Privacy
What this site collects.
Everything it collects is described below, each with what is stored, why, for how long and who else sees it. Nothing is sold, nothing is shared beyond the services named here, and nobody is profiled.
Last changed 22 September 2026.
Who is responsible
This site is run by one person, and in the legal sense that person is the controller: Necati Atakan Alevli, in the Netherlands. There is no company behind it and no data protection officer, because neither is required at this size. Every question about data goes to the address at the bottom of this page, and every request is answered by him.
Analytics
Google Analytics, loaded through Google Tag Manager, records which pages are read, how long they are read for, roughly where in the world a visitor is, what kind of device they use, and which site or search they arrived from. Google derives the location from the IP address and does not store the address itself.
It is switched off until you accept it. The banner asks once; declining is one click with no consequences, and the site works identically either way. The legal basis is your consent, and a visitor who never answers is treated as having declined.
Reports are kept in Google Analytics for two months and then deleted. The measurement is not linked to your Google account, and the data is not used for advertising.
If you accepted and have changed your mind, or declined and want to allow it after all, this resets the choice and asks again.
The subscriber list
If you subscribe, the site stores your email address, the date you asked, and the date you confirmed, and nothing else. Confirmation is double opt-in: a link is sent to the address, and the address is only on the list once that link is opened, so nobody can be added by someone who cannot read their inbox. The legal basis is your consent, given by opening that link.
An address that is never confirmed is deleted after 30 days. A confirmed address stays until you leave. Every email carries an unsubscribe link that works in one click and deletes the address rather than flagging it; you can also ask for it to be deleted by replying to any email.
Separately from the list, a hashed form of your IP address is stored for 24 hours each time the form is used. It exists so that one sender cannot make the site send confirmation emails to strangers in bulk, it is not kept with your address, and it cannot be turned back into the address it came from.
The list is his own, held in his own database, and is not shared, sold, or uploaded anywhere to build an audience.
The contact form
A message sent through the form is stored with your name, your email address, the message, the language you wrote it in, the identifier your browser sends, and a hashed form of your IP address. The hash exists to stop one sender flooding the form, and it cannot be turned back into the address. A copy of the message, with the reason for writing if you picked one, is emailed to his own mailbox so that he sees it.
The legal basis is his legitimate interest in reading and answering what you sent him. Messages are deleted after twelve months. If you would rather not use the form, the email address on the contact page reaches the same person with none of this stored on the site.
The bot check
When either form is sent from a browser running JavaScript, an invisible check from Vercel BotID runs first. It reads characteristics of the browser and the device to tell a person from a script, and sends the outcome along with the form. Nothing is placed in your browser.
The site uses the answer, person or script, to decide whether to accept the form, and keeps nothing from it. Without JavaScript the check does not run and the form works as it always did. The legal basis is the legitimate interest in forms that software cannot flood.
The page check
The full-sight test can read a web address you give it, either in the box on that page or through the bookmarklet. This site fetches that address, reads the HTML it gets back, and works out the verdict in your browser. The page it fetched is not stored.
The address itself is kept, exactly as given and with the date and time, and it is kept indefinitely. That includes anything after a question mark in it, so an address carrying a name or an email address keeps those too. It is how he sees what the tool is used for and whether anyone is running it at a third party in volume. The legal basis is the legitimate interest in running a tool that is not abused.
It is not linked to you. The limit is enforced by counting requests against a one-way hash of your IP address, and those counts are deleted after a day. The checked address is written in a record of its own, without the hash, so the list of checked pages cannot be turned back into a list of who checked them.
Copy you paste into the box is different again: it is read in your browser, is never sent here, and is stored nowhere.
Server logs
The site runs on Vercel, which keeps short-lived request logs containing the IP address, the page requested and the time, as any web server does. These are operational records, used to keep the site running and to notice abuse, and are not used to profile anyone. The legal basis is the legitimate interest in running a site that works.
Cookies and storage
Everything this site places in your browser is listed below. Only the first two need your consent, and they are only set after you give it.
| Name | Set by | What it does | How long |
|---|---|---|---|
| _ga | Google Analytics, after consent | Tells one visit from another by giving your browser a random identifier. | Two years |
| _ga_… | Google Analytics, after consent | Keeps the state of the current visit. | Two years |
| NEXT_LOCALE | The site | Remembers whether you chose English or Dutch, so the next page is in the same language. | Until the browser closes |
| naa-consent | The site, in local storage rather than a cookie | Remembers your answer to the analytics question, so it is not asked again. | Until you clear it, or use the button above |
The language and consent entries are needed for the site to respect a choice you made, which is why they do not need consent themselves. There are no advertising cookies, no social media pixels and no third-party embeds.
The editor that publishes this site sets its own sign-in cookie, for its one user. A visitor never receives it.
Who else sees the data
Four services process data on his behalf, each under a data processing agreement, and each sees only what its job needs. Vercel hosts the site and runs the bot check; its servers that handle the forms and the page check run in Frankfurt. Supabase holds the database with the subscriber list, the contact messages and the list of checked pages, on servers in Ireland. Resend sends the confirmation and contact emails, from its European region. Google provides the analytics described above.
Where one of these companies processes data outside the European Union, the transfer rests on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses. No data is sold, rented or passed to anyone else, and no decision about you is made automatically.
What you can ask
You can ask what the site holds about you, have it corrected, have it deleted, have its use restricted, receive it in a portable form, or object to its use. Where something rests on your consent, you can withdraw that consent at any time, and the withdrawal does not affect what was lawful before it.
Send the request to the address below. It is answered within a month, and there is nothing to prove beyond that you control the address you write from. If you think a request was handled wrongly, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.
Changes to this page
When the site starts or stops doing something described here, this page changes in the same update, and the date at the top moves. There is no separate notice; the page is the notice.
Questions about any of this, or a request under the section above, go to marketing@atlantisdigital.nl.