, and protects your information. We collect minimal data and use it only to respond to you.

1. Data we collect

Contact form: name, email, subject, message — stored in Supabase table contact_messages with status `new`.
Newsletter: email only — stored in newsletter_subscribers (or forwarded to ConvertKit/Resend via PUBLIC_CRM_WEBHOOK_URL).
Analytics (if enabled): anonymized page views via Vercel Analytics — no cookies for tracking identity.

We do not collect: payment data, government IDs, or sensitive categories. Honeypot field website / company_website is used only to block bots and is discarded.

2. How we use it

To reply to your inquiry (contact) and send occasional build logs (newsletter) — you can unsubscribe anytime.
To improve the site (aggregated, anonymized). We never sell your data.

3. Legal basis & retention

Legal basis: consent (newsletter) and legitimate interest/contract (replying to contact). Contact messages retained until resolved, then archived. Newsletter emails retained until you unsubscribe (delete via email to gairhedurga13@gmail.com).

4. Sharing

Processors only: Supabase (Postgres, Edge Functions, Storage `portfolio` bucket) and, if configured, Vercel (hosting) and ConvertKit/Resend (newsletter). All are GDPR-aware. No selling, no ad networks.

5. Your rights

You may request access, correction, or deletion of your data at any time via gairhedurga13@gmail.com or contact form. We respond within 7 days.

6. Security

Transport: HTTPS + HSTS `max-age=63072000` + CSP `default-src 'self'` (see vercel.json:7 headers). Storage: Supabase RLS (service key server-only), AES-256 at rest, bcrypt for admin, Zod validation + sanitization (`src/lib/validators.ts:1` `sanitizeText`/`sanitizeEmail`), rate-limit 60s on newsletter/contact (client `localStorage` + planned server rate-limit).

7. Cookies

Only essential: theme preference (`localStorage`, not cookie) and auth refresh cookie for /admin (future). No tracking cookies. See browser settings to clear.

8. Children

Site is not directed to children under 13. We do not knowingly collect from children.

9. Changes

We’ll update this page and the `Last updated` date when we change practices. Check back periodically.

10. Contact

Durga Gairhe — Kathmandu, Nepal
Email: gairhedurga13@gmail.com
GitHub: github.com/dpgaire · LinkedIn: linkedin.com/in/durga-gairhe

Privacy Policy.