This page explains what personal data I collect through nicodes.xyz, why, and what you can do about it. Short version: I only collect what I need to reply to you, I don't use tracking or analytics, and you can ask me to delete everything at any time.
Who I am
This site is run by Nicolas Sebag, a freelance developer working under the name Nicodes. I'm responsible for the personal data described on this page (the "data controller").
- Business address: {BUSINESS_ADDRESS}
- Registration number: {BUSINESS_ID}
- Email: contact@nicodes.xyz
What I collect
When you request a free audit through the form:
- your store's web address;
- your email address;
- your message, if you write one;
- the page you sent the form from, the site that sent you there (referrer) and any campaign tags in the link (utm_…);
- the date and time of your request.
When you email me: your address and whatever you include in your message.
When you visit the site: the hosting provider and Cloudflare handle technical data such as your IP address and browser type, to deliver the pages and block spam. I don't use analytics or advertising tools.
I also run a public speed test (Google PageSpeed Insights) on the store address you send. It measures your public storefront, not you.
If I contacted you first
I sometimes email Shopify store owners about their store's speed or theme. In that case, I found your business email and store address on public sources, such as your store's website or contact page.
I only keep what I need to reach you: your name if it's public, your business email, your store's address and notes on its public speed results.
Every message tells you how to opt out, and a one-line reply is enough. I then stop and keep only your email address on a do-not-contact list, so I don't write to you again.
Why, and on what legal basis
- To reply to your request and prepare your audit. Legal basis: steps you asked me to take before a possible contract.
- To follow up on that audit and, if you hire me, to carry out and invoice the project. Legal basis: the contract, and my legal duty to keep accounting records.
- To protect the form from spam and abuse. Legal basis: my legitimate interest in keeping the site secure.
- To contact businesses about my services (see above). Legal basis: my legitimate interest in offering my services to other businesses, which you can object to at any time.
I don't sell your data, I don't add you to a newsletter without your consent, and I don't make automated decisions about you.
Who handles it
I'm the only person with access to your details. I use the services below to run the site and the form. Each one processes data on my behalf and only for that purpose:
- Vercel: website hosting.
- Cloudflare (Turnstile): spam protection on the form.
- n8n: the automation that receives the form and passes it on.
- Google (Gmail, Google Sheets): email and my list of requests.
- Google PageSpeed Insights: receives only your store's address, to run the speed test.
I only share data with authorities when the law requires it.
Transfers outside the EU
Some of these providers are based in the United States or use servers there. These transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.
How long I keep it
- Audit requests that don't lead to a project: 3 years after our last contact, then deleted.
- Clients: for the length of the project, then accounting records for as long as the law requires ({ACCOUNTING_RETENTION}).
- Do-not-contact list: only your email address, for as long as needed to respect your request.
- Technical logs at the hosting provider and Cloudflare: their own short, standard periods.
Your rights
You can ask me at any time to:
- show you the data I hold about you (access);
- correct it (rectification);
- delete it (erasure);
- limit how I use it (restriction);
- stop using it, including for prospecting, without giving a reason (objection);
- send it to you in a reusable format (portability).
Email contact@nicodes.xyz and I'll reply within one month. If you think I haven't handled your data properly, you can complain to {SUPERVISORY_AUTHORITY}.
Cookies
This site uses no analytics or advertising cookies, which is why there's no cookie banner. When you use the form, Cloudflare Turnstile runs a quick check in your browser to tell people from bots. It's used for nothing else.
Security
Only I can access the accounts that hold your details, and the site is served over HTTPS only.
Changes to this policy
If this policy changes, I'll update the date at the top of the page. If a significant change affects requests you've already sent, I'll tell you by email.